CVE Vulnerability Catalog

The SEO Booster plugin for WordPress is vulnerable to time-based SQL injection via the 'orderby' parameter in all versions up to and including 7.3.1. This is due to insufficient escaping and lack of proper SQL query preparation, allowing authenticated attackers with administrator-level access to append additional SQL queries.

The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' search parameter in all versions up to and including 7.6.1. This is due to insufficient input sanitization and output escaping.

The Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' Block Attribute in all versions up to and including 3.1.6 due to insufficient input sanitization and output escaping.

The Catch Themes Demo Import plugin for WordPress up to version 3.3 inclusive has an authorization flaw. The catch_themes_demo_import_activate_plugin() function, hooked on admin_init with the activate_plugin GET parameter, installs the 'essential-content-types' plugin before checking current_user_can('activate_plugins'). This allows authenticated attackers with subscriber-level access or higher to install that plugin.

The GiveWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitter_message' Sequoia Template Setting in all versions up to and including 4.16.3 due to insufficient input sanitization and output escaping.

The MxChat – AI Chatbot & Content Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 3.2.10 due to insufficient input sanitization and output escaping.

The MultiVendorX plugin for WordPress is vulnerable to generic SQL injection via the 'order_by' parameter in versions up to and including 5.0.9. Insufficient escaping and lack of proper SQL query preparation allow authenticated attackers with subscriber-level access or higher to append additional SQL queries.

The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.95.0 via the sanitize_status function. This allows authenticated attackers with contributor-level access and above to extract titles, full content, excerpts, dates, authors, and custom-field metadata of other users' pending-review, scheduled, and trashed posts by embedding a crafted [catlist] shortcode in their own draft and previewing it.

The Landing Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.5.3.6. Missing nonce validation in the ulpb_admin_ajax function allows unauthenticated attackers to perform unauthorized actions on posts and post meta.

A vulnerability was found in TOKO-ONLINE-ROTI up to version ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99 in an unknown function of the file proses/add.php. Manipulation of the argument kd_cs leads to authorization bypass. The attack can be carried out remotely.

A vulnerability in Anubis Web AI Firewall Utility from version 1.22.0 to 1.26.0-pre1 allows an attacker to bypass the Anubis challenge by manipulating the X-Original-URI header. The PathChecker.Check() function trusted the client-controlled header before matching r.URL.Path, enabling the use of ALLOW rules for patterns like ^/\.well-known/.*$.

Wekan before version 9.34 has a vulnerability in the cloneBoard method that allows an authenticated user to clone any board (knowing its ID) without permission checks. This enables reading cards, comments, attachments, member information, and activities from private boards.

In Wekan prior to version 9.32, webhook URLs stored from user input are not validated against internal network connections. A board administrator can configure webhooks that cause server-side requests to internal or metadata services.

In Wekan prior to version 9.32, REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAccess instead of write-level Authentication.checkBoardWriteAccess for mutating custom-field routes. A read-only board member can call POST, PUT, and DELETE handlers for /api/boards/:boardId/custom-fields and custom-field dropdown items to create, update, or delete board custom fields.

Stored Cross-Site Scripting (XSS) vulnerability in the YouTubeAPI plugin of AVideo (versions 29.0 and below). An attacker can inject malicious JavaScript by setting a YouTube video title, which is then rendered on the AVideo homepage without HTML encoding.

AVideo prior to version 29.0 contains an unauthenticated Reflected XSS vulnerability in YouTubeAPI Gallery Pagination. The $_GET['search'] parameter is concatenated directly into the href attribute of pagination links without proper encoding, allowing arbitrary JavaScript injection.

Dulwich through version 1.1.0 is missing SSH host key verification in contrib/paramiko_vendor.py. This means that during SSH connections, the server's public key is not checked for trustworthiness.

Heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0. An attacker can cause a Denial of Service (DoS) by supplying crafted input.

A Cross Site Scripting (XSS) vulnerability has been discovered in xxl-job-admin version 3.0.0. A remote attacker can exploit a crafted HTTP GET request containing a malicious script to execute arbitrary code in the victim's browser context.

Listmonk prior to version 6.2.0 contains an SQL injection vulnerability in the GET /api/subscribers/export endpoint. The user-controlled query parameter is passed to QuerySubscribersForExport without validation, allowing an authenticated user with appropriate permissions to read arbitrary database tables and execute data-modifying PostgreSQL CTEs.