CVE Vulnerability Catalog

Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprotected setToggleVisibilityAction and updatePositionAction to make logged-in administrators delete, hide or reorder catalogue and configuration objects.

DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the output_dir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files to exhaust disk or inodes and use error messages as a filesystem oracle.

Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers can distribute a skill bundle with an unchecked-hash .pyc under scripts/<subdir>/__pycache__/ that ramparts silently ignores, while CPython executes it when the skill runs.

Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.

LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission read functions to view other students' work, grades and instructor feedback.

The Web 2.0 Directory plugin for WordPress in versions up to and including 2.10.12 is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' parameter. Unauthenticated attackers can append additional SQL queries to existing queries, enabling extraction of sensitive information from the database. Because the parameter is used in integer context without surrounding quotes, WordPress's built-in addslashes/magic_quotes escaping provides no protection against time-based payloads such as SLEEP-based conditionals.

The BuddyBoss Platform plugin for WordPress (up to and including 3.6.0) is vulnerable to Stored Cross-Site Scripting via Group Name due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that will execute when a user accesses an injected page. This requires the "Enable social group creation by all members" setting to be enabled, which is the default.

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. decompress_xpi_thread() used libarchive with archive_read_support_format_all(), allowing a TAR file named *.xpi to be extracted; a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a warning dialog, when the user installs or opens the crafted .xpi.

A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In set_permission(), types CLIPBOARD and WEBSITE_DATA_ACCESS are not stored, so control fell into an else-if branch that always set EPHY_PERMISSION_PERMIT for ACCESS_WEBCAM and ACCESS_MICROPHONE. A malicious site that obtains approval for clipboard or third-party storage access can afterwards use getUserMedia without a further camera/microphone prompt.

The GeoDirectory plugin for WordPress (up to and including 2.8.197) is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that will execute when an Administrator or Editor opens the pending listing's edit screen. The payload does not fire for the attacker directly but executes in the victim's browser, enabling privilege escalation.

The Germanized for WooCommerce plugin (up to and including 4.1.4) is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse. The on_user_email_changed hook, responsible for rotating the activation token and recording a pending-email-change marker, is only registered inside the is_double_opt_in_login_enabled() branch when "Disable login for unactivated customers" is set to Yes, leaving the original ?activate= token valid and unbound to the email address when the setting is No. An authenticated attacker with subscriber-level access can change their account email to a victim's billing email and redeem the original activation token to reassign guest orders and expose the victim's billing data.

The FlexStock plugin for WordPress (up to and including 3.17.2) is vulnerable to Stored Cross-Site Scripting via the 'products[].post_content' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access and above can inject arbitrary web scripts into pages that will execute when a user accesses an injected page. This is exploitable by any Subscriber-level user because the plugin's admin_enqueue_scripts callback exposes the REST bearer token in the Dashboard page source without a capability check, and the REST endpoint's permission_callback validates only that bearer token rather than performing a current_user_can() capability check.

The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '<fieldname>_start / <fieldname>_end' parameter in all versions up to and including 3.3.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link. The vulnerability is only exploitable on product pages where a Date & Time Range Picker extra field is configured, though the required field name is visible in the product page source.

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'querystring:<key>' URL parameter in all versions up to and including 3.15.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link. The bypass is triggered when an attacker supplies a matching 'field:<key>' URL parameter that causes the server to fully resolve the {field:*} placeholder, forcing the client-side else-branch to abandon the server-sanitized value and reconstruct field content from the raw query string.

The Smart Post plugin for WordPress (versions up to and including 4.0.9) is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page. Exploitation requires the victim page to contain an Author Filter block alongside a grid or live-filter block, and execution is triggered by a visitor clicking the attacker's author entry in the dropdown.

The All in One SEO plugin for WordPress in versions up to and including 5.0.3 is vulnerable to Sensitive Information Exposure via the 's' parameter. Unauthenticated attackers can extract arbitrary non-public post meta values, including sensitive custom fields such as API keys and internal notes, which are emitted verbatim into the HTML title element and JSON-LD SearchResultsPage schema.

The Amelia (Booking for Appointments and Events Calendar) plugin for WordPress in versions up to and including 2.4.12 is vulnerable to Sensitive Information Exposure via the 'page' parameter. Unauthenticated attackers can extract staff personally identifiable information (full name, email address, phone number, gender, timezone) and administrator-authored internal notes for every published event, because the raw providers array is never stripped before output in the JSON response.

The Newsletters plugin for WordPress in versions up to and including 4.18.1 is vulnerable to time-based SQL Injection via the 'id' parameter due to insufficient escaping of user-supplied input and lack of proper preparation of the existing SQL query. An authenticated attacker with subscriber-level access or higher can append additional SQL queries to existing queries to extract sensitive information from the database. An attacker can obtain the required nonce and subscriberauth cookie without a WordPress account by subscribing through the public newsletter form and opening the management link sent via email; the ownership check verifies only the subscriber_id field and does not validate that the injected id parameter belongs to the authenticated subscriber.

The SEOPress plugin for WordPress (up to 10.3) is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with Subscriber-level access to inject arbitrary scripts that execute when a user visits an injected page. The payload uses the %%archive_title%% token with HTML, and the plugin substitutes the token after escaping.

The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter (mapped to display_name) in versions up to and including 4.17.0 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or higher can inject arbitrary scripts that execute when a user visits the injected page. Exploitation requires the attacker's account to have a mapped author term, which is not present by default for new users.