CVE Vulnerability Catalog

XSS vulnerability in Softtr Informatics E-Commerce Pack due to improper neutralization of script-related HTML tags. Allows Cross-Site Scripting attacks.

Authorization bypass vulnerability in AdisyonPro via user-controlled key. Allows access to functionality not properly constrained by ACLs.

The Push Notification for Post and BuddyPress plugin version 3.20 and earlier has a Subscriber Broken Access Control vulnerability. This means a user with the subscriber role can gain unauthorized access to functions they should not have permissions for.

Kali Forms version 2.4.23 and earlier has an Unauthenticated Broken Access Control vulnerability. This means an unauthenticated attacker can access functions that should be protected.

The Ditty plugin version 3.1.67 and earlier has a Subscriber Broken Access Control vulnerability. A user with the subscriber role can gain unauthorized access to functions they should not have permissions for.

The FluentPlayer Pro plugin version 1.3.2 and earlier has an Editor Broken Access Control vulnerability. A user with the editor role can gain unauthorized access to functions they should not have permissions for.

The Fluent Boards Pro plugin version 2.0.11 and earlier has an Editor Arbitrary File Deletion vulnerability. An editor can delete arbitrary files on the server, which can lead to serious damage.

The Fluent Boards Pro plugin version 2.0.11 and earlier has a Subscriber Cross Site Scripting (XSS) vulnerability. A user with the subscriber role can inject a malicious script that executes in other users' browsers.

In Spring Authorization Server versions 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request with an invalid request_uri and an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.

The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions up to, and including, 3.1.3, allowing authenticated attackers with Subscriber-level access to unsubscribe arbitrary customers from product stock-alert notifications.

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPress plugin before 2.21.0's campaign configuration and scheduling data.

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.

In the Joomla Event Manager extension before version 5.0.1, attendee lists are readable by any logged-in user. A non-manager can read attendee names, usernames, registration dates, and statuses for events they do not manage, including lists belonging to unpublished events.

In the Joomla Events Manager extension before version 5.0.1, there is a reflected XSS vulnerability via the PDF export link. The buildCurrentPdfLink function copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to a reflected XSS vector.

In the Joomla Event Manager extension before version 5.0.1, there is a vulnerability allowing cross-user event and venue takeover through forged form fields. A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that record.

In the Joomla Event Manager extension before version 5.0.1, there is a vulnerability allowing unauthenticated article overwrite and force-publish. Any visitor holding their own session token can republish and overwrite an article associated with an event.

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions. Attackers could make a logged-in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link.

JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Affected versions: Spring for Apache Kafka 4.1.0, 4.0.0-4.0.6, 3.0.0-3.3.16, 2.9.0-2.9.14, and 2.8.12 and earlier.

A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Affected versions: Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Affected versions: Spring Integration 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.