CVE Vulnerability Catalog

The BP Direct Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bpdm_login' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes.

The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dbview' shortcode in all versions up to, and including, 0.5.5 due to insufficient input sanitization and output escaping on user supplied attributes.

The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes.

The Any News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'any-ticker' shortcode in all versions up to and including 3.1.1 due to insufficient input sanitization and output escaping on user supplied attributes.

The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes.

The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webcam' shortcode in all versions up to, and including, 0.5 due to insufficient input sanitization and output escaping on user supplied attributes.

The Eulerpool Research Systems plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'aaq' shortcode in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping on user supplied attributes.

The Qyrr WordPress plugin up to version 2.0.7 is vulnerable to arbitrary file uploads due to missing file type validation in the blob_to_file() function. Authenticated attackers with Contributor-level access and above can upload arbitrary files, potentially leading to remote code execution.

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below are vulnerable to directory enumeration by setting a path in the theme field, allowing attackers to gain additional information about the server.

FreshRSS versions 1.26.3 and below have a bypass of double clickjacking protection, allowing an attacker to trick the admin into clicking the Promote button on another user's management page after the admin double-clicks a button on an attacker-controlled website.

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, allowing XSS payload execution if a page renders feed entries without CSP. The Allow API access setting must be enabled beforehand. Account takeover is possible via password change, UserJS persistence, autofill password theft, or phishing page display. If the victim is an administrator, the attacker can perform administrative actions. Fixed in 1.27.0.

go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.8 and below, the justification verification caching mechanism caches verification results without properly considering the message context, allowing an attacker to bypass justification verification by reusing a cached justification in an invalid context.

The mkdocs-include-markdown-plugin for Mkdocs in versions 7.1.7 and below has a vulnerability where unvalidated input can collide with substitution placeholders. This issue is fixed in version 7.1.8.

Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal and Liferay DXP allow remote attackers to inject arbitrary web script or HTML via the `redirect` parameter in Announcements and Alerts.

A cross-site scripting (XSS) vulnerability in the web content template in Liferay Portal and Liferay DXP allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload in a web content structure's Name text field.

FreshRSS versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, this may lead to privilege escalation via obscuring the promote user button in the admin UI or XSS by tricking the user to drag content into the UserJS text area. This is fixed in version 1.27.0.

Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to an event in Liferay Portal and Liferay DXP allow remote attackers to inject arbitrary web script or HTML via crafted payloads in user's First Name, Middle text, or Last Name fields.

Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.6, 7.4 update 35 through update 92, and 7.3 update 25 through update 36. A remote attacker can inject arbitrary web script or HTML via a crafted payload injected into a Calendar's "Name" text field.

A reflected cross-site scripting (XSS) vulnerability exists on the page configuration page in Liferay Portal and Liferay DXP. A remote attacker can inject arbitrary web script or HTML via the com_liferay_layout_admin_web_portlet_GroupPagesPortlet_backURLTitle parameter.

Multiple stored cross-site scripting (XSS) vulnerabilities in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.7, and 7.4 update 50 through update 92. A remote authenticated attacker can inject arbitrary web script or HTML via a crafted payload injected into an asset author's First Name, Middle Name, or Last Name text field.