CVE Vulnerability Catalog

The Campaign Monitor for WordPress plugin in versions through 2.9.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Easy Media Download WordPress plugin versions up to and including 1.1.11 is vulnerable to Reflection Injection due to improper neutralization of script-related HTML tags (Basic XSS). This could allow injection of malicious JavaScript.

The Flaming Password Reset WordPress plugin has a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This affects all versions up to and including 1.0.3.

The Effect Maker plugin (up to version 1.2.1) contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. This allows an attacker to execute malicious scripts in the context of the victim's browser.

Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Fluent Support: from n/a through <= 1.10.4.

Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core (woffice-core) allows exploiting incorrectly configured access control security levels. This issue affects Woffice Core versions up to and including 5.4.30.

Missing Authorization vulnerability in shinetheme Traveler allows exploiting incorrectly configured access control security levels. This issue affects Traveler from n/a through <= 3.2.6.

Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache allows accessing functionality not properly constrained by ACLs. This issue affects Aruba HiSpeed Cache from n/a through < 3.0.3.

The nK Themes Helper plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in versions up to and including 1.7.9. This allows an attacker to make requests from the server to arbitrary resources, potentially leading to unauthorized access to internal systems.

When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file.

The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.3.2. The plugin's framework component adds SVG to allowed MIME types without sanitizing SVG contents, allowing authenticated attackers with Author-level access and above to upload malicious SVG files.

When doing TLS transfers with reused easy or multi handles and altering the CURLSSLOPT_NO_PARTIALCHAIN option, libcurl could accidentally reuse a cached CA store for which the partial chain option was reversed. Contrary to user expectations, libcurl could find and accept a trust chain it otherwise would not.

When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host.

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread inadvertently changed them globally and could affect other concurrently set up transfers. Disabling certificate verification for a specific transfer could unintentionally disable the feature for other threads as well.

When using the CURLOPT_PINNEDPUBLICKEY option with libcurl or --pinnedpubkey with the curl tool, curl should check the public key of the server certificate. This check was skipped under a certain condition, allowing the connection without proper verification and failing to notice a possible impostor. The condition required a QUIC connection with ngtcp2 built with GnuTLS and explicit disabling of standard certificate verification.

A SQL injection vulnerability was identified in code-projects Intern Membership Management System 1.0 in the file /intern/admin/add_admin.php. Manipulation of the Username argument allows remote exploitation, and a public exploit may be used.

A vulnerability was found in code-projects Intern Membership Management System 1.0 in an unknown function of /intern/admin/edit_activity.php. Manipulation of the activity_id argument leads to SQL injection. The exploit is publicly available and can be used remotely.

A vulnerability has been found in code-projects Intern Membership Management System 1.0 affecting an unknown function of /intern/admin/edit_students.php. Manipulation of the admin_id argument leads to SQL injection, and the attack may be launched remotely. The exploit has been disclosed publicly and may be used.

A flaw was found in code-projects Intern Membership Management System 1.0 in an unknown function of /intern/admin/edit_admin.php. Manipulation of the admin_id argument causes SQL injection. The attack can be initiated remotely and the exploit has been published.

A flaw was found in Keycloak regarding the authorization header parser. This parser is overly permissive regarding the formatting of the 'Bearer' authentication scheme, accepting non-standard characters as separators and tolerating case variations that deviate from RFC 6750 specifications.