CVE Vulnerability Catalog

TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.

TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.

The AnyComment plugin for WordPress in versions up to and including 0.3.6 is vulnerable to Stored Cross-Site Scripting via the 'email' parameter. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::column_default(), which returns the stored email verbatim into an HTML <td> when the subscription's user_ID does not resolve to an existing WP_User. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page.

The Abandoned Cart Pro for WooCommerce plugin for WordPress in versions up to and including 10.8.0 is vulnerable to generic SQL Injection via the 'validate' parameter. Due to insufficient escaping of a user-supplied parameter and lack of sufficient preparation on the existing SQL query, an unauthenticated attacker can append additional SQL queries to existing ones to extract sensitive information from the database. AES-CTR is a malleable stream cipher, so an attacker who obtains one legitimate token by abandoning a cart with an email address they control can recover the keystream and forge a ciphertext carrying arbitrary SQL. The HMAC check added in 10.4.1 is enforced only when the wcap_nonce parameter is present, so omitting the parameter skips it entirely.

Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and Virtual I/O Server. Affects versions from 01-00 before 01-23-/A for AIX and from 01-04 before 01-23-/A for Virtual I/O Server.

The Directorist plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 8.10.2.1. Authenticated attackers with subscriber-level access can delete arbitrary business directory listings, including those owned by other users.

The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to and including 5.9. Unauthenticated attackers can include arbitrary PHP files on the server, potentially leading to remote code execution.

The Membership & User Roles for WooCommerce plugin is vulnerable to privilege escalation in versions up to and including 20260828. Authenticated attackers with subscriber-level access can restore previously revoked administrator privileges.

The Bit integrations plugin for WordPress is vulnerable to privilege escalation via log re-execution in all versions up to and including 2.10.6. Unauthenticated attackers can overwrite the administrator's password and take over the administrator account.

The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.7.29. Unauthenticated attackers can retrieve personally identifiable information for every booked customer, including names, email addresses, phone numbers, and physical addresses.

A remote code execution vulnerability in ONLYOFFICE Document Server versions before 10.0.0 allows an authenticated attacker with a valid JWT to execute arbitrary operating system commands as the ds service account.

Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege escalation. This is caused by a privileged service running from the %PROGRAMDATA%\Hyland\DesktopHost\bin folder with weak permissions.

Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent attacker may send management instructions to an affected device without adequate authentication, allowing modification of device state or management settings.

The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges.

An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options.

CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction.

Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another packet (retransmit or malicious) is received for the same tuple. IKE state is retained in memory after the client closes the connection, storing a pointer to iface_endpoint inside ike_sa.sa->st_iface_endpoint. Once this invalid pointer is used, the daemon crashes and restarts. This vulnerability can be triggered before the remote peer has authenticated itself. Continued exploitation can lead to a denial of service. Remote code execution could be possible. The IKE over TCP option is not enabled by default; only configurations that contain listen-tcp=yes are affected.

OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field.