CVE Vulnerability Catalog

The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before writing it into a generated PHP file in its own folder. This allows high privilege users such as a subsite administrator on a multisite network, who cannot otherwise run code, to achieve Remote Code Execution that any unauthenticated visitor can trigger.

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers. This allows unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing. This allows users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension; a disclosed file is re-published at a public URL and its original is deleted as a side effect.

The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes. This allows unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.

The GeoDirectory WordPress plugin before version 2.8.194 does not verify that a referenced attachment belongs to the listing being saved. This allows users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.

The Download Monitor WordPress plugin before version 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page. This allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.

The asVereinbase WordPress plugin before version 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match. This allows an unauthenticated attacker to log in as any user, including an administrator.

The MAS Videos WordPress plugin through version 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object. This allows any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.

The Advanced Twenty Seventeen WordPress plugin through version 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child theme. This allows any authenticated user such as a subscriber to switch the site's active theme site-wide, and allows the same action to be triggered against any logged-in user including an administrator via CSRF.

The Pixel Tag Manager for WooCommerce WordPress plugin before version 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard. This allows users with a role as low as Contributor to overwrite the plugin's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 4.0.3. This is due to the Gutenberg Register block passing the attacker-controlled Assigned Role attribute directly into the [wppb-register] shortcode without server-side authorization. The role guard in the form builder only downgrades roles that carry the manage_options or remove_users capability, leaving the Editor role and other privileged non-Administrator roles completely unrestricted. This makes it possible for authenticated attackers with Author-level access and above to create new WordPress accounts bearing the Editor role (or any other role that lacks the two guarded capabilities).

The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine. An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint. When an administrator performs a routine export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library, so no additional plugin or theme is required.

MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store contains recoverable eMudhra intermediate CA certificates. The issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.

Postiz lets a signed-in user ask the backend to run a function on one of their connected channels, but the backend did not restrict which functions could be requested, allowing calls to internal helpers. One helper reads a file from the server's disk (e.g., environment file with the session signing secret, database address, and service credentials), and another makes the backend process exit with a single request. Self-registration is open by default, so no existing account or action by another user is needed.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vulnerability information is available.

Craft CMS allows any authenticated control panel user to submit an element-search condition whose selector is evaluated as a sandboxed Twig object template; the allowed column filter delegates property lookup to Yii ArrayHelper outside Twig's SecurityPolicy, bypassing the sandbox to recover GeneralConfig::securityKey and then forge signed parameters that invoke native PHP callables.

The Mollie webhook endpoint accepts two independent attacker-controlled parameters (commerceTransactionHash and id) and never verifies they belong together; an unauthenticated attacker with any paid Mollie payment ID can mark any transaction as paid for its full amount.