CVE Vulnerability Catalog

Security Misconfiguration vulnerability in HCL BigFix Service Management. An authenticated attacker could exploit improper access controls, enabling unauthorized viewing of restricted data elements across tenant boundaries.

Path Traversal vulnerability in the ASReportService component of HCLSoftware AppScan 360°. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized file modification within the application's directory scope.

An improper encoding or escaping of output vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information.

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in the Theme API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users with administrator privileges to read or write limited files.

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 12.0.6 via the Assignment Engine fields. This is due to insufficient input sanitization and output escaping on assignment data fields including Expressions, URLs, and Advanced assignment data.

A flaw was found in Netty's netty-handler-ssl-ocsp component. A remote attacker can provide an OCSP response that omits the optional nextUpdate field, causing OCSP validation to be silently skipped and applications to proceed with an unvalidated certificate.

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightbox_class' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page.

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts if they trick a user into clicking a link.

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page.

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts if they trick a user into clicking a link.

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'album_id' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficient escaping and lack of preparation on the existing SQL query. Authenticated attackers with author-level access can append additional SQL queries to extract sensitive information from the database.

The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and including, 9.3.0 due to insufficient escaping and lack of preparation on the existing SQL query. Authenticated attackers with custom-level access can append additional SQL queries to extract sensitive information from the database.

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to and including 2.5.1. This is due to insufficient escaping and lack of prepared statements in the WPIMItem::get_all() function. Authenticated attackers with Contributor-level access or above can append additional SQL queries to extract sensitive information from the database.

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vkExUnit_cta_img_position' Post Meta in all versions up to and including 9.118.0 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page.

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.8.0 via the 'filename' parameter. Authenticated attackers with shop manager-level access or above can read the contents of arbitrary files on the server, which may contain sensitive information.

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to and including 6.5.6 due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page.

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kubio/copyright Block Content in all versions up to and including 2.8.4 due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts that execute when a user accesses an injected page. This bypasses both WordPress core kses-on-save and the plugin's own wp_kses_post() because entity-encoded script tags are treated as inert text but decoded into live HTML.

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. Attackers with LatePoint Agent-level access or above can read bookings and customer PII (full name, email, phone, and notes) assigned to other agents, and delete arbitrary bookings. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles.

The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. Authenticated attackers with subscriber-level access or above can permanently delete arbitrary posts, pages, and custom post types (bypassing the trash) or change any published post to draft status.

The Bar Association Website by KA Informatics Technologies Ltd. Co. is vulnerable to Reflected XSS due to improper neutralization of input during web page generation. This issue affects versions through 18092026. The vendor was contacted but did not respond.