CVE Vulnerability Catalog

Improper neutralization of special elements used in an OS command (OS command injection) and cross-site request forgery (CSRF) in an ASUS router model allow an attacker to trick a logged-in administrator into visiting a phishing website, causing the router to execute arbitrary commands with root privileges.

Improper neutralization of special elements used in an OS command in certain ASUS routers allows a remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.

An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request. This may result in unauthorized access to user accounts and full administrative control of the LMS platform.

The ASMobile web interface in the VertiGIS GIS Portal package allows authenticated users to define a business reference into which JavaScript code can be inserted. On its own this is self-XSS, but the business reference is included in order details and later displayed in the OrderAdministration portal (AuftragsManager) of VertiGIS WebOrderSystem, where the code executes when a highly privileged user opens the order.

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups). The search term can be passed in the searchValue URL parameter, so the search is performed when a logged-in user opens such a URL, and JavaScript code in this parameter executes in the victim's browser.

The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage employees of defined companies (user groups). User properties such as the "secondName" parameter can be filled with JavaScript code while editing a user; the code is stored and executed in the browser of any other privileged user who opens the edited user entry or the user overview of the corresponding user group. An authenticated attacker with access to the portal can use this to run script code in the session of other portal users. Version 7.0.8.6, the latest available at the time of testing, is affected; the vendor did not provide information about further affected versions.

An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana allows an attacker within Bluetooth range to connect to an affected device without prior pairing or authentication. This enables unauthorized access to the device.

A firmware verification vulnerability in Creative Sound Blaster Katana allows an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device. The lack of effective integrity verification enables installation of unauthorized software.

The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 does not consistently resolve the target of the update-user action between authorization and execution in its front-end Forms module. This allows unauthenticated visitors to bypass the guard protecting administrator accounts, take over the site administrator's account, and obtain a valid session. Exploitation requires two separate front-end form configurations whose targets are mapped to visitor-submitted values.

The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 performs no capability check when updating a post through one of its front-end form actions. This allows unauthenticated visitors to overwrite arbitrary posts, including those storing field definitions, leading to arbitrary code execution on the server. Exploitation requires a published form whose post-update action maps both target and content to visitor-submitted values.

The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 does not validate or escape some form shortcode attributes that can take values from the visitor's request and are output without escaping. This allows users with a role as low as contributor to run arbitrary script in the browser of anyone led to open a crafted link or page, including a logged-in administrator. This is an incomplete fix for CVE-2023-5292.

The Advanced Custom Fields: Extended WordPress plugin (and PRO) before 0.9.2.8 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module, performing that check only for administrator accounts. This allows unauthenticated visitors to overwrite any non-administrator account's credentials and obtain a session for that account. Exploitation requires a published form whose user-update action maps its target to a visitor-submitted value.

The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal handler, and the nonce it relies on is not bound to the specific notice. On sites in certain configurations, a low-privileged authenticated user (Subscriber) can dismiss administrative notices marked as non-dismissible, including a warning that sensitive files may be publicly accessible.

The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page. Combined with unescaped comment author output, this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator.

The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page. Combined with unescaped comment author output, this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator.

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its editor media-upload endpoint, checking only the client-supplied MIME type and a case-sensitive block of the .php extension. This allows users with the Editor role and above to upload files with other active extensions into the public uploads directory, leading to stored script execution in the site origin and, depending on the server's handler mapping, to code execution.

The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in a maintenance routine that runs on unauthenticated requests. This allows unauthenticated attackers to move affected popups into the Trash and overwrite their stored preview data.

The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of filesystem locations it may serve files from to network administrators on multisite. A subsite administrator not trusted at the network level can approve arbitrary locations, causing the plugin to serve readable files from outside the uploads directory, including files belonging to other subsites, to unauthenticated visitors. Single-site installations are unaffected.

The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the specific account selected on its front-end Edit Profile form. This allows a Multisite subsite Administrator to change any other user's account email, including a Network Super Admin's, and take over that account through the password-reset flow.

The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attributes before outputting it back in a redirect message. This could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks against higher-privileged users who submit the affected form.