CVE Vulnerability Catalog

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms. Hotel-restricted back-office employees can modify rooms of other hotels by submitting foreign room IDs in the id_rooms parameter, changing status, floor, comments, or inactive dates.

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the apiSourceGetContent endpoint to obtain database passwords, LDAP bind credentials, and other projects' data.

An open redirect vulnerability exists in the PingGateway Fragment Filter feature. Affected versions include 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0 (and later).

The vulnerability allows an unauthenticated attacker to bypass the login lockdown mechanism in versions up to and including 2.17.

The vulnerability in cloak_ecto and cloak libraries involves using a password hash with insufficient computational effort. An attacker who holds hashed values and the configured secret can brute-force low-entropy plaintexts much faster than configured.

The vulnerability allows an unauthenticated attacker to change settings in the PayPlug for WooCommerce (Official) plugin in versions up to and including 3.1.0.

The vulnerability allows an unauthenticated attacker to change settings in the TrueBooker plugin in versions up to and including 1.2.9.

The vulnerability allows an unauthenticated attacker to access sensitive data in the Mailjet Email Marketing plugin in versions up to and including 6.2.3.

The vulnerability allows a subscriber-level user to perform a Cross Site Scripting (XSS) attack in the Front End PM plugin in versions up to and including 11.4.6.

The vulnerability allows an unauthenticated attacker to exploit Broken Access Control in the 10Web Social Photo Feed plugin in versions up to and including 1.4.35.

The vulnerability allows an unauthenticated attacker to bypass the Captcha mechanism in the Captcha by BestWebSoft plugin in versions up to and including 5.2.8.

The vulnerability allows a subscriber-level user to perform a Denial of Service (DoS) attack in the WPBase Cache plugin in versions up to and including 5.5.6.

The Missing Authorization vulnerability in the Autoship Cloud for WooCommerce Subscription Products (autoship-cloud) plugin allows exploiting incorrectly configured access control security levels. This issue affects versions from n/a through 2.17.1.

The Wappointment plugin in versions up to and including 2.7.7 contains an Insecure Direct Object References (IDOR) vulnerability that allows an unauthenticated attacker to access resources they should not have permission to.

The Piotnet Addons For Elementor plugin in versions up to and including 7.1.71 allows a user with the Contributor role to download arbitrary files from the server.

The App for Cloudflare® plugin in versions up to and including 1.10.1 contains a Broken Access Control vulnerability that allows a user with the Subscriber role to perform actions beyond their permissions.

The WC Fields Factory plugin in versions up to and including 4.1.12 contains a Cross Site Scripting (XSS) vulnerability that allows a user with the Subscriber role to inject malicious script.

The Ohio Extra plugin in versions up to and including 3.6.8 contains a Cross Site Scripting (XSS) vulnerability that allows a user with the Subscriber role to inject malicious script.

The JetElements For Elementor plugin in versions up to and including 2.9.2.2 contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation.

A vulnerability was identified in SourceCodester Simple Student Information System 1.0 affecting some unknown processing of the file /register.php in the Profile Field Handler component. Manipulation of the firstname/lastname arguments leads to cross site scripting, and the attack may be initiated remotely.