CVE Vulnerability Catalog

The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones. It also does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.

The Blood_Bank_Management_System version 1.0.0 has a Cross-Site Scripting vulnerability in the /abs.php file due to manipulation of the Search argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

The Books4Cash application (up to commit a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571) has a Cross-Site Scripting vulnerability in the search.php file due to manipulation of the Search argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object. This allows users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links. This allows unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.

The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an attachment and permanently deleting it. This allows users with the Editor role and above to delete arbitrary posts of any type, including content they cannot otherwise delete such as navigation menus, block templates and global styles.

The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it. This allows authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users.

The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data. This allows any authenticated user, including Subscribers, to disclose the names, email addresses, transaction IDs and payment amounts of every booking on the site.

The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff. This allows any authenticated user, such as a subscriber, to retrieve every discount coupon configured on the site, including coupons the administrator has chosen to hide from customers, together with their amounts, validity dates and usage limits.

The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publicly accessible location under an attacker-chosen filename. This allows users with the Salon Staff role or higher to force the server to read internal-only resources and disclose them, and to store a malicious SVG that runs arbitrary scripts in the site's origin for anyone who opens it.

The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user accounts its salon staff roles may edit through the customers management screen. This allows users with the Salon Staff or Salon Worker role to reset any other user's role, including administrators, to a customer and to overwrite arbitrary profile fields on any account.

The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer. This allows them to escalate any account to administrator and take over the site.

The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms. This allows users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.

The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of a Stripe Checkout session. This allows unauthenticated attackers to redirect victims who complete or cancel checkout to an arbitrary external URL.

The television application (up to version 0.15.9) has a Command Injection vulnerability in the Entry::output function of the television/channels/entry.rs file due to manipulation of the raw argument. The attack requires local access.

The Databasement application (up to version 1.8.1) has a Missing Authorization vulnerability in the Scheduled Restore component, in the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php, due to manipulation of the schema_name argument. The attack can be executed remotely, and the exploit has been publicly disclosed.

A flaw has been found in OpenCATS 0.10.0 in the processLogin function of modules/careers/CareersUI.php (Career Portal component). Manipulation of the applyToJobSubAction argument causes improper restriction of excessive authentication attempts, allowing remote exploitation. The attack requires high complexity and exploitability is described as difficult, but the exploit has been published and may be used.

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

A SQL injection vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The vulnerability affects the functions MySQLDB::valid, MySQLDB::getresults, MySQLDB::noresults, MySQLDB::getExams, MySQLDB::latestExamID, and MySQLDB::getreport in results.php and include/database.php. Manipulation of the id, user, or topic arguments leads to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The vulnerability affects an unknown function in qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Manipulation of the query, qtype, sortname, or sortorder arguments leads to SQL injection, and the attack can be launched remotely. The exploit has been made publicly available and could be used for attacks.