CVE Vulnerability Catalog

Dell PowerProtect Data Domain contains a Path Traversal vulnerability. A low privileged attacker with remote access could exploit it to gain filesystem access.

Dell PowerProtect Data Domain contains an OS Command Injection vulnerability. A low privileged attacker with remote access could exploit it to execute commands.

Dell PowerProtect Data Domain Virtual Edition contains an OS Command Injection vulnerability. A high privileged attacker with remote access could exploit it to execute commands.

The MemberPress plugin for WordPress in versions up to and including 1.14.1 is vulnerable to Cross-Site Request Forgery. This is due to a bypassable nonce verification check in the save_profile_fields() function using an isset() condition, allowing the security check to be completely bypassed by omitting the nonce parameter from the request. This enables unauthenticated attackers to change authenticated users' email addresses via a forged request, leading to account takeover through password reset functionality.

Database backups created by AXIS Camera Station Pro in versions prior to the patch are vulnerable to offline attacks. After updating, the system automatically creates an additional backup that may also be vulnerable, so all such backups should be deleted and stored credentials changed.

The VikRentCar plugin for WordPress in versions up to and including 1.4.8 is vulnerable to cross-site request forgery (CSRF) in the condtext_update_tmpl function due to missing nonce validation. This allows unauthenticated attackers to write arbitrary PHP code to the plugin's template files and achieve remote code execution if they can trick an administrator into clicking a link.

The Prime Slider plugin for WordPress in versions up to and including 4.7.2 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page.

The MxChat plugin for WordPress in versions up to and including 3.2.25 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'feedback' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when an administrator visits the Transcripts page.

The IvyForms plugin for WordPress in versions up to and including 1.5.1 is vulnerable to arbitrary file upload via the filterFiletypeAndExt function due to insufficient file type validation and bypass of WordPress's native defenses. Authenticated attackers with custom-level access can configure a file upload field with a dangerous extension, and then any unauthenticated visitor can upload a file via the public REST endpoint, enabling remote code execution.

The Mage Eventpress plugin for WordPress in versions up to and including 5.7.8 is vulnerable to privilege escalation via the mep_grant_shop_manager_access() function, which unconditionally grants manage_options when a request marker (e.g., $_GET['page']) starts with 'mep_' or 'mpwem_'. Authenticated attackers with Shop Manager-level access can elevate their privileges to Administrator by appending the parameter to admin URLs.

The Product Designer for WooCommerce (Lumise) plugin for WordPress in versions up to and including 2.1.2 is vulnerable to Directory Traversal via the process_checkout function. Unauthenticated attackers can read arbitrary files on the server because the required lumise_security nonce is freely obtainable through the /?lumise=ajax action=init handler.

The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management authorization check on its SMTP configuration page, which is gated only on the plugin activation capability. This allows users with a delegated role below administrator to change outbound mail delivery and achieve administrator account takeover.

The Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute. This leads to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request.

The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out. This allows unauthenticated users to store a Cross-Site Scripting payload that executes in another user's session, including a logged-in administrator.

Insufficiently Protected Credentials in the tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access access keys, secret keys, and deployment secrets.

The Rank Math SEO plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in the updateMeta REST API endpoint. An authenticated attacker with Contributor-level access or higher can inject a PHP object, and the presence of a POP chain allows remote code execution by writing a webshell to the uploads directory.

The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure via the 'animated-text' shortcode. The atb_shortcode_handler() function fetches an arbitrary post by attacker-supplied ID and, without capability checks or post_type validation, displays its content, allowing authenticated attackers with Contributor-level access or higher to read rendered content of any published post, including non-public custom post types.

The affiliate-toolkit plugin for WordPress is vulnerable to Arbitrary File Upload via the upload_image function. Due to insufficient file type validation (weak Content-Type prefix check and extension derivation from attacker-controlled URL path), an authenticated attacker with Contributor-level access or higher can upload executable files, enabling remote code execution. Exploitation requires the 'import product image' option to be enabled.

The AMP for WP – Accelerated Mobile Pages plugin for WordPress up to and including 1.1.17 is vulnerable to stored cross-site scripting via the 'headline-*' shortcode attribute due to insufficient input sanitization and output escaping. A Subscriber-level user can store a malicious shortcode in their biographical info field that executes when a user accesses the page.

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers can close the quoted PRAGMA argument and append statements to read, modify, or drop SQLite data, bypassing read-only mode and write approval.