CVE Vulnerability Catalog

Authorization Bypass Through User-Controlled Key vulnerability in WP Rentals by sc Internet Vivoo allows exploiting incorrectly configured access control security levels. Affects versions before 3.16.0.

In Checkmk versions before 2.5.0p10, improper certificate validation allows a relay and a push agent sharing the same UUID to reuse each other's mTLS certificate to authenticate against agent receiver endpoints in either direction, because the endpoints do not verify that the certificate was issued by their own root certificate.

Apache SkyWalking Booster UI (part of Apache SkyWalking UI) versions 10.2.0 through 10.4.0 are vulnerable to cross-site scripting (XSS) due to improper neutralization of input during web page generation. The product is marked as UNSUPPORTED WHEN ASSIGNED.

Apache Allura through version 1.20.0 is vulnerable to stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers.

Pik Online Portal through version 3.5.1 uses a one-way hash without salt, which enables cryptanalysis attacks. The vulnerability affects Pik Online Software Solutions Inc. Pik Online Portal.

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before version 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status).

The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.

The WPvivid — Backup, Migration & Staging WordPress plugin before version 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.

The WPLP Cookie Consent WordPress plugin before version 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.

The Frontend Admin by DynamiApps WordPress plugin before version 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration.

The Ninja Forms WordPress plugin before version 3.15.2 does not restrict its REST abilities to administrators, treating a plugin-specific capability as equivalent to full site administration. This allows any user granted that capability to read settings and stored submissions, overwrite configuration, and create or modify arbitrary posts and pages.

Apache Allura through version 1.20.0 has a stored XSS vulnerability via markdown HTML processing. The issue is fixed in version 1.21.0.

The WPFunnels WordPress plugin before version 3.13.0 does not perform any authorization or nonce check in one of its opt-in submission handlers, and takes notification recipients and subject from the request. This allows unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.

The WPFunnels WordPress plugin before version 3.13.0 does not restrict access to log files it writes to a predictable location under the public uploads directory. This allows unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.

The WPFunnels WordPress plugin before version 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for. This allows unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.

The Pods WordPress plugin before version 3.3.9.2 does not restrict which functions a display callback may resolve to. This allows users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1.

The PagerDuty alarm hook in Apache SkyWalking transmits the integration routing key over cleartext HTTP. Although PagerDuty serves over HTTPS and normally redirects plain HTTP to HTTPS, the initial POST request with the JSON body containing the routing key is sent unencrypted before any redirect response is received. The issue affects versions from 9.6.0 through 11.0.0.

The Content Views WordPress plugin before version 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns. This allows unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.

The WPFunnels WordPress plugin before version 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead. This allows unauthenticated attackers to create WordPress user accounts even when registration is disabled. This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.

A path traversal vulnerability was identified in Eleveo Quality Management 9.7.0 in the function QuestionnaireService.runDataExportNow of the Questionnaire Service component. Manipulation of the file_name argument leads to path traversal. The attack can be performed remotely. The exploit is publicly available, and the vendor did not respond.