CVE Vulnerability Catalog

The WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser.

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial.

Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming handler returns unescaped, executing JavaScript in victims' browsers.

Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers.

QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path parameter. Attackers can craft GET requests to /assets/php/_devtools/installer/step_2.php with malicious installation_path values echoed unescaped, executing JavaScript in victims' browsers.

webpack-dev-server versions 5.1.0 before 5.2.7 and version 6.0.0 have an unauthenticated open-editor endpoint that validates the Host header with a regular expression meant for browser Origin schemes. A Host value beginning with file: or an extension scheme bypasses hostname and allowedHosts checks, and URL construction throws. In default non-production mode the server returns HTTP 500 with a full stack trace, disclosing filesystem paths, module locations, and source line numbers.

The OpenVPN 3 Core library versions 3.4 through 3.11.7 has improper certificate validation, allowing attackers to circumvent extended key usage restrictions.

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress Extensions for Leaflet Map plugin allows Stored XSS. This issue affects Extensions for Leaflet Map through version 6.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress ND Shortcodes For Visual Composer plugin allows Stored XSS. This issue affects ND Shortcodes For Visual Composer through version 7.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress Waitlist Woocommerce (Back in stock notifier) plugin allows Stored XSS. This issue affects Waitlist Woocommerce (Back in stock notifier) through version 2.9.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin allows Stored XSS. This issue affects Restaurant Menu – Food Ordering System – Table Reservation through version 2.4.4.

The ЮKassa for WooCommerce plugin is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 2.17.3.

The myCred plugin is vulnerable to authorization bypass through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 4.0.0-beta.1.

The Page Restriction WordPress (WP) plugin by miniOrange is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.6.0.

The WP Desk ShopMagic plugin (shopmagic-for-woocommerce) has an insertion of sensitive information into an externally-accessible file or directory vulnerability, allowing retrieval of embedded sensitive data. This issue affects ShopMagic versions up to and including 4.9.1.

The WordPress plugin Off-Canvas Sidebars & Menus (Slidebars) up to version 0.5.9 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. User-supplied data is not properly sanitized, allowing malicious scripts to be stored.

The ACF Extended plugin through 0.9.2.7 contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. This may allow an attacker to access files outside the intended directory.

The Majestic Support plugin by Ahmad Majestic, versions up to 1.2.1, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The WordPress Sunshine Photo Cart plugin (through version 3.7.5) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of the flawed authorization settings.