CVE Vulnerability Catalog

The Pochipp plugin for WordPress (versions up to and including 1.20.2) is vulnerable to reflected cross-site scripting via the 'keyword' parameter. Insufficient output escaping causes the $_GET['keyword'] value to be interpolated into the value attribute without esc_attr(). Unauthenticated attackers can inject arbitrary scripts that execute when a user with upload_files capability clicks a crafted link.

The Better Messages plugin for WordPress (versions up to and including 2.15.33) is vulnerable to authorization bypass due to improper verification of user authorization. An authenticated attacker with custom-level access can access the full message transcript, thread metadata, and user data of any chat-room thread without authorization. This is only exploitable when the chat room's only_joined_can_read setting retains its default value of '0'.

The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'student_id' parameter. Missing validation on a user-controlled key allows authenticated attackers with subscriber-level access and above to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs.

The Better Messages plugin for WordPress (versions up to and including 2.15.33) is vulnerable to Information Exposure by Spoofing. The is_ai_bot_user() function identifies privileged internal AI bot accounts by checking for the 'ai-chat-bot-' prefix against a guest record's stored IP address, which is populated verbatim from the client-controlled X-Real-IP request header. This allows unauthenticated attackers to register a guest identity treated as an internal AI bot, bypassing role allowlists and join filters to join administrator-restricted chat rooms, post messages, and read other users' private message history.

The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute if they can trick a user into clicking a link.

The Tutor LMS plugin for WordPress (versions up to and including 4.0.8) is vulnerable to authorization bypass due to improper verification that a user is authorized to perform an action. This allows authenticated attackers with subscriber-level access and above to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ). The exploit chain requires triggering the profile-photo upload flow, creating a Tutor topic reparented to that attachment, then invoking the lesson deletion handler against any target post ID.

The Divi Essential plugin for WordPress (versions up to and including 5.8.1) is vulnerable to sensitive information exposure via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when the 'nonce' POST parameter is present and can be trivially bypassed by omitting it) and never call current_user_can() or enforce a capability. This allows authenticated attackers with Subscriber-level access and above to enumerate every table in the WordPress database and read up to a caller-controlled number of rows from any table — including wp_users (usernames, emails, hashed passwords), wp_usermeta (session tokens, secret keys), and wp_options (privileged settings, API keys, credentials stored by other plugins).

The SEO Booster plugin for WordPress (versions up to and including 7.4.7) is vulnerable to Missing Authorization due to a missing capability check on the handle_oauth_callback() function hooked to admin_init, which processes $_GET['access_token'] and $_GET['google_email'] without verifying the caller's role. This allows authenticated attackers with Subscriber-level access and above to overwrite the seobooster_access_token, seobooster_google_email, and seobooster_gsc_sites options and delete the seobooster_needs_reauth flag by visiting a crafted /wp-admin/ URL, disrupting the Google Search Console integration and injecting attacker-chosen data into site options.

The WP2Social Auto Publish plugin for WordPress (versions up to and including 2.4.12) is vulnerable to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

The WPComplete plugin for WordPress (versions up to and including 2.9.9.0) is vulnerable to Stored Cross-Site Scripting via the 'empty' Shortcode Attribute due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page. This requires the premium version of the software. Please note this only affects the pro version.

SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metadata. Attackers can call the endpoint with type=8 and crafted content to read block titles, names, aliases, and hierarchical paths of restricted documents via template injection.

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable storage access, can copy the SQLite database and media files directly without entering the vault passcode.

A flaw in Netty's `netty-codec-http` component. A remote attacker can send a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling.

A flaw in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests.

Vulnerability in Open edX Platform allows a course author or staff user with import permission to bypass path validation in _is_bad_path, which compares paths using startswith instead of comparing path components. A crafted .tar.gz archive can escape into a sibling course staging directory, causing limited cross-tenant file corruption.

Vulnerability in Open edX Platform involves lack of sanitization of discussion-title values in add_additional_attributes_to_notifications, allowing an enrolled student to place CSS-capable markup in post titles. This markup is rendered as safe HTML in email digests, enabling email-open tracking and content spoofing or phishing.

Vulnerability in Suricata allows treating IPv4 and IPv6 flows as equal without comparing IP family when raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. This can cause incorrect flowbit state, detection bypass, or IP-only bypass.

Vulnerability in Suricata's SMB parser can retain force-completed transactions on flows with one-directional payload, leading to unbounded per-flow state and CPU/memory exhaustion. Sustained one-directional SMB traffic can be exploited.

Vulnerability in microsandbox exposes network config secrets and environment variables via command-line arguments, readable by other local users through process listings. This can disclose API keys, tokens, and other secrets on shared hosts, CI runners, and developer systems.

Vulnerability in Suricata's SMTP MIME parser does not fully reset state when processing Content-Type: message/rfc822 encapsulation, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs.