CVE Vulnerability Catalog

Joomla! Core versions 1.0.0-5.4.7 and 6.0.0-6.1.2 have a vulnerability of unrestricted uploads of SHTML files. The default list of dangerous files did not include SHTML files, which on servers that execute these files could lead to code execution.

MyBB before version 1.8.40 contains a vulnerability in the Contact module that does not properly validate redirect URLs, leading to open redirect and reflected JavaScript code injection.

MyBB from version 1.8.13 to 1.8.40 contains a vulnerability in the installer module that improperly escapes database configuration values, leading to PHP code injection and remote code execution.

AAP Controller's HashiCorp Vault credential plugin contains a vulnerability that sends the Kubernetes service account token to an attacker-controlled URL when testing Vault credentials with kubernetes_role authentication.

TRENDnet TEW-WLC100 version 1v2.07b01 contains a stack-based buffer overflow vulnerability in the function FUN_0040da4c in /usr/nginx/sbin/nginx, in the HTTP Header Handler component. Manipulation of the Server argument can lead to remote attacks.

Unauthenticated SQL Injection vulnerability in Readabler plugin versions before 2.0.18. An attacker without authentication can inject SQL queries.

Unauthenticated Arbitrary File Upload vulnerability in Masteriyo - LMS plugin versions up to 2.3.2. An attacker without authentication can upload arbitrary files to the server.

Unauthenticated Deserialization of untrusted data vulnerability in Youzify plugin versions up to 1.3.7. An attacker without authentication can deserialize data, potentially leading to remote code execution.

Unauthenticated Broken Authentication vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can bypass authentication mechanisms.

Unauthenticated PHP Object Injection vulnerability in Popup by Supsystic plugin versions up to 1.13.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.

Unauthenticated PHP Object Injection vulnerability in Ultimate Maps by Supsystic plugin versions before 1.5.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.

Unauthenticated PHP Object Injection vulnerability in Easy Google Maps plugin versions up to 1.13.0. An attacker without authentication can inject PHP objects, potentially leading to remote code execution.

Unauthenticated SQL Injection vulnerability in JetAppointment plugin versions up to 2.5.2. An attacker without authentication can inject SQL queries.

Unauthenticated SQL Injection vulnerability in Affiliates Manager plugin versions up to 2.9.53. An attacker without authentication can inject SQL queries.

An unauthenticated attacker can remotely execute arbitrary code (RCE) in WP Compress versions prior to 7.20.01.

An unauthenticated attacker can perform PHP Object Injection in RegistrationMagic versions up to 6.0.9.7.

An unauthenticated attacker can exploit SQL Injection in Modern Events Calendar versions prior to 7.35.0.

An unauthenticated attacker can exploit SQL Injection in Sticky Chat Widget versions up to 1.4.2.

The GP Premium plugin by EDGE22 Studios Ltd. contains an unrestricted upload of dangerous file type vulnerability, allowing remote code inclusion. The issue affects versions from n/a through 2.5.5.

Seroval prior to 1.5.3 allows attacker-controlled JSON deserialization that can lead to unintended side effects, and when combined with frameworks registering callable wrappers, potentially unintended server-side invocation or remote code execution.