CVE Vulnerability Catalog

HPE NonStop Middleware software has a secret key handling and data deserialization vulnerability. Technical details were not provided in the description.

A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and system shutdown. Technical details were not provided in the description.

The Paid Videochat Turnkey Site (ppv-live-webcams) plugin for WordPress is vulnerable to Reflected Cross-site Scripting due to improper neutralization of input during web page generation. This issue affects versions from n/a through 7.5.12.

A vulnerability in curl during upload mishandles HTTP/2 RST_STREAM received from the server, leading to a use-after-free of a struct Curl_easy object.

The LifterLMS plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 10.3.1 via attacker-controlled attributes of the [lifterlms_checkout] shortcode. The llms_get_template() helper performs extract() on the shortcode attribute array before resolving the template path, allowing attacker-supplied 'template_name' and 'default_path' attributes to overwrite local parameters and control the path passed to a PHP include.

The CP Multi View Event Calendar (cp-multi-view-calendar) plugin for WordPress is vulnerable to SQL Injection due to improper neutralization of special elements used in SQL commands. This issue affects versions from n/a through 1.4.41.

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to and including 2.4.3 due to insufficient input sanitization and output escaping. The save-time sanitizer mbw_htmlspecialchars2() is ineffective because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots.

The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to and including 2.5 due to insufficient input sanitization and output escaping. The enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor, and no capability or role check gates the write path.

Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL, and Criteria is never validated against an allow-list. An authenticated staff user with the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers, api_keys, and sessions.

Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The jobid parameter passed to C4::Scheduler::remove_at_job is not validated, and Schedule::At::remove substitutes it into an atrm command string without quoting or escaping, executing it through a single-argument system() call that invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can execute arbitrary OS commands as the Koha application user.

The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 2.4.3 via the '<mode>_type' parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling access control bypass, sensitive data disclosure, or code execution. Exploitation is trivial via an unauthenticated POST to any page rendering a public [mb_board] shortcode, and on standard PHP installations pearcmd.php can be leveraged to write and include an attacker-controlled payload in a single request.

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 1.17.1 via deserialization of untrusted input. This allows authenticated attackers with administrator-level access and above to inject a PHP Object. No known POP chain is present in the vulnerable software, so impact only occurs if another plugin or theme with a POP chain is installed.

The ShopMagic – email automation for WordPress plugin is vulnerable to Local File Inclusion in all versions up to and including 4.9.0 via the 'billing_address.first_name' parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling access control bypass, sensitive data disclosure, or code execution. Exploitation requires a published recipe processing the {{ customer.first_name }} placeholder — the built-in "New Order email with social media profile links" recipe satisfies this by default, making the default configuration exploitable with no account, cookie, or nonce.

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 5.7.3 via the `booking[id]` and `cart[id]` parameters on the public `steps__reload_booking_form_summary_panel` and `steps__start` routes. The lack of ownership checks allows unauthenticated attackers to enumerate booking and cart identifiers and read other customers' appointment details and pending checkout contents directly from JSON responses.

The Appointment Booking Plugin – LatePoint for WordPress is vulnerable to Authentication Bypass in versions up to and including 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the public process_step_customer() booking step. When the 'Use WordPress users as customers' option is enabled, the helper matches a WordPress user by user_login equal to the victim's email even if their user_email differs, and links that user's ID into the victim's LatePoint customer row. This allows authenticated attackers with Subscriber-level access to take over another customer's LatePoint account.

The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated REST route. This allows unauthenticated attackers to perform SQL injection and read arbitrary data from the database.

The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard. This allows unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.

The affiliate-toolkit WordPress plugin before version 3.9.1 does not prevent a low-privileged user from supplying a template body that its bundled templating engine compiles and executes as PHP, allowing users with the Contributor role or above to run arbitrary PHP code on the server.

The Ultimate Multisite WordPress plugin before version 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file.

The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an administration screen. This allows unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute in the session of an administrator who views the stored data.