CVE Vulnerability Catalog

The Webba Booking plugin in versions up to 6.5.2 contains an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8.

A Path Traversal (CWE-22) vulnerability in the execute_obj function of PeaZip's archive object viewer (peach.pas) in versions 11.2.0 and earlier on Windows allows an attacker to execute an arbitrary program already present on the victim's system. The attacker must convince the victim to preview a crafted archive entry via the "Preview with... -> Associated application" action (Shift+Ctrl+O), where the entry name contains "../" sequences that escape the temporary extraction directory and are passed to ShellExecuteW without warning. The flaw stems from missing validation of the tempstring and lack of path-containment check in checkfiledirname.

Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Broken Link Checker: from n/a through 2.4.14.1.

The WholesaleX – B2B & Wholesale Plugin for WooCommerce with Wholesale Prices plugin for WordPress is vulnerable to Limited Privilege Escalation in all versions up to, and including, 3.0.8 via the 'process_registration' due to missing validation on the 'wholesalex_registration_role' parameter. This makes it possible for unauthenticated attackers to register as any existing WholesaleX role. The vulnerability was partially patched in version 2.3.8.

A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to cause memory corruption and null pointer dereference, potentially leading to process crash, DoS or information disclosure.

A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server.

A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.

In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.

A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution.

A vulnerability in HPE NonStop Kernel Level Thread Model Lib can cause stack buffer overflow which can allow arbitrary code execution.

Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5.

Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart (fluent-cart) allows Retrieve Embedded Sensitive Data. This issue affects FluentCart through version 1.7.1.

The Fluent CRM plugin (up to 3.2.5) contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker could exploit this flaw to gain higher privileges within the WordPress system.

The BSK PDF Manager WordPress plugin up to version 3.8.1 does not properly neutralize input during web page generation, allowing Stored XSS. A malicious script stored in the application is later executed in other users' browsers.

The Amelia Booking plugin (up to 2.4.10) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An attacker could execute arbitrary SQL queries, potentially leading to data leakage or modification.

The Everest Forms WordPress plugin up to version 3.6.1 does not properly neutralize input during web page generation, allowing Stored XSS. A malicious script stored in a form is executed in users' browsers.

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption, which may result in a system halt. The description does not specify the attack vector or required privileges.