CVE Vulnerability Catalog

A missing authentication vulnerability in the SSH keys synchronization endpoint allows an unauthenticated attacker to retrieve the list of users, their groups, and uploaded public SSH keys.

A Stored HTML Injection vulnerability was discovered in N2OS in the Diagram tab and Graph view due to insufficient input validation. An authenticated administrator can inject malicious HTML tags into configuration data, which renders in a victim's browser when viewing the affected data. This enables phishing and possible open redirect attacks, though full XSS and direct information disclosure are prevented by existing controls.

The Download Manager plugin for WordPress up to version 3.3.61 inclusive is vulnerable to Stored Cross-Site Scripting via 'note_before' and 'note_after' shortcode attributes due to insufficient input sanitization and output escaping.

The Mail Mint plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter in versions up to and including 1.24.2. This is due to insufficient escaping and lack of proper SQL query preparation.

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' Shortcode Attribute in all versions up to and including 5.113.0 due to insufficient input sanitization and output escaping.

The GamiPress plugin for WordPress up to version 7.9.4 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'access' parameter due to missing validation on a user-controlled key. Unauthenticated attackers can view private GamiPress activity logs, including badge earnings, points balance changes, and events from integrated plugins like WooCommerce, LearnDash, and BuddyPress.

The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'stag' parameter in all versions up to and including 2.3.4 due to insufficient input sanitization and output escaping.

The Ultimate Post plugin for WordPress up to version 5.0.31 is vulnerable to Stored Cross-Site Scripting. Attackers with contributor-level access or higher can inject malicious JavaScript via the 'moreResultsText' attribute of the advanced search block due to insufficient input sanitization and output escaping.

The WPFunnels plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 3.12.7 via the 'logKey' parameter. Authenticated attackers with administrator-level access can include and execute arbitrary .php files on the server.

The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 1.17.5 due to insufficient escaping and lack of query preparation. This allows authenticated attackers with custom-level access and above to append additional SQL queries to existing ones.

The User Frontend plugin for WordPress up to version 4.3.7 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'wpuf_files_data' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to overwrite the post_title, post_content, and post_excerpt of any arbitrary post, including administrator posts.

The User Frontend plugin for WordPress up to version 4.3.7 has an authorization bypass vulnerability. Unauthenticated attackers can delete arbitrary media attachments with post_author 0 via the wpuf_file_del AJAX action.

The AcyMailing plugin for WordPress up to version 10.10.2 is vulnerable to Stored Cross-Site Scripting via the 'alignment' attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress is vulnerable to unauthorized plugin installation and activation in versions up to and including 3.4. This is due to a missing capability check and missing nonce validation on the pg_install_profilegrid() AJAX handler, allowing authenticated attackers with Subscriber-level access and above to install and activate the ProfileGrid plugin from the WordPress repository.

The Fediverse Embeds WordPress plugin before version 1.5.8 does not validate the destination URL of server-side requests made by an unauthenticated site-info endpoint. This allows anonymous users (the nonce is exposed on public pages with an embed) to make the site request internal and private network URLs and read back the parsed page metadata.

The Fediverse Embeds WordPress plugin before version 1.5.8 does not validate the destination URL of a server-side request made by an unauthenticated media-proxying endpoint. This allows anonymous users to fetch arbitrary URLs, including internal and private network addresses, and read back the response body.

The Everest Forms WordPress plugin before version 3.5.0 incorrectly restricts access to several REST API endpoints belonging to its onboarding assistant. The capability check is only applied when an attacker-controllable request header holds a specific value, so it can be bypassed by omitting or changing that header.

The WP Support Plus Responsive Ticket System WordPress plugin through version 9.1.2 does not sign or verify its guest-session cookie, allowing unauthenticated attackers to forge it and impersonate any ticket owner (identified by email address) to read, reply to, and close that person's support tickets.

The WP DSGVO Tools (GDPR) WordPress plugin before version 3.1.40 lacks an authorization check on the immediate-processing path of its data subject access request feature, allowing unauthenticated attackers to generate and download the full personal-data export (including name, postal address, phone number, email, and comment content) of any user, customer, or commenter by supplying their email address.

A path traversal vulnerability has been detected in mcp-text-editor up to version 1.0.2. The issue affects the _validate_file_path function in mcp_text_editor/text_editor.py, where manipulation of the file_path argument allows remote attacks. The exploit has been publicly disclosed and may be used.