CVE Vulnerability Catalog

The Participants Database plugin (participants-database) for WordPress by xnau webdesign is vulnerable to deserialization of untrusted data, allowing Object Injection. The issue affects versions up to and including 2.7.8.5.

The Participants Database plugin (participants-database) for WordPress by xnau webdesign contains an SQL Injection vulnerability (improper neutralization of special elements in an SQL command) enabling blind SQL injection. The issue affects versions up to and including 2.7.8.5.

The VikRentCar plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script stored in the application is later executed in users' browsers.

The GamiPress plugin contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An attacker can inject their own queries into the database.

The VikRentCar plugin contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. A malicious script is reflected in the server response and executed in the victim's browser.

The Car Rental Manager plugin by Magepeople contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.5.3.

The Knit Pay plugin contains a missing authorization vulnerability allowing exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 9.6.3.0.

The WPMobile.App plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. Unauthorized parties may access functions or resources that should be protected.

CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied data. A remote unauthenticated attacker can craft a malicious URL containing JavaScript or HTML code that executes in the victim's browser when visited, allowing theft of session cookies and actions performed on behalf of the victim within the application.

CGM CLININET is vulnerable to local privilege escalation. The service processing incoming HL7 messages runs with root privileges, but due to incorrect permissions its scripts and configuration files can be modified by the uhcapache user, allowing execution of arbitrary code as root.

The CGM CLININET application runs the cgm-updater process listening on an open network port without any authentication. The vulnerability was confirmed to affect versions up to 2026.MS3; version 2026.MS3 with the updater-upkg component in version 5.3.0 or higher is not affected.

The rsyncd service of CGM CLININET is vulnerable to Authentication Bypass via IP spoofing. Access is granted solely based on the client's source IP address, so an attacker able to spoof an allowed IP can edit files on the affected system.

The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials, in the SysIO.pl configuration file. Insecure file permissions make this file readable by any local account.

CGM CLININET is vulnerable to code injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted user-supplied data. An attacker from an adjacent network can supply a crafted query parameter to import an attacker-controlled module, resulting in arbitrary code execution with root privileges.

The CGM CLININET application stores user passwords as unsalted MD5 hashes. This storage method is vulnerable to dictionary and rainbow table attacks in the event of a database breach.

CGM CLININET is vulnerable to remote code execution caused by deserialization of untrusted data. The server exposes an HTTP-based API used by the administrative module that exchanges data using Java object serialization; an attacker on the same local network can send a crafted serialized object whose deserialization allows arbitrary code execution with root privileges.

In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those systems. An attacker on an adjacent network able to send data to these HL7 processes can achieve remote code execution with root privileges.

CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of evaluated code, an authenticated high-privileged attacker can cause arbitrary code execution with root privileges.

CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment path. The endpoint is accessible without authentication, allowing an unauthenticated attacker on the adjacent network to retrieve the list of patient documents and download them.

Improper authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge an access ticket, subsequently enabling the user to perform administrator operations.