CVE Vulnerability Catalog

A vulnerability in OpenDMARC up to 1.4.2 affects the strcasecmp function in libopendmarc/opendmarc_policy.c, leading to improper handling of exceptional conditions. The attack can be executed remotely, and the exploit has been made public.

A vulnerability in OpenDMARC up to 1.4.2 affects the opendmarc_policy_parse_dmarc function in libopendmarc/opendmarc_policy.c. Manipulation of arguments like fo/rf/ri/pct/sp/adkim/aspf/rua/ruf leads to improper handling of exceptional conditions. Remote exploitation is possible, and the exploit has been disclosed.

Reflected Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 occurs in the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping. The attack requires the victim to follow a crafted link, and the site must be configured with LdapCommentAuthenticator.

Stored Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows an anonymous attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it. Affects only sites with HTML in comments enabled (users.comments.htmlenabled=true) and HTMLSubset formatter.

Stored Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows an unauthenticated attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped Trackback, verification and moderation defaults allow the value to be approved and rendered as an active link; a visitor who clicks the link executes script in the weblog's origin.

Stored Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back with that type. A victim who opens the uploaded file executes the stored script. Media uploads are disabled by default; only installations that enable them are affected.

Exposure of Sensitive Information vulnerability in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing secrets, by authoring a Velocity template that uses an include directive to load a classpath resource outside the theme namespace. Roller treats weblog administrators as untrusted and enables a Velocity sandbox, but the include and parse directives are not confined by it.

Reflected Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog using the bundled frontpage theme, by supplying a crafted blog-directory parameter that the directory page reflects without proper escaping. Affects only weblogs using the bundled frontpage theme, and a victim must follow a crafted link.

Stored Cross-site Scripting (XSS) vulnerability in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding, causing the stored script to execute in another author's or administrator's browser. No optional feature or non-default configuration is required; affects weblogs with multiple authors or administrators who are not mutually trusted.

A SQL injection vulnerability was discovered in aaPanel BaoTa up to 11.8.0, affecting the get_domain_status function in /www/server/panel/mod/project/domain/domainMod.py (Domain Handler component). Manipulation of the get argument allows remote SQL injection. The exploit has been publicly released and the vendor did not respond to the disclosure.

A SQL injection vulnerability was identified in aaPanel BaoTa up to 11.8.0, affecting the getData function in /www/server/panel/class/data.py. Manipulation of the log_type argument leads to SQL injection. The attack can be launched remotely and the exploit is publicly available; the vendor did not respond to the disclosure.

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks.

The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership. This allows unauthenticated users to mark any order as paid.

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to. This allows unauthenticated users to mark an arbitrary pending order as paid by confirming a smaller payment of their own against it.

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The route is not rate limited either.

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path. This allows the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total. This allows unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form. This allows unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.

A vulnerability was found in Frappe HR up to 16.15.0, affecting the get_expense_claims/get_shift_requests/get_attendance_requests functions in hrms/api/__init__.py (Permission Validation component). Manipulation of the employee argument leads to incorrect authorization. The attack can be launched remotely; the vendor confirmed the issue has already been fixed.