CVE Vulnerability Catalog

Multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, and Apeos C3567 1.1.3, have a path traversal vulnerability in the web management interface. The vulnerability is in the handling of externally supplied parameters. A specially crafted malicious request may trigger unintended processing.

The Ad Inserter plugin for WordPress up to version 2.8.18 is vulnerable to Reflected XSS via the Referer header. Insufficient input sanitization and output escaping on the '{search-query}' dynamic tag allow unauthenticated attackers to execute arbitrary JavaScript in the context of the site for any visitor, including a signed-in administrator. Exploitation requires an ad block with the '{search-query}' tag and automatic insertion enabled.

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. An unknown function in backend/app/modules/ai/ai_client.py within the AI Provider Configuration Handler component allows exposure of data to the wrong session. The attack can be launched remotely and the exploit is publicly available.

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider. This allows unauthenticated attackers to mark arbitrary orders as paid without payment.

The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request. This allows unauthenticated attackers to obtain the order key of an arbitrary order and view its contents.

The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization. This allows unauthenticated users to overwrite the site's CRM integration endpoint and credentials, after which synced user data is delivered to an attacker-chosen host.

The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers. This allows any authenticated subscriber to read other users' email addresses and to trigger a cross-user CRM re-sync.

The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 due to improper verification of user authorization. This allows authenticated attackers with subscriber-level access and above to delete arbitrary media library attachments, including administrator-owned files, when a Custom Fonts field is registered on the user profile page.

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response served as HTML. This allows attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link.

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page. This could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's download dialogue, including administrators. Only sites running PHP below 8.1 are affected.

HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoofing from a trusted domain.

A vulnerability has been found in itsourcecode Leave Management System 1.0. An unknown function in /module/leavetype/controller.php allows manipulation of the LEAVTID argument leading to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

A server-side request forgery (SSRF) vulnerability exists in Form Tools up to 3.1.1 in the smart_fill function of /global/code/actions.php (AJAX Endpoint component). Manipulation of the url argument allows server-side requests. The exploit is publicly disclosed and can be triggered remotely.

An unrestricted file upload vulnerability exists in Form Tools up to 3.1.1 in the Files::uploadFile function of global/code/actions.php (Ajax Handler component). Manipulation allows remote upload of arbitrary files. The exploit is public and may be used.

A vulnerability exists in Form Tools up to 3.1.1 in the Clients::updateClientSettingsTab function of global/code/Clients.class.php (Client Settings component). Manipulation of the page_titles argument leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely and the exploit is publicly disclosed.

The WP Popular Posts plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 7.4.2 via the 'context' parameter. Unauthenticated attackers can extract sensitive edit-context fields, including raw title, content, password, meta, status, and guid, from non-public post objects such as wp_block synced patterns that WordPress core refuses to expose.

A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code.

The Advanced Woo Labels plugin for WordPress is vulnerable to unauthorized data modification due to an improperly secure capability check on the 'save_meta_boxes' function in all versions up to and including 2.51. This allows authenticated attackers with Contributor-level access and above to create AWS labels rendered without proper escaping. The vulnerability was partially patched in version 2.46.

A weakness has been identified in ZongXR SuperMarket 1.0.0.0 affecting the startBuy function of the Instant Buy component. Manipulating the Username argument leads to missing authentication. The attack can be performed remotely. The exploit has been publicly disclosed and may be used for attacks. The project was informed but has not responded.

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0 affecting the OrderController.deleteOrder function of the Order Deletion Endpoint. Manipulating the orderId argument results in missing authentication. The attack can be carried out remotely. The exploit has been publicly released and may be used. The project was informed but has not responded.