CVE Vulnerability Catalog

Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking. This issue affects VikBooking Hotel Booking Engine & PMS from n/a through <= 1.8.2.

On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inserting a USB drive (containing a publicly documented reset string) into a USB port.

Missing Authorization vulnerability in ganddser Jock On Air Now (JOAN) joan allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Jock On Air Now (JOAN) from n/a through <= 6.0.4.

An authentication bypass by spoofing vulnerability in the Saad Iqbal All In One Login (change-wp-admin-login) WordPress plugin allows identity spoofing. The issue affects All In One Login from n/a through version 2.0.8.

Missing Authorization vulnerability in Jthemes imEvent imevent allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects imEvent from n/a through <= 3.4.0.

The Backup and Move plugin (by Gaurav Aggarwal) up to version 0.1 has a Missing Authorization vulnerability. This allows exploiting incorrectly configured access control security levels.

The Sertifier Certificate & Badge Maker plugin in versions up to and including 1.21 is vulnerable to a missing authorization issue, allowing exploitation of incorrectly configured access control security levels. This could enable unauthorized access to plugin-protected functions or data.

The Easy Appointments plugin (versions up to 3.12.14) contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This can lead to code injection.

The WordPress plugin Ajax Search Lite (versions up to and including 4.13.3) is vulnerable to deserialization of untrusted data, allowing object injection. The flaw stems from unsafe processing of input data.

Missing Authorization vulnerability in flippercode Advanced Google Maps wp-google-map-gold allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Advanced Google Maps: from n/a through <= 5.8.4.

The Smush Image Compression and Optimization plugin (WPMU DEV) for WordPress is vulnerable to path traversal of type '.../...//' in versions up to, and including, 3.17.0. The vulnerability may allow access to files outside the intended directory.

IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 through 24.0.1 and 25.0.0 are vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Podatność CVE-2025-10955 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Netigma firmy Netcad Software Inc. Umożliwia to ataki typu XSS (Cross-site Scripting) poprzez ciągi zapytań HTTP.

The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitized prior to being passed to a do_shortcode call. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes if an administrator previews or publishes a crafted testimonial.

The Better Find and Replace plugin for WordPress up to version 1.7.7 lacks a capability check on the rtafar_ajax() function, allowing authenticated attackers with Subscriber-level access to trigger OpenAI API key usage, resulting in quota consumption and potential costs.

The Hubbub Lite plugin for WordPress (versions up to and including 1.36.0) is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'dpsp_list_attention_search' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary scripts into pages that execute if a user is tricked into clicking a link.

The Blog2Social plugin for WordPress is vulnerable to Server-Side Request Forgery up to version 8.6.0 via the getFullContent() function. Authenticated attackers with Subscriber-level access can make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services.

A cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed in the web browser of a victim user who accesses the page.

The Blog2Social plugin for WordPress is vulnerable to limited file upload due to an incorrect capability check on the uploadVideo() function in versions up to and including 8.6.0. Authenticated attackers with Subscriber-level access and above can upload mp4 files to the 'wp-content/uploads/<YYYY>/<MM>/' directory.

The Easy Digital Downloads plugin for WordPress in all versions up to and including 3.5.2 is vulnerable to Order Manipulation due to an order verification bypass. When the POST body includes verification_override=1, verification is unconditionally skipped, allowing an unauthenticated attacker to submit a forged IPN that is treated as verified. A valid PayPal transaction id is required, restricting order manipulation to orders placed by the attacker with a customer account.