CVE Vulnerability Catalog

Privilege escalation due to weak configuration while temporary file handling.

Privilege escalation due to weak configuration during package extraction process.

Exposed dangerous function lead to privilege escalation via gRPC server.

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server.

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.

The Taxi Booking Manager for WooCommerce plugin by Magepeople inc. contains an Authentication Bypass vulnerability using an alternate path or channel. This issue affects versions before 2.0.8.

The ssh library in Erlang/OTP contains an Allocation of Resources Without Limits or Throttling vulnerability. An authenticated remote attacker can exhaust node memory by repeatedly opening session channels that are never assigned a handler. This affects OTP from 18.1.2 before 27.3.4.18, 28.5.0.7, and 29.1.1 (corresponding to ssh from 4.1.1 before 5.2.11.13, 5.5.2.6, and 6.0.6).

A denial-of-service vulnerability in the Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder is caused by inefficient algorithmic complexity (quadratic) when processing very large subidentifiers. A remote unauthenticated attacker can send a crafted OID during the TLS handshake, causing prolonged CPU consumption (e.g., about 13 seconds for ~262 KB of data). The issue affects the BER, PER, and JER decoders in lib/asn1.

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter. Unauthenticated attackers can include and execute arbitrary .php files on the server, allowing execution of any PHP code in those files.

The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode, making it possible for authenticated attackers with subscriber-level access and above to execute arbitrary shortcodes.

Net::IDN::Punycode versions before 2.590 for Perl do not validate UTF-8 input in encode_punycode. A flagged string with malformed bytes can hang, crash, or return a wrong label. Only direct calls to encode_punycode are affected; the decoder is not vulnerable.

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of overlong labels before the length check in to_ascii. Labels with many distinct non-ASCII characters cause quadratic CPU cost. All ASCII conversions in the distribution are affected.

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding long labels in decode_punycode. No label length limit exists in the to-Unicode direction, enabling CPU exhaustion attacks.

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode. Decoding an attacker-supplied punycode label reads and writes freed heap memory.

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.2.1. This is due to an operator precedence bug in the post-type guard within the trash_table_bulk() and restore_table_bulk() functions that causes the guard to never fire, combined with a permission callback that only verifies plugin role membership without per-post-type or ownership checks.

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. Authenticated attackers with Subscriber-level access and above can delete arbitrary files on the server.

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.

The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area. An unauthenticated user can submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.