CVE Vulnerability Catalog

An unauthenticated Local File Inclusion vulnerability exists in Lighthouse versions up to 1.2.12. It allows an attacker to read arbitrary files from the server without authentication.

In the liboauth2 library, the DPoP verifier accepts a proof whose jwk header contains private key material. The oauth2_token_verify() function returns success for a malformed DPoP proof embedding a private EC key, violating RFC 9449 requirements.

The liboauth2 library is vulnerable to Server-Side Request Forgery (SSRF) in the oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, the kid value is appended to alb_base_url without URL encoding or path sanitization, and the HTTP GET request is issued before signature verification.

The WP Database Backup plugin for WordPress up to version 7.11 is vulnerable to OS command injection via the `wp_db_exclude_table` parameter. An authenticated attacker with administrator privileges can inject malicious data that is directly concatenated into the `mysqldump` command without proper escaping, allowing arbitrary command execution on the server.

The Wappointment plugin for WordPress up to version 2.7.6 contains an Insecure Direct Object Reference (IDOR) vulnerability. The authorization key `edit_key` is generated as a predictable, unsalted MD5 hash of a sequential client ID, a publicly observable timestamp, and a small staff ID, allowing unauthenticated attackers to compute it and cancel or reschedule other users' appointments.

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress up to version 1.5.1 contains an arbitrary file copy vulnerability. The create_entry_el() function passes the raw_value from Elementor Pro's Form_Record object directly to PHP's copy() without validation, allowing an attacker to copy any file from the server or from an external URL.

A vulnerability was discovered in StormShield Network Security versions 4.3.0 to 4.3.41, 4.8.0 to 4.8.15, and 5.0.0 to 5.0.5, allowing a possible leak of secret information when administration commands are passed via the CLI tool. An attacker with SSH access to the firewall (if SSH multiuser mode is enabled) could potentially obtain the proxy CA passphrase or TPM password.

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter in the wprp_load_more_revs AJAX action. The unsanitized value is concatenated directly into an AND id NOT IN (...) clause, allowing unauthenticated attackers to extract database data.

The vulnerability in PIA uses a bare string-prefix check for the OIDC issuer allowlist instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer that passes the prefix check but points to a controlled server. This allows an unauthenticated caller of POST /v1/upload/sbom to force outbound HTTP(S) requests to an arbitrary host and accept a JWT signed with the attacker's key.

The Groundhogg plugin for WordPress (versions up to 4.5.8) is vulnerable to SQL injection via the 'select' parameter. An authenticated attacker with custom-level access or higher can append additional SQL queries, enabling extraction of sensitive database information.

The JetFormBuilder plugin for WordPress up to version 3.6.3 has an authorization bypass vulnerability, allowing unauthenticated attackers to retrieve any values from post meta, including WooCommerce PII, order totals, attachment paths, and third-party plugin credentials. Exploitation requires at least one published form with a get_from_db generator field.

The Ninja Forms - File Uploads plugin for WordPress up to version 3.3.29 is vulnerable to Arbitrary File Read. The attach_files() function improperly handles a raw attacker-controlled 'files' array, bypassing upload validation, path normalization, and database record creation, allowing an unauthenticated attacker to read arbitrary files on the server.

The RSS Aggregator by Feedzy plugin for WordPress up to version 5.2.1 is vulnerable to stored XSS via the 'aspectRatio' attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts that execute when users access affected pages.

The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.6.4 via the 's' parameter. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information.

The LatePoint plugin for WordPress up to version 5.6.2 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'service_id' parameter. Missing validation allows unauthenticated attackers to create approved bookings for admin/agent-only services, consuming restricted capacity.

The Kirki plugin for WordPress up to version 6.0.11 has an authorization bypass vulnerability. An unauthenticated attacker can send arbitrary HTML-injected emails, including phishing messages with a real password reset link, using the site's mail server and its SPF/DKIM reputation.

The JoomSport plugin for WordPress up to version 5.7.8 contains an authorization bypass vulnerability. It allows authenticated attackers with subscriber-level access or higher to create arbitrary season groups and modify existing group names, participants, and round-type options. Exploitation requires obtaining the joomsportajaxnonce, which is exposed on frontend pages rendering a JoomSport shortcode.

The Kirki plugin for WordPress up to version 6.0.11 is vulnerable to sensitive information exposure via the get_single_symbol function. Unauthenticated attackers can extract full builder metadata and rendered HTML of any kirki_symbol post, including unpublished drafts, by supplying a sequential WordPress post ID.

The My Calendar – Accessible Event Manager plugin for WordPress up to version 3.7.14 inclusive contains an Insecure Direct Object Reference (IDOR) vulnerability via the 'vcal' parameter. Missing validation on a user-controlled key allows unauthenticated attackers to enumerate occurrence IDs and access the full iCalendar export of non-public, draft, trashed, and personal calendar events.

The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom_thumbnail parameter in all versions up to and including 1.5.1.8 due to insufficient input sanitization and output escaping.