CVE Vulnerability Catalog

The One User Avatar plugin for WordPress up to version 2.5.4 is vulnerable to Stored Cross-Site Scripting via the wpua_action_process_option_update function. Insufficient file type validation in wp_handle_upload() and reliance on attacker-controlled Content-Type header allow authenticated users with subscriber-level access to upload potentially executable files, which may lead to remote code execution. Exploitation requires admin to grant subscribers avatar upload permissions.

The LiteSpeed Cache plugin for WordPress up to version 7.8.1 is vulnerable to Stored Cross-Site Scripting via Comment Content. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. A payload crafted from decimal numeric character references bypasses WordPress's wp_kses sanitization.

The Forminator Forms plugin for WordPress up to version 1.57.0.1 is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the targeted Textarea field to have the Rich-Text editor option enabled.

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature, allowing an authenticated user with report administration permissions to gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature, allowing an authenticated user with report administration permissions to gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.

WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature, allowing an authenticated user with report administration permissions to gain arbitrary command execution as the Dimension WebUI process user by sending specially crafted requests.

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the administrator's consent.

An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

An out-of-bounds read vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.

In openNDS before 11.0.0, the client_params.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by embedding semicolons in a URL query parameter name.

A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds_preauth/ endpoint because of libopennds.sh.

An out-of-bounds read vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.

WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service.

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise.