CVE Vulnerability Catalog

phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Authenticated users with edit_faq permission can supply the ID of a restricted FAQ they cannot view to modify its content, bypass moderation, and change its publication state.

phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations without validating a CSRF token. Attackers can lure a logged-in user with the CONFIGURATION_EDIT permission into submitting a crafted cross-site request, triggering migrations that may impact database integrity or availability.

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search API endpoints. Attackers can send concurrent GET requests that load and process all database records into PHP memory, exhausting CPU and memory to crash the server.

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a target record_id or attachment ID to tamper with or remove files on unauthorized FAQs.

phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController::updateData, api/user/data/update), checking only the session and CSRF token. An attacker with a hijacked session can set the e-mail to their own mailbox and use the password-reset flow to take over non-2FA accounts, including superadmin.

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.

FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride calculation passes SIZE_MAX - 3 to Stream_Zero for sub-byte images. A malicious RDP clipboard peer can return a crafted 1-bpp BMP processed by clipboard_synthesize_image_format_to_bmp for CF_DIB/CF_DIBV5, crashing the client or causing an out-of-bounds write.

FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate the MIC offset. Unauthenticated attackers can send a crafted AUTHENTICATE_MESSAGE with a backward session-key offset and MIC offset to write 16 zero bytes beyond the allocation.

The PAYCOMET for WooCommerce plugin (up to version 5.45) contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. An unauthenticated attacker can inject malicious JavaScript that executes in the victim's browser.

Gantry 5 Framework generates error messages containing sensitive information, allowing retrieval of embedded sensitive data. This affects versions from n/a through 5.6.4.

The GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to and including 2.8.61 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when an administrator views the affected payment form.

The European VAT Compliance Assistant for WooCommerce plugin is vulnerable to Stored Cross-Site Scripting via the CF-IPCountry header in all versions up to and including 1.36.10 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits the affected page.

The Fancy Comments WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to improper neutralization of input during web page generation. This affects versions from n/a through 1.2.21.

The User Registration & Membership plugin for WordPress in versions up to and including 5.2.8 is vulnerable to Stored Cross-Site Scripting via a Checkbox Field Value due to insufficient input sanitization and output escaping. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation.

The User Registration & Membership plugin for WordPress in versions up to and including 5.2.8 is vulnerable to Arbitrary Shortcode Execution due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(). The attacker-controlled HTTP_REFERER header passes only through sanitize_text_field(), which does not strip WordPress shortcode delimiters, before being substituted into a Content Restriction message executed via apply_shortcodes()/do_shortcode().

The WP Booking System – Booking Calendar plugin for WordPress in versions up to and including 2.1.0.3 is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. This allows unauthenticated attackers to read the stored notification email body of any booking by iterating booking_id and email_log_id, exposing customer PII.

The EU VAT Assistant for WooCommerce plugin for WordPress in versions up to and including 2.1.30.260413 is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter due to insufficient input sanitization and output escaping. The stored payload executes in the administrator's browser context when reviewing an order via WooCommerce → Orders → Edit Order.

The LearnPress – WordPress LMS Plugin for WordPress in versions up to and including 4.4.10 is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter due to insufficient input sanitization and output escaping. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress in versions up to and including 6.3.2 is vulnerable to Insecure Direct Object Reference via the 'context' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to expose arbitrary users' sensitive profile data, including email address, display name, registration date, profile image URL, and user meta fields.