CVE Vulnerability Catalog

The IDonate WordPress plugin before 2.1.13 does not have authorisation and CSRF when deleting users via an action handler, allowing unauthenticated attackers to delete arbitrary users.

A SQL injection vulnerability was found in the save_house function of /admin_class.php in SourceCodester Best House Rental Management System 1.0. Manipulation of the house_no argument allows SQL injection. The vulnerability can be exploited remotely and a public exploit exists.

A vulnerability was detected in Bdtask Flight Booking Software up to 3.1 in the Package Information Module, file /b2c/package-information. Manipulation leads to unrestricted file upload. The attack can be launched remotely and the exploit is publicly available.

A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. It affects an unknown functionality in the Deposit Handler component, allowing unrestricted file upload. The attack can be initiated remotely, and the exploit has been publicly disclosed.

The Entrada theme by Waituk contains a Cross-Site Request Forgery vulnerability in versions from n/a through 5.7.7. This vulnerability allows an attacker to leverage CSRF to perform unauthorized actions in the context of a logged-in administrator.

Stored Cross-site Scripting (XSS) vulnerability in Ultimate Addons for WPBakery Page Builder (ultimate_vc_addons) by Brainstorm_Force. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 3.21.1 (excluding 3.21.1).

A vulnerability was detected in Kamailio 5.5 in the function sr_push_yy_state of the file src/core/cfg.lex (Configuration File Handler component). The manipulation results in use after free. The attack must be initiated from a local position and requires manipulating config files.

A vulnerability was detected in Kamailio 5.5 in the rve_destroy function of src/core/rvalue.c (configuration file handler). Manipulation leads to a heap-based buffer overflow. The attack requires local access and config file manipulation, and the exploit is publicly disclosed. There is ongoing doubt about the real existence of this vulnerability.

A path traversal vulnerability was identified in givanz Vvveb up to 1.0.7.3 in the sanitizeFileName function of system/functions.php in the Code Editor component. Manipulation of the File argument allows access to files outside the intended directory. The attack can be launched remotely and the exploit is publicly available.

The Slider Templates plugin for WordPress (versions up to 1.0.3) contains a Server-Side Request Forgery (SSRF) vulnerability. It allows an attacker to force the server to make requests to arbitrary network resources.

The Builderall Builder for WordPress plugin (builderall-cheetah-for-wp) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 3.0.1.

Stored Cross-site Scripting (XSS) vulnerability in Simple Pull Quote (simple-pull-quote) by llamaman. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 1.6.3 inclusive.

Stored Cross-site Scripting (XSS) vulnerability in WP AdCenter (wpadcenter) by WPeka. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 2.6.1 inclusive.

Stored Cross-site Scripting (XSS) vulnerability in Posts By Tag (posts-by-tag) by Sudar Muthu. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 3.2.1 inclusive.

The Dynamic User Directory (dynamic-user-directory) plugin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), allowing Stored XSS. This issue affects Dynamic User Directory from n/a through <= 2.3.

The WP Gravity Forms Zoho CRM and Bigin plugin by CRM Perks contains an open redirect vulnerability, allowing phishing. This issue affects versions up to and including 1.2.8.

The Persian Admnin Fonts plugin by MDZ has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 4.1.03.

A vulnerability in the ACF to REST API plugin (acf-to-rest-api) up to version 3.3.4. Sensitive information is inserted into sent data, allowing unauthorized retrieval of embedded sensitive data.

The KiotViet Sync plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions from n/a through <= 1.8.5.

The 百度站长SEO合集 (baiduseo) plugin contains a missing authorization vulnerability that allows accessing functionality not properly constrained by ACLs. This issue affects 百度站长SEO合集 from n/a through <= 2.1.4.