CVE Vulnerability Catalog

The Soundslides plugin for WordPress is vulnerable to stored XSS via the soundslides shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This affects all versions up to and including 1.4.2.

The Shouty plugin for WordPress is vulnerable to stored XSS via the shouty shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This affects all versions up to and including 0.2.1.

The wp-twitpic plugin for WordPress is vulnerable to stored XSS via multiple parameters of the 'twitpic' shortcode due to insufficient input sanitization and output escaping. This affects all versions up to and including 1.0.

The Google Drive upload and download link plugin for WordPress is vulnerable to stored XSS via the 'link' parameter of the 'atachfilegoogle' shortcode due to insufficient input sanitization and output escaping. This affects all versions up to and including 1.0.

The SortTable Post plugin for WordPress (all versions up to and including 4.2) is vulnerable to stored cross-site scripting via the 'id' parameter in the sorttablepost shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with contributor-level access or above can inject arbitrary web scripts.

The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'logoff' action. This affects all versions up to and including 3.0.0.

The Reuters Direct plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.0.0. This is due to missing or incorrect nonce validation on the 'class-reuters-direct-settings.php' page. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request, provided they can trick a site administrator into performing an action such as clicking a link.

A reflected cross-site scripting vulnerability found in ALC WebCTRL and Carrier i-Vu in versions older than 8.0 affects login panels, allowing a malicious actor to compromise the client browser.

An integer overflow vulnerability in node-forge versions 1.3.1 and below allows remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. Due to 32-bit bitwise truncation, these arcs may be decoded as smaller, trusted OIDs, enabling bypass of downstream OID-based security decisions. The issue is patched in version 1.3.2.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user with specific permissions to cause a denial of service condition through HTTP response processing.

GitLab EE contained an issue that, under certain configuration conditions, could allow an authenticated user to view information from security reports. The issue affects versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1. GitLab has remediated the issue.

An IDOR vulnerability in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in temporary unauthorized disclosure of sensitive course, admin, and student data before the system reverts to normal access restrictions.

GitLab CE/EE versions 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 contain an issue that under specific conditions could allow an unauthenticated user to join arbitrary organizations by changing headers on some requests.

A stored cross-site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.

A stored cross-site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.

Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level privileges to read server logs.

Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level privileges to dump user records and access sensitive information.

A reflected cross-site scripting (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload.

Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.

The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to and including 4.1.6 via deserialization of untrusted input in saved-search-item.php. This allows authenticated attackers with Subscriber-level access and above to inject a PHP Object. No known POP chain is present in the vulnerable software, meaning this vulnerability has no impact unless another plugin or theme containing a POP chain is installed. If a POP chain is present, it may allow the attacker to perform actions like deleting arbitrary files, retrieving sensitive data, or executing code.