CVE Vulnerability Catalog

In versions prior to 3.9.7, the i18next-http-middleware did not block dotted variants of keys such as '__proto__.polluted', leading to the potential for remote prototype pollution in applications using i18next-fs-backend version ≤ 2.6.5.

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings, potentially allowing unauthorized writes to the global object prototype.

Socket versions before 2.041 for Perl have an out-of-bounds heap read issue. The pack_ip_mreq_source() function incorrectly checks the length of its source argument, leading to copying adjacent heap memory when the source is shorter than 4 bytes.

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable.

Versions up to 1.1.1 of the Integration for ActiveCampaign and contact forms (Contact Form 7, WPForms, Elementor, Ninja Forms) are vulnerable to unauthenticated PHP object injection.

There is an unauthenticated Path Traversal vulnerability in FastDup versions <= 2.7.2.

Versions of the eCommerce Product Catalog up to 3.5.5 are vulnerable to unauthenticated SQL injection.

There is an unauthenticated PHP Object Injection vulnerability in OttoKit versions <= 1.1.27.

The GPTranslate plugin in versions up to 2.32.6 has a vulnerability to unauthenticated SQL Injection, allowing malicious queries to be executed against the database.

There is an unauthenticated PHP Object Injection vulnerability in WP Travel Engine versions up to 6.7.12.

There is an unauthenticated PHP Object Injection vulnerability in wpForo Forum versions <= 3.1.0.

Happyforms versions up to 1.26.13 are vulnerable to unauthenticated PHP object injection.

The WP User Manager plugin versions up to 2.9.16 contain a vulnerability that allows subscribers to delete arbitrary files.

In versions up to 1.1.8 of the Integration for Mailchimp and contact forms (Contact Form 7, WPForms, Elementor, Ninja Forms), there is a vulnerability to unauthenticated PHP object injection.

Versions of RegistrationMagic up to 6.0.8.6 have a vulnerability in unauthenticated authentication, which may allow attackers to take over user accounts.

The Integration for Contact Form 7 HubSpot plugin version 1.3.7 and earlier contains an unauthenticated PHP Object Injection vulnerability. An attacker can remotely inject a malicious PHP object, potentially leading to arbitrary code execution or other dangerous operations.

Versions up to 1.4.3 of the Integration for Salesforce, Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms plugins are vulnerable to unauthenticated PHP object injection.

In versions of Integration for Contact Form 7 and Constant Contact up to 1.1.6, there is a vulnerability to unauthenticated PHP object injection.

The WP Zendesk plugin for contact forms such as Contact Form 7, WPForms, Elementor, Formidable, and Ninja Forms in versions up to 1.1.4 is vulnerable to unauthenticated PHP object injection.

Versions up to 1.2.1 of the Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugins are vulnerable to unauthenticated PHP object injection.