CVE Vulnerability Catalog

Dell PowerProtect Data Domain in multiple versions contains an OS command injection vulnerability. The flaw is due to improper neutralization of special elements used in OS commands.

A vulnerability in Dell PowerProtect Data Domain allows unauthorized command execution by a local attacker with high privileges due to incorrect authorization.

Dell PowerProtect Data Domain in multiple versions contains an improper link resolution before file access vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

A vulnerability in Dell PowerProtect Data Domain allows insertion of sensitive information into log files. A low-privileged attacker with local access could exploit this to expose confidential data.

Dell PowerProtect Data Domain in multiple versions contains an improper link resolution before file access vulnerability. It allows a high privileged attacker with local access to gain unauthorized access to the system.

Dell PowerProtect Data Domain systems in multiple versions are vulnerable due to incorrect permission assignment for a critical resource. A high-privileged attacker with local access could exploit this to gain unauthorized access.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.6, LTS2026 release 8.6.1.0 through 8.6.1.10, LTS2025 release 8.3.1.0 through 8.3.1.30, and LTS2024 release 7.13.1.0 through 7.13.1.70 contain an improper access control vulnerability in RBAC. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information tampering.

Dell PowerProtect Data Domain in multiple versions contains an OS command injection vulnerability. A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands.

The RTMKit (rometheme-for-elementor) plugin for WordPress up to version 2.0.7 is vulnerable to Local File Inclusion (LFI). This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This allows authenticated attackers with Contributor-level access and above to include and execute files on the server ending in _templates.php, enabling the execution of any PHP code in those files.

The Destekz plugin from Raera - Ankara Web Design and Digital Advertising Agency contains a reflected XSS vulnerability due to improper input neutralization during page generation. The issue affects versions up to 02062026, and the product is no longer supported by the vendor.

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to and including 2.2.1 due to insufficient input sanitization and output escaping.

The Zakra theme for WordPress up to version 4.2.0 is vulnerable to Stored Cross-Site Scripting. The REST API path bypasses sanitization for three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, zakra_menu_item_active_color), allowing authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when users view the page.

A vulnerability in Dell Client Platform BIOS allows authentication bypass due to a primary weakness. An unauthenticated attacker with physical access could potentially exploit this flaw, leading to information disclosure.

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress up to version 2.8.16 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'data' attribute of the [adinserter] shortcode. The replace_ai_tags() function processes a {reusable-block-N} tag pattern calling get_post_field('post_content', N) without verifying user capabilities, restricting the post type to 'wp_block', or checking the post status.

The CURCY – Multi Currency for WooCommerce plugin for WordPress up to version 2.2.14 allows unauthenticated attackers to execute arbitrary shortcodes. This is due to insufficient validation of a value before passing it to the do_shortcode function.

The LatePoint plugin for WordPress up to version 5.6.1 is vulnerable to authorization bypass. Unauthenticated attackers can modify personally identifiable information (first name, last name, phone number, and notes) of any existing customer record, including administrator accounts, by submitting the booking form with a known email address. Exploitation requires guest bookings to be enabled.

The Quiz and Survey Master (QSM) plugin for WordPress up to version 11.1.4 is vulnerable to authorization bypass. Authenticated attackers with contributor-level access or higher can modify quizzes they do not own, overwrite result pages, and redirect notification emails to attacker-controlled addresses.

A vulnerability in Puppet resource_api causes sensitive parameters (e.g., passwords) to not be flagged as sensitive and are stored in cleartext in the agent's local transaction state cache. Affected versions include resource_api 1.5.0 through 1.9.1 and 2.0.0.

The RTMKit plugin for WordPress up to version 2.0.7 contains a stored XSS vulnerability in the Advanced Heading widget. It stems from insufficient output escaping of the 'Background Text' parameter in the render() function, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts.

libcurl might in some circumstances reuse the wrong connection when asked to do Negotiate-authenticated ones, even when they are set to use different 'services'. Due to a logical error in the code, a request issued by an application could wrongfully reuse an existing connection to the same server that was authenticated using different services.