CVE Vulnerability Catalog

Server-Side Request Forgery (SSRF) is reported in the ticket sales chart PDF export functionality of Wegow. An authenticated user with a promoter account can manipulate the <svg> parameter of the POST request generated by selecting Download PDF, causing the export.highcharts.com service to send HTTP requests to attacker-controlled external resources and embed their responses in the generated PDF.

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to and including 1.12.0 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or higher can inject arbitrary scripts that execute when a user hovers over a comment's like counter, as the tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML.

The User Registration PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3. This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadcasting post-deletion WebSocket events and returning thread API responses. An authenticated channel member can obtain server-side webhook URLs and authentication context from interactive-message posts via the post_deleted WebSocket event or the threads REST API.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log entries. An attacker with access to server logs can obtain valid session tokens or OAuth access tokens and impersonate authenticated users.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpoint. An attacker with a valid OAuth bearer token for a target user can permanently take over that user's SSO-backed account by setting an attacker-controlled password and detaching the account from its identity provider.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-initiated imports. An authenticated attacker with team admin privileges can force-add existing Mattermost users to their team and forge posts attributed to those users' identities.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user's permissions before other validations, allowing non-content reviewers to infer a post's flagged status via direct API call.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results. An authenticated user without permission to list private teams can disclose the ID, name, and display name of private teams via a modified team search request.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens. An authenticated attacker can join a team or gain unauthorized access to private channels via a forwarded or leaked invitation link.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter. This allows an authenticated SAML user to join any team, including invite-only teams, via forging the team_id or invite_id fields in the RelayState.

Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, and 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during local image proxy direct fetches. A remote attacker can cause memory exhaustion on the server via a crafted oversized image response.

The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page.

The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. An authenticated attacker with subscriber-level access or above can inject arbitrary web scripts into pages that execute whenever a user accesses the injected page.

The WPConsent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including, 1.1.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms allows Object Injection. This issue affects Gravity Forms: from n/a before 3.1.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.4.0.

The Green Popups plugin (halfdata-green-popups) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. The vulnerability allows an attacker to perform Blind SQL Injection.

The Grid plugin (the-grid) contains a Code Injection vulnerability due to improper control of code generation. The vulnerability allows an attacker to perform Command Injection.