CVE Vulnerability Catalog

A stored cross-site scripting (XSS) vulnerability in the PwdGrp.cgi endpoint of AVTECH DGM1104 allows attackers to inject malicious JavaScript or HTML into the username field. Successful exploitation enables arbitrary script execution in the victim's browser context.

An authenticated command injection vulnerability was discovered in the test_mail function of AVTECH SECURITY DGM1104 (firmware version FullImg-1015-1004-1006-1003). This flaw allows an attacker to execute arbitrary system commands via crafted input.

A vulnerability was identified in ProudMuBai GoFilm 1.0.0/1.0.1 in the SingleUpload function of the file /server/controller/FileController.go. Manipulation of the File argument leads to unrestricted upload. The attack may be initiated remotely, and the exploit is publicly available and might be used.

A vulnerability was determined in opsre go-ldap-admin up to 20251011. This issue affects some unknown processing of the file docs/docker-compose/docker-compose.yaml of the component JWT Handler. Manipulation of the argument secret key can lead to use of hard-coded cryptographic key. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized.

The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar" function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with subscriber level access and above, to import arbitrary calendars and manage them.

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the "create_img_preload_tag" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the getTermsForAjax function in all versions up to, and including, 3.40.1. This is due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level access and above to append additional SQL queries into existing queries to extract sensitive information from the database, granted they have metabox access for the taxonomy (enabled by default for contributors).

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress in versions up to and including 3.40.1 is vulnerable to authorization bypass. The "taxopress_merge_terms_batch" function does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with subscriber-level access and above to merge or delete arbitrary taxonomy terms.

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via the "woof_add_query" and "woof_remove_query" functions due to missing validation on a user-controlled key. This makes it possible for authenticated attackers with subscriber-level access and above to insert or remove arbitrary saved search queries into any user's profile, including administrators.

The Post SMTP plugin for WordPress in versions up to and including 3.6.1 is vulnerable to authorization bypass. The 'handle_gmail_oauth_redirect' function does not properly verify that a user is authorized to update OAuth tokens, allowing authenticated attackers with subscriber-level access and above to inject invalid or attacker-controlled OAuth credentials.

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5. Missing nonce validation on the "post_add_to_list" function and an incorrect permissions callback in the "Api/init" function allow an unauthenticated attacker to add or remove products from a user's wishlist via a forged request if they trick a site user into clicking a link.

User enumeration in Nagvis' Checkmk MultisiteAuth before version 1.9.48 allows an unauthenticated attacker to enumerate Checkmk usernames.

A Protection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass. This issue affects ALZip from 12.01 before 12.29.

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces and bzm project Ids. Prior to this fix, anyone could see this list as a dropdown on the Jenkins UI.

The FluentCart plugin for WordPress is vulnerable to SQL Injection via the 'groupKey' parameter in all versions up to, and including, 1.3.1. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with Administrator-level access and above to append additional SQL queries into existing queries to extract sensitive information from the database.

The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 via upload filenames. This makes it possible for unauthenticated attackers to extract session values that can subsequently be used to access conversation data.

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin for WordPress in versions up to and including 2.3.8 is vulnerable to unauthorized access due to a missing capability check on the process_status_unlink() function. This allows unauthenticated attackers to delete backup progress files and cause a backup to fail while it is in progress.

The CSSIgniter Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' shortcode attribute in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with Contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

In ImageMagick, prior to versions 7.1.2-9 and 6.9.13-34, there is a vulnerability in the Magick++ layer that manifests when Options::fontFamily is invoked with an empty string. This leads to memory being freed while leaving a pointer to freed memory, which can result in crashes or heap corruption.

Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop and unconditionally appends data to a std::vector per-loop iteration. This issue leads to unbounded memory growth and eventually causes the process to run out of memory.