CVE Vulnerability Catalog

A vulnerability was detected in SourceCodester Best House Rental Management System 1.0. The save_category function in /admin_class.php is affected, where manipulation of the Name argument results in SQL injection. The attack can be initiated remotely and the exploit is publicly available.

A SQL injection flaw was discovered in Simple Online Hotel Reservation System 2.0 in /admin/add_account.php via manipulation of the Name argument. The attack can be performed remotely and a public exploit is available.

An unrestricted file upload vulnerability was identified in Simple Online Hotel Reservation System 2.0 in /admin/edit_room.php (Photo Handler component). The attack can be carried out remotely and a public exploit is available.

The kallyas theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the theme's shortcodes in all versions up to, and including, 4.23.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Import WP plugin for WordPress in versions up to and including 2.14.16 is vulnerable to Arbitrary File Read. The REST API endpoint accepts arbitrary absolute file paths without proper validation in the attach_file() function when handling file_local actions, allowing authenticated attackers with administrator-level access to read server files.

The Qi Blocks plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.4.3. The plugin stores arbitrary CSS styles submitted via the `qi-blocks/v1/update-styles` REST API endpoint without proper sanitization in the `update_global_styles_callback()` function. An authenticated attacker with Contributor-level access or higher can inject arbitrary CSS, which can be used to hide content, overlay fake UI elements, or exfiltrate sensitive information via CSS injection techniques.

The Employee Spotlight – Team Member Showcase & Meet the Team Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Folderly plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the /wp-json/folderly/v1/config/clear-all-data REST API endpoint in all versions up to, and including, 0.3. This allows authenticated attackers with Author-level access and above to clear all data such as terms and categories.

The WP Discourse plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5.9. This is due to the plugin unconditionally sending Discourse API credentials (Api-Key and Api-Username headers) to any host specified in a post's discourse_permalink custom field during comment synchronization. This makes it possible for authenticated attackers with author-level access and above to exfiltrate sensitive Discourse API credentials to attacker-controlled servers, as well as query internal services and potentially perform further attacks.

The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the Subscriptions Manager in all versions up to, and including, 2.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcode in all versions up to and including 1.51 due to insufficient input sanitization and output escaping on user-supplied attributes. An authenticated attacker with Contributor-level access or higher can inject arbitrary scripts that execute when a user visits the page.

The Schema Scalpel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping when outputting user-supplied data into JSON-LD schema markup. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts that execute when a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 0.92.0 via the 'catlist' shortcode due to insufficient restrictions on which posts can be included. An authenticated attacker with Contributor-level access or higher can extract data from password-protected, private, or draft posts that they should not have access to.

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.3.1. The plugin does not properly verify that a user is authorized to perform an action. An authenticated attacker with Author-level access or higher can enable or disable arbitrary SiteSEO features that they should not have access to.

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Blogs in Liferay Portal 7.4.0 through 7.4.3.111 and older unsupported versions, as well as Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92 and older unsupported versions, do not check permissions for images in a blog entry. This allows remote attackers to view images in a blog entry via a crafted URL.

The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin: WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disconnect_account_request() function in all versions up to, and including, 3.5.1.

The Document Library Lite plugin for WordPress in versions up to and including 1.1.6 is vulnerable to Improper Authorization. The plugin exposes an unauthenticated AJAX action dll_load_posts that returns document data as JSON without nonce or capability checks. The handler accepts an attacker-controlled args array allowing retrieval of unpublished document titles and content.