CVE Vulnerability Catalog

The WordPress plugin Web to SugarCRM Lead is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0.0. This is due to missing nonce validation on the custom field deletion functionality, allowing unauthenticated attackers to delete custom fields via a forged request if they can trick a site administrator into performing an action such as clicking a link.

The Ultimate Member plugin for WordPress in versions up to and including 2.11.0 is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode attributes due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages.

The Product Table for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_key' parameter in all versions up to and including 5.0.8 due to insufficient input sanitization and output escaping.

The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This allows unauthenticated attackers to modify arbitrary posts by providing a post_id parameter via the guest posting form, including changing titles, content, excerpts, and removing post authors.

The WC Builder – WooCommerce Page Builder for WPBakery plugin for WordPress in versions up to and including 1.2.0 is vulnerable to Stored Cross-Site Scripting via the 'heading_color' parameter (and multiple other styling parameters) of the 'wpbforwpbakery_product_additional_information' shortcode due to insufficient input sanitization and output escaping. This allows authenticated attackers with Shop Manager-level access or higher to inject arbitrary web scripts into pages.

The Tainacan plugin for WordPress is vulnerable to unauthorized metadata section creation due to missing authorization checks in all versions up to, and including, 1.0.1. The create_item_permissions_check() function unconditionally returns true, bypassing authentication and authorization validation.

The WishSuite plugin for WordPress in versions up to and including 1.5.1 is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter of the 'wishsuite_button' shortcode due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages.

The Five Star Restaurant Reservations – WordPress Booking Plugin is vulnerable to Stored Cross-Site Scripting via the 'rtb-name' parameter in all versions up to and including 2.7.5 due to insufficient input sanitization and output escaping.

The Amazon affiliate lite Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.0. Missing nonce validation on the 'ADAL_settings_page' function allows unauthenticated attackers to update plugin settings via a forged request, if they can trick an administrator into clicking a link.

The Responsive and Swipe slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the rsSlider shortcode in all versions up to and including 1.0.2 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject scripts that execute when a user accesses an injected page.

The F70 Lead Document Download plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check in the 'file_download' function in versions up to and including 1.4.4. Unauthenticated attackers can download any file from the WordPress media library by guessing or enumerating attachment IDs.

The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() function in all versions up to, and including, 2.0.0. This makes it possible for unauthenticated attackers to retrieve the Google API key set in the plugin's settings.

A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer. It allowed a crafted SOAP request with an oversized namespace prefix to cause memory corruption in stack. An unauthenticated attacker on the same local network may exploit this flaw to enable remote code execution with elevated privileges, leading to full compromise of the device.

FastAPI Users prior to version 15.0.2 has a login CSRF vulnerability due to stateless OAuth state tokens that are not linked to the initiating session. An attacker can exploit this to take over the victim's account or log the victim into the attacker's account.

A vulnerability was determined in FastAdmin up to 1.7.0.20250506. Affected is the function selectpage of the file application/common/controller/Backend.php of the component Backend Controller. Executing a manipulation of the argument custom/searchField can lead to SQL injection. It is possible to launch the attack remotely, and the exploit has been publicly disclosed.

A flaw in code-projects Simple Stock System 1.0 affects an unknown function in the file /market/chatuser.php, leading to cross site scripting (XSS). The attack can be carried out remotely. The exploit has been published and may be used.

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.8.1 through 2.52.0, an attacker with an account on a CVAT instance is able to retrieve the contents of any file system directory accessible to the CVAT server. The exposed information is names of contained files and subdirectories. The contents of files are not accessible. Version 2.53.0 contains a patch.

CSRF vulnerability in Turms Admin API up to v0.10.0-SNAPSHOT allows attackers to gain escalated privileges.

Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transactions. Version 1.2.0 fixes the issue.

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest() method in UserServiceController.java allows any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks.