CVE Vulnerability Catalog

An Improper Access Control vulnerability in UniFi Protect AI Key allows a malicious actor with network access, under certain conditions, to reach internal resources through the device.

An Improper Access Control vulnerability in UniFi Protect AI Key allows a malicious actor with network access to reach internal resources through the device.

Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.

The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user who invoked the installer, even though it should be root ownership.

Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to and including 4.5 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages that execute in an administrator's browser when the GetSocial settings page is visited.

The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' parameter of the 'woocommerce_remove_variations' AJAX action in versions up to and including 1.5.0 due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation on the existing SQL query. Authenticated attackers with Subscriber-level access and above can append additional SQL queries to extract sensitive information from the database.

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.16.1 via the 'args[link_target]' parameter. Unauthenticated attackers can extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp_user_level, and WooCommerce customer PII such as billing_email, billing_phone, and billing_address_1.

The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata' parameter in all versions up to and including 1.4.2 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages that execute when a user visits the injected page.

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'synopsis' Shortcode Attribute in all versions up to and including 8.1.7 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages that execute when a user visits the injected page.

The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'redirect_url' shortcode attribute in all versions up to and including 3.0.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages that execute whenever a user visits the injected page.

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to and including 4.1.0 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a link. Exploitation requires the targeted lesson page to have an empty nav-items array, which occurs naturally when a lesson has no content, no attachments, and comments are disabled or the viewer is not logged in.

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone' listing field in all versions up to and including 8.10.2.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access or higher to inject arbitrary web scripts into pages that execute whenever a user visits the injected page. This is possible because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.

Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator. This issue affects Hitachi Ops Center Administrator: before 11.0.9-01.

Out-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX and Hitachi Disk Array Driver for Virtual I/O Server. This issue affects Hitachi Disk Array Driver for AIX: from 01-00 before 01-23-/A; Hitachi Disk Array Driver for Virtual I/O Server: from 01-04 before 01-23-/A.

The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the process_bulk_action() delete handler then matching any stored key whose name contains the substring 'cfdb7_file' and passing the stored value directly to unlink() without validating that the file actually belongs to the submission being deleted or constraining the filename with basename()/realpath(). This makes it possible for unauthenticated attackers to inject a crafted multipart field.

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to and including 1.7.29 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute when a user accesses an affected page.

A vulnerability in Citrix UniconOS allows arbitrary file read and write. This issue affects versions before 2607.2 CR and before 2603 LTSR CU2.

A vulnerability in Citrix UniconOS allows persistent command execution. This issue affects versions before 2607.2 CR and before 2603 LTSR CU2.

An authorization bypass through user-controlled key vulnerability in HYPR Passwordless on Windows allows privilege escalation. This issue affects versions before 11.3.3.