CVE Vulnerability Catalog

The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid.

The Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary parameters into the client software, resulting in unauthorized reconfiguration and full compromise of the application's functionality. The attack can also target an already seeded client if the attacker knows the IDP URL used for enrollment.

A malicious actor with network access could exploit an Improper Access Control vulnerability in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.

Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation that could destroy and then replace a store path before content verification.

NetBird client versions 0.60.0 through 0.74.6 contain a command injection vulnerability allowing a malicious or compromised peer to execute arbitrary commands on other NetBird client hosts due to improper escaping of peer names in SSH configuration.

The NewStatPress plugin for WordPress up to version 1.4.5 is vulnerable to Stored Cross-Site Scripting via the 'Last referrers' meta box on the Overview admin page due to insufficient output escaping, allowing unauthenticated attackers to inject arbitrary scripts.

The FV Flowplayer Video Player plugin for WordPress up to version 7.5.54.7212 is vulnerable to Stored Cross-Site Scripting via the 'synopsis' shortcode attribute due to insufficient input sanitization and output escaping, requiring the 'Parse Vimeo and YouTube links' option enabled and liststyle set to 'season'.

The Gmedia Photo Gallery plugin for WordPress up to version 1.25.1 is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter due to insufficient escaping and preparation, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

The Smart Forms plugin for WordPress up to version 2.6.104 is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page.

The Form Maker by 10Web plugin for WordPress up to version 1.15.48 is vulnerable to blind SQL Injection via the 'inputs' parameter due to insufficient escaping and preparation, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

The Verified Reviews (Avis Vérifiés) plugin for WordPress up to version 2.4.6 is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Authentication bypass is possible due to loose comparisons in signature verification.

The Cryptocurrency Donation Box plugin for WordPress up to version 2.2.13 is vulnerable to Stored Cross-Site Scripting via the 'data_object' parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. The nonce is publicly exposed to anonymous visitors.

The Contact Form DB for Enfold plugin for WordPress in versions up to and including 2.0.2 is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. The payload is echoed unescaped in a title HTML attribute and in the table cell body in admin/ecf_index.php, and base64 encoding and serialization do not neutralize the malicious content.

The JTL-Connector for WooCommerce plugin for WordPress in versions up to and including 2.4.3 is vulnerable to time-based SQL Injection via the 'product.push' Identity Endpoint. Due to insufficient escaping of a user-supplied parameter and lack of sufficient preparation on the existing SQL query, an unauthenticated attacker can append additional SQL queries to existing ones to extract sensitive information from the database. The injection fires during identity linking before ProductController::push() executes, so exploitation succeeds even if downstream product handling would otherwise reject the request.

The Document Gallery plugin for WordPress in versions up to and including 5.1.1 is vulnerable to Stored Cross-Site Scripting via the 'dg_thumber_webhook' Action Request Body. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it.

Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled. This can lead to memory corruption and potential code execution.

The NewStatPress plugin for WordPress in versions up to and including 1.4.5 is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary scripts into pages that execute when a user visits the injected page. Exploitation requires that an administrator has placed the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and that the attacker's crafted URL accumulates enough hits to appear in the top-N ranking.

Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL). The URL scheme filter (FURLRequestFilter) is empty by default, which permits all URL schemes. On Windows, this results in a call to ShellExecuteW() with the open verb, so a supplied file:/// URI causes the referenced file to be executed. Any Unreal Engine game that loads user-generated content containing Blueprints is vulnerable to command execution via a malicious local file or a remote file on a WebDAV share. This is an instance of CWE-1188 (Initialization of a Resource with an Insecure Default).