CVE Vulnerability Catalog

Unauthenticated Cross Site Scripting (XSS) vulnerability in Podlove Podcast Publisher plugin versions up to 4.5.4. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.

Unauthenticated Cross Site Scripting (XSS) vulnerability in SEO Plugin by Squirrly SEO plugin versions up to 14.2.2. An attacker without authentication can inject a malicious script into the page, which executes in the victim's browser.

Unauthenticated Cross Site Scripting (XSS) in Aora versions up to 1.3.19. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in Paymob for WooCommerce versions up to 4.1.10. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in Advance Product Search versions up to 1.4.8. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in SmartSMTP versions up to 1.2.0. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products versions up to 1.4.13. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in GeoDirectory versions up to 2.8.173. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium versions up to 5.6.07. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in wpDataTables versions up to 6.5.1.4. An attacker can inject malicious script without authentication.

Subscriber SQL Injection in WordPress Persistent Login versions up to 3.1.0. A user with subscriber role can execute unauthorized database queries.

Unauthenticated Cross Site Scripting (XSS) in Tagembed versions up to 7.4. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in TranslatePress versions up to and including 3.3.2.

Unauthenticated Cross Site Scripting (XSS) in JetEngine versions up to and including 3.8.14.1.

Unauthenticated Local File Inclusion in Golo Framework versions prior to 1.7.5.

Unauthenticated Local File Inclusion in Shuffle versions up to and including 1.8.

A flaw in FreeIPA allows a remote unauthenticated attacker to exploit the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body, causing excessive memory consumption, memory exhaustion, and denial of service.

A flaw in FreeIPA allows a remote unauthenticated attacker to send oversized form POST requests to `/ipa/migration/migration.py`, forcing the migration handler to read attacker-controlled bodies fully into memory, leading to increased memory usage, slower handling, and potential DoS.

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations, allowing a user with LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets and potential full domain compromise.

A flaw in libvirt allows an unprivileged local user to exploit an integer overflow in the NodeGetFreePages RPC handler, bypassing a size check and leading to a heap buffer overflow. This can corrupt the root libvirt daemon's memory, potentially causing DoS or local privilege escalation.