CVE Vulnerability Catalog

An information disclosure vulnerability has been found in dairy-management-system (Dav-ee) in delivery/checkfarmer.json.php, within the AJAX Endpoint component. Manipulation of the fname argument allows remote disclosure of information. The exploit has been published and may be used.

A SQL injection vulnerability has been found in dairy-management-system (Dav-ee) in payment/pay.php. Manipulation of the f_no/farmer arguments in the mysqli_real_escape_string function allows remote execution of SQL queries. The exploit is public and may be used.

In openGauss-server, the built-in function pg_read_binary_file_blocks() in src/common/backend/utils/adt/genfile.cpp has a permission check flaw. The function only validates the range of startBlockNum and blockCount, then calls ReadBinaryFileBlocksFirstCall(), which does not verify the caller's SELECT privileges. Any user with ordinary database connection access can read binary blocks of table data without SELECT permission if they know the relation file path.

The App Builder WordPress plugin before 5.7.1 does not require authentication or authorization before writing attacker-supplied data to one of its options, and on a separate unauthenticated request redirects the visitor's browser to a URI built from that stored data. This can lead to open redirect or other attacks.

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorized source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.

The TrueBooker WordPress plugin before 1.3.0 does not have authorization checks in place in some of its functionality, allowing unauthenticated users to create and modify booking services and categories, including their prices.

The TrueBooker WordPress plugin before 1.3.0 does not have authorization checks in some of its AJAX actions and does not validate the submitted service price server-side, allowing unauthenticated users to create bookings at a price of their choosing and to attach them to arbitrary customer accounts.

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link.

The TrueBooker WordPress plugin before 1.3.0 does not perform any capability check on one of its setup handlers, and the token it checks is issued to unauthenticated visitors. This allows anyone to overwrite the plugin's entire configuration and discard any settings they do not supply.

The Subscribe to Comments WordPress plugin before 2.3.3 does not sanitise newline characters from a notification sender-name setting before using it in e-mail headers. This allows users with Author-level access and above to inject arbitrary e-mail headers, such as a hidden Bcc, and to spoof the sender.

The iPOSpays Payment Gateway for WooCommerce WordPress plugin before 1.4.7 does not verify that a payment was actually completed before recording an order as paid. This allows unauthenticated users to mark any unpaid order as paid and rewrite its total.

A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.

The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state. This allows unauthenticated users to replace the thumbnail image the site publishes for any document.

The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup. This allows users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

A security vulnerability has been detected in Dav-ee dairy-management-system in the mysqli_query function of the employees/delete.php file. Manipulation of the e_payroll_no argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been publicly disclosed and may be used; the project has not yet responded to the report.

A weakness has been identified in Dav-ee dairy-management-system in the mysqli_query function of the farmers/add.php file. Manipulation of the f_no/f_id/f_name/f_locallity/f_ac/f_phone arguments can lead to SQL injection, and the attack can be launched remotely. The exploit is publicly available, and the product does not use versioning, so version information is unavailable.

A weakness has been identified in itsourcecode Online Cake Ordering System 1.0 in the confirm.php file. Manipulation of the cancel argument causes SQL injection, and the attack can be initiated remotely. The exploit is publicly available and could be used for attacks.

The Salon Booking System WordPress plugin before 10.31.11 does not enforce a minimum of zero when subtracting a fixed-amount discount from a booking's total. This allows an unauthenticated visitor who knows a valid discount code to create a confirmed booking stored with a negative total.

The BDM Digital Payment Gateway WordPress plugin through 1.3.12 does not verify credentials on its public payment-status update route and treats unset credentials as valid. This allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid without payment in the default configuration.