CVE Vulnerability Catalog

The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several REST API routes, allowing unauthenticated users to modify the permalink of any published post and read plugin configuration data.

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint `/wp-json/wc-srp/v1/earning` in versions up to, and including, 32.7.0. This is due to the `user_has_cap` filter in the `SRP_REST_Earning_Controller` class unconditionally granting the custom `rs_earning_read` capability to all users — including unauthenticated visitors — combined with missing sanitization of the `reason` parameter in the `create_items()` function and missing output escaping in the `column_default()` method of `SRP_Master_Log`. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into the reward points log that will execute whenever an administrator accesses the Master Log or User Reward Points admin pages.

The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute whenever a user accesses an injected page. The exploit chain combines a server-side gap (matrix sub-field keys are not sanitized) with a client-side gap (DOMPurify is only invoked for strings, but matrix values are arrays).

In the Linux kernel, a vulnerability in XFS filesystem: functions xfs_reflink_fill_cow_hole and xfs_reflink_fill_delalloc cycle the ILOCK to grab a transaction, causing data fork mappings to become stale. Failure to refresh the data fork mapping before re-querying the COW mapping can lead to incorrect *shared values, potentially causing writes to wrong physical blocks.

The @fastify/static library up to version 10.1.0 fails to reject '..' path segments before file resolution. This allows bypassing path traversal protections and reading files inside the static root that are under a guarded URL prefix. The issue is patched in version 10.1.1.

In the facil.io library up to version 0.7.4, a vulnerability was found in the websocket_on_protocol_error function in websocket_parser.h. Manipulation of the on_message argument leads to improper input validation, which can be exploited remotely. The project has not responded to the issue report.

Oracle Platform Security for Java (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 have an easily exploitable vulnerability allowing a low-privileged attacker with network access via HTTP to take over the product. CVSS 8.8.

Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) in versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable by a low-privileged attacker with network access via HTTP, can lead to takeover of Oracle Platform Security for Java. CVSS 8.8.

A vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can compromise the component. CVSS 8.8.

Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can compromise the system.

A vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, requires physical segment access and low privileges. Successful attack can lead to product takeover and impact other products (scope change). CVSS 8.0.

A vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, it allows a low-privileged attacker with network access via HTTP to compromise and take over the component. CVSS 7.5.

Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) allows a low-privileged attacker with network access via SOAP to take over the system. CVSS score 8.8.

A vulnerability in Protegent 360 v2.0.0.4 by Unistal Systems allows a local attacker to escalate privileges via the sub_186f4 function.

A vulnerability in Protegent 360 v2.0.0.4 by Unistal Systems allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys.

The IP Login extension for Joomla accepts client IP headers without requiring a configured trusted proxy. Attackers can spoof the IP used for automatic login and potentially impersonate mapped accounts.

Multiple Regular Labs extensions for Joomla! disclose restricted content via the Smart Search index: indexing can render generated content using the indexing administrator's identity instead of a public guest, causing restricted or administrator-only content to be stored in the public search index.

The Joomla Regular Labs Extension Manager did not consistently check CSRF tokens or permissions during admin, install, update, and uninstall operations. An unauthorized backend user or CSRF attack could install, update, or remove extensions.

The DB Replacer extension for Joomla does not consistently require Super User permission or a valid token for administrator routes and replacement requests. An unauthorized backend user or CSRF attack can perform database replacements, potentially causing major data corruption or site compromise.

Multiple Regular Labs extensions for Joomla did not consistently check CSRF tokens, item permissions, or input validation in admin actions, editor popups, and import/export operations. Unauthorized backend users or CSRF attacks could expose, create, or modify extension configuration and items.