CVE Vulnerability Catalog

A vulnerability in OpenClinica Community Edition up to 3.12.2/3.13 affects an unknown part of the file /ImportCRFData?action=confirm of the CRF Data Import component. Manipulating the xml_file argument results in path traversal. The attack can be initiated remotely, and the exploit has been made public.

A vulnerability in OpenClinica Community Edition up to 3.12.2/3.13 affects some unknown functionality of the file /ImportCRFData?action=confirm of the CRF Data Import component. Manipulating the xml_file argument leads to xml injection. The attack can be launched remotely, and the exploit has been disclosed to the public.

A vulnerability was identified in TOZED ZLT T10 T10PLUS_3.04.15. The affected element is an unknown function of the file /reqproc/proc_post of the Reboot Handler component. Such manipulation leads to denial of service. Access to the local network is required for this attack to succeed. The exploit is publicly available and might be used.

A vulnerability was found in Sangfor Operation and Maintenance Security Management System version 3.0 in an unknown function of /fort/portal_login in the Frontend component. Manipulating the loginUrl argument leads to command injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

In 70mai X200 up to version 20251019, there is a file inclusion vulnerability in the Init Script Handler component. The attack requires local access and is difficult to exploit, but the exploit is public.

A vulnerability has been found in aaPanel BaoTa up to 11.2.x. This vulnerability affects unknown code of the file /database?action=GetDatabaseAccess of the Backend component. The manipulation of the argument Name leads to SQL injection. The attack can be initiated remotely, and the exploit has been disclosed to the public and may be used.

A flaw was found in code-projects Responsive Hotel Site 1.0 allowing SQL injection in /admin/roomdel.php. Manipulating the ID argument enables remote attacks. The exploit has been published and may be used.

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping on user-supplied values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Saphali LiqPay for donate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saphali_liqpay' shortcode in all versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The CYAN Backup plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete' functionality in all versions up to, and including, 2.5.4. This makes it possible for authenticated attackers with Administrator-level access and above to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to and including 13.7.3 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with Editor-level access and above to append additional SQL queries, provided they can convince an author-level user or higher to add a malicious custom field value.

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/envira-convert/v1/bulk-convert' REST API endpoint in all versions up to, and including, 1.11.0. This makes it possible for authenticated attackers, with contributor-level access and above, to convert galleries to Envira galleries.

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution up to version 3.3.8 is vulnerable to sensitive information exposure via the 'enqueue_social_login_script' function. Unauthenticated attackers can extract sensitive data including the Facebook App Secret if Facebook Social Login is enabled.

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the status of refund requests, including approving and refusing refunds.

The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized booking note creation due to a missing capability check on the 'booking_add_notes' function in all versions up to, and including, 4.2.0.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add a note to the backend view of any booking.

The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovaem-ajax.php file in all versions up to, and including, 1.8.6. This makes it possible for unauthenticated attackers to delete ticket files, download tickets, and more.

The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled.

The Mang Board WP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mp' parameter up to version 2.3.1. This is due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they trick a user into clicking a link.

The Download Manager plugin for WordPress is vulnerable to unauthorized access due to a hardcoded Cron key used in the deleteExpired() and clearTempDataCPCron() functions in all versions up to, and including, 3.3.30. This makes it possible for unauthenticated attackers to trigger these cron jobs leading to deletion of expired posts and clearing cache.

The Contact Form 7 AWeber Extension plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_aweber_logreset' AJAX endpoint in all versions up to, and including, 0.1.42. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the AWeber logs.