CVE Vulnerability Catalog

A vulnerability was found in cak-filemanagement-system in the move_uploaded_file function of admin/add_logs.php. Manipulating the File argument allows unrestricted file upload, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.

A vulnerability was found in cak-filemanagement-system in the mysqli_query function of admin/save_student.php. Manipulating the date/department/subject/forwarded_to/action_taken_by/section/password arguments results in SQL injection, and the attack can be carried out remotely. The exploit has been made public and could be used.

The CP Multi View Events Calendar plugin for WordPress is vulnerable to stored cross-site scripting via the 'Subject' parameter in all versions up to and including 1.4.43 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary scripts that execute when a user accesses an injected page.

The GeoDirectory plugin for WordPress (versions up to and including 2.8.199) is vulnerable to Stored Cross-Site Scripting via the listing description (post_content). Insufficient input sanitization on save combined with the AyeCode UI library, which inserts the data-bs-content value as HTML into a popover, allows authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts.

In FreeRTOS-Kernel before V11.3.3, on MPU-enabled ports with queue sets enabled, missing queue-set type validation in the queue-set selection system call allows a local unprivileged task to write actor-controlled data beyond a pointer-sized object on the privileged kernel stack, affecting privileged memory across the MPU isolation boundary.

In JetBrains Toolbox App before 3.9.1 and 3.8.2, and in multiple JetBrains products (IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover) at the listed versions, the jetbrainsd daemon trusted compromised intermediate certificates. This could allow an attacker to impersonate a trusted party in the certificate chain.

In JetBrains products (IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover, DataSpell) before the versions specified in the description, the embedded browser trusted revoked intermediate certificates. This could lead to acceptance of invalid certificates.

The GeoDirectory plugin for WordPress (all versions up to and including 2.8.198) is vulnerable to arbitrary shortcode execution. The software allows users to execute an action that does not properly validate a value before running do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes.

The Essential Addons for Elementor plugin for WordPress up to 6.8.7 is vulnerable to privilege escalation via the page_id parameter of the register_user() function. An unauthenticated attacker can register an account with a role as high as Editor by abusing revision status and nonce bypass. Exploitation requires user registration enabled and an administrator having previously saved and reverted a non-default role on an affected page.

The Like Button Rating ♥ LikeBtn plugin for WordPress (all versions up to and including 2.6.64) is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header)' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits the injected page. Exploitation requires the administrator to have disabled the default 'Be GDPR compliant' option and an additional administrator action.

The Themify Builder plugin for WordPress (versions up to and including 7.8.4) is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts. Insufficient input sanitization and output escaping on the variations post meta allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute on the Custom Fonts admin listing.

The Majestic Support plugin for WordPress (all versions up to and including 1.2.2) is vulnerable to generic SQL Injection via the 'columns (array keys)' parameter due to insufficient escaping on user-supplied input and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers with subscriber-level access and above to append additional SQL queries to extract sensitive information from the database.

The Avada theme for WordPress up to 7.16.2 is vulnerable to arbitrary file upload via the convert_palette_images_to_truecolor() function. Insufficient file type validation before processing uploaded files allows unauthenticated attackers to upload executable files, enabling remote code execution.

The easy.jobs plugin for WordPress up to 2.8.4 is vulnerable to stored cross-site scripting via the 'cover_letter' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when an administrator opens the affected candidate's Application tab and clicks a crafted link.

The FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_video][]' parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user visits the injected page. This requires an administrator to have enabled the 'Allow visitors to upload videos to their profile' setting.

The Advanced Custom Fields: Extended plugin for WordPress up to 0.9.2.7 is vulnerable to sensitive information exposure. An unauthenticated attacker can extract the WordPress password hash of any user by injecting a {get_user} template tag that is resolved and written as a publicly readable term name. This requires a public [acfe_form] shortcode page with a Term action using a save.name field mapping.

The FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits the injected page. This requires the plugin's 'Parse Vimeo and YouTube links' setting to be enabled.

The FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits the injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve the comment containing the malicious shortcode.

The OpenStation plugin for WordPress (all versions up to and including 1.1.16) is vulnerable to authorization bypass due to improper verification of user authorization. This allows authenticated attackers with subscriber-level access and above to modify arbitrary other users' placement rows and read serialized metadata. Exploitation requires at least one orphaned placement to exist and the attacker to self-enable OpenStation.

The Email Templates Customizer and Designer plugin for WordPress up to 1.5.14 is vulnerable to authorization bypass due to improper verification of user authorization. An unauthenticated attacker can enumerate WooCommerce order IDs via the preview_order parameter and exfiltrate customer billing data (name, address, phone, email). Two unauthenticated requests are required.