CVE Vulnerability Catalog

In Group-Office prior to versions 26.0.25, 25.0.100, and 6.8.165, authenticated users can persist arbitrary legacy settings for any user_id. A separate issue in the email module injects the email_font_size setting directly into JavaScript without escaping. A low-privileged user can overwrite an administrator's email_font_size setting with a JavaScript payload and trigger stored XSS in the administrator's browser.

In Mautic 7, a stored XSS vulnerability exists in the project selector component. The application fails to sanitize project names returned via AJAX before injecting them into the DOM, allowing an authenticated user to store a malicious script.

A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests from the hosting server, enabling internal network reconnaissance or forcing requests to arbitrary internal or external destinations.

The Rank Math SEO plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in the update_site_editor_homepage function. Unauthenticated attackers can modify plugin settings like homepage title, meta description, breadcrumbs label, and social media metadata, severely impacting SEO rankings and potentially displaying malicious content.

The Contact Form 7 – PayPal & Stripe Add-on plugin for WordPress up to version 2.4.9 allows payment bypass. An attacker can mark any order as paid by making a minimal real payment and manipulating the invoice parameter in IPN.

Improper access control in the MQTT broker allows wildcard topic subscriptions, exposing all MQTT traffic to unauthorized actors.

The ITS Intelligent SCADA System developed by ITP Technology has a Stored Cross-Site Scripting vulnerability, allowing privileged remote attackers to inject persistent JavaScript codes that are executed in users' browsers upon page load.

The ITS Intelligent SCADA System developed by ITP Technology has a Stored Cross-Site Scripting vulnerability, allowing privileged remote attackers to inject persistent JavaScript codes that are executed in users' browsers upon page load.

In the Quay config-tool, the LDAP and SMTP validation functions make outbound connections to user-supplied endpoints without proper IP or host filtering. An attacker with config editor access can exploit these functions to perform internal network reconnaissance from the Quay pod's network position.

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3.28.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires that the attacker also supply a valid 'orderby' parameter in the same request, as this is necessary to reach the vulnerable code path that processes and concatenates the 'order' value into the SQL query.

The Plus Addons for Elementor plugin for WordPress up to version 6.4.15 contains a stored XSS vulnerability via the 'carousel_direction' parameter in the Carousel Anything widget. Insufficient output escaping in the render() function allows HTML attribute injection, enabling authenticated attackers (contributor-level and above) to inject arbitrary scripts.

The Wireless Control Module (WCM) of the 2025 Indian Motorcycle Scout Bobber + Tech uses weak authentication. An attacker with access to the in-vehicle network can recover the user-set unlock PIN by passively observing a single authentication exchange, as the display response uses a non-cryptographic operation.

The Simple Divi Shortcode plugin for WordPress up to version 1.2 contains a Stored XSS vulnerability via the 'id' parameter of the [showmodule] shortcode. An attacker with contributor-level access can inject arbitrary HTML/JavaScript.

Service Center by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability. An authenticated attacker can modify a parameter in a specific query function to access other users' EC order details.

A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libsoup proxy server or as a proxy in front of a non-libsoup backend server.

The StatCounter plugin for WordPress up to version 2.1.1 has a Stored XSS vulnerability. The statcounter_addToTags() function outputs the post author's nickname in a JavaScript context without proper escaping, allowing authenticated attackers with Author-level access to inject scripts.

The Automotive Car Dealership Business WordPress Theme is vulnerable to Stored Cross-Site Scripting via the 'Project Details' custom field in Portfolio Items. The vulnerability is due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level permissions or higher can inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Breeze plugin for WordPress up to version 2.5.2 exposes sensitive information to unauthenticated attackers. When caching for logged-in users is enabled, the plugin improperly verifies the 'wordpress_logged_in_' cookie, allowing attackers to impersonate an administrator and read private content.

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress up to version 6.3.7 contains a sensitive information exposure vulnerability. The AJAX action 'ays_poll_get_user_information' serializes and returns the full WP_User object (including password hash, email, login, roles, and capabilities) without nonce verification or capability check beyond is_user_logged_in(). This allows authenticated attackers with subscriber-level access or above to retrieve their own password hash, which WordPress does not normally expose, and can be used for offline password cracking.

The Post Snippets plugin for WordPress up to version 4.0.19 is vulnerable to Stored Cross-Site Scripting due to insufficient output escaping of snippet content when rendering JavaScript variables in the post editor, where double quotes are not properly handled. An authenticated attacker with Administrator access can inject malicious scripts via an imported file that execute when any administrator accesses the post editor.