CVE Vulnerability Catalog

The HAPPY (happy-helpdesk-support-ticket-system) plugin by VillaTheme in versions up to and including 1.0.9 contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This may allow unauthorized users to access functions or data they should not have access to.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vikas Ratudi VPSUForm v-form allows Retrieve Embedded Sensitive Data. This issue affects VPSUForm from n/a through <= 3.2.24.

The Responsive Posts Carousel Pro plugin for WordPress is vulnerable to stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 15.2.

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_page_custom_js' parameter in all versions up to and including 3.20.3 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts into pages that execute when a user visits the injected page, despite the intended restriction of Custom JS to Administrators.

The Restrict Content plugin for WordPress in versions up to and including 3.2.15 is vulnerable to Stored Cross-Site Scripting via the 'register_form' and 'restrict' shortcodes due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages.

The Calendar plugin for WordPress in versions up to and including 1.3.16 is vulnerable to Stored Cross-Site Scripting via the 'event_desc' parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, provided they can convince an administrator to enable lower privilege users to manage calendar events.

The Premium Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.11.53. This is due to missing nonce validation in the 'insert_inner_template' function, allowing unauthenticated attackers to create arbitrary Elementor templates via a forged request if they can trick a site administrator or other user with edit_posts capability into performing an action such as clicking a link.

The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the 'get_template_content' function in all versions up to and including 4.11.53. This allows unauthenticated attackers to view the content of private, draft, and pending templates.

Local Deep Research versions 1.3.0 to before 1.3.9 makes HTTP requests using raw requests.get() without the application's SSRF protection (safe_requests.py). This can allow attackers to access internal services, attempt to reach cloud provider metadata endpoints (AWS/GCP/Azure), and perform internal network reconnaissance by submitting malicious URLs through the API. The issue is patched in version 1.3.9.

LibreNMS prior to version 25.12.0 is vulnerable to stored cross-site scripting in the Alert Rule API. Alert rules can be created or updated via the LibreNMS API, and the alert rule name is not properly sanitized, allowing HTML code injection. This issue has been patched in version 25.12.0.

Marshmallow, a lightweight library for converting complex objects to and from simple Python datatypes, in versions from 3.0.0rc1 to before 3.26.2 and from 4.0.0 to before 4.1.2, is vulnerable to denial of service in Schema.load(data, many=True). A moderately sized request can consume a disproportionate amount of CPU time. The issue is patched in versions 3.26.2 and 4.1.2.

Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php).

A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to inject malicious JavaScript or HTML into the Name field, leading to script execution in victims' browsers.

A stored cross-site scripting (XSS) vulnerability exists in the Page Settings module of Piranha CMS v12.1. Attackers can inject malicious JavaScript or HTML into the Excerpt field, leading to script execution in victims' browsers.

PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module. The vulnerability allows injection of malicious script that may execute in the user's browser.

A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FuguHub does not sanitize or restrict script execution inside SVG content, allowing execution of attacker-controlled JavaScript when a victim opens a crafted SVG.

An error in the SignServer container startup logic in Keyfactor SignServer versions prior to 7.2 causes the Admin CLI command configuring certificate access to set the "allowany" property on every container restart instead of only on first startup. This resets the configuration to allow any user with a valid trusted client auth certificate to connect.

A vulnerability in WooCommerce versions 8.1 to 10.4.2 allows logged-in customers to access order data of guest customers on sites with a certain configuration. It has been fixed in WooCommerce 10.4.3 and in point releases for previously affected versions starting from 8.1 (fixed in 8.1.3). WooCommerce 8.0 and earlier are not affected.

MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the msgtipo parameter.

MyNET up to v26.05 contains a reflected cross-site scripting (XSS) vulnerability via the msg parameter. An attacker can inject malicious JavaScript that is reflected in the server response and executed in the victim's browser.