CVE Vulnerability Catalog

The Beaver Builder Page Builder plugin for WordPress up to version 2.10.2.2 is vulnerable to stored cross-site scripting via the Button Code setting in the Button Module. Insufficient input sanitization and output escaping allow authenticated attackers with author-level access to inject arbitrary scripts that execute when a user accesses an injected page.

The Contest Gallery plugin for WordPress up to version 30.0.7 is vulnerable to second-order SQL injection via the cg_multiple_files_for_post and cgRealId parameters. Insufficient escaping and lack of query preparation allow authenticated attackers with author-level access to append additional SQL queries, potentially extracting sensitive information.

The Invisible Anti-Spam & CAPTCHA plugin for WordPress up to version 5.1 is vulnerable to SQL injection via JSON keys/values patterns. Insufficient escaping and lack of query preparation allow authenticated attackers with editor-level access to append additional SQL queries, potentially extracting sensitive information.

The Invisible Anti-Spam & CAPTCHA plugin for WordPress up to version 5.1 is vulnerable to SQL injection via the 'key' parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with editor-level access to append additional SQL queries, potentially extracting sensitive information.

The Form Maker by 10Web plugin for WordPress up to version 1.15.44 is vulnerable to blind SQL injection via the '{username}' placeholder in a dynamic-choice field. Authenticated attackers with subscriber-level access can append additional SQL queries to extract sensitive information from the database.

The Hydra Booking plugin for WordPress up to version 1.2.2 is vulnerable to stored cross-site scripting via the 'first_name' parameter. Authenticated attackers with host-level access can inject arbitrary web scripts that execute when users access affected pages.

The KiviCare plugin for WordPress up to version 4.5.1 is vulnerable to generic SQL injection via the 'searchTerm' parameter. Authenticated attackers with custom-level access can append additional SQL queries to extract sensitive information from the database.

The Booking calendar, Appointment Booking System plugin for WordPress up to version 3.2.36 has an authorization bypass vulnerability. Unauthenticated attackers can mark reservations as paid or completed, cancel legitimate payments, auto-approve reservations, and trigger transactional emails.

The Image Uploader for Welcart plugin for WordPress up to version 1.4.6 is vulnerable to generic SQL injection via the 'post_title' parameter. Authenticated attackers with author-level access can append additional SQL queries to extract sensitive information from the database.

The Pinpoint Booking System – Version 2 plugin for WordPress up to version 2.9.9.6.8 is vulnerable to price manipulation via the 'cart_data' parameter. Unauthenticated attackers can override the WooCommerce checkout price of any bookable product to an arbitrary value, enabling purchase at a self-chosen price.

In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface.

In Red Hat Quay, a user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit an SSRF vulnerability within the build API by providing a malicious URL, causing the builder to make requests to internal network addresses.

In Red Hat Quay's exported logs feature, an unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. File IDs can be intercepted from plaintext email or webhook callbacks.

In Red Hat Quay's Stripe billing webhook handler, an unauthenticated attacker can forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header.

In Red Hat Quay, when SECURITY_SCANNER_V4_PSK is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint, allowing flooding of the notification queue and injection of path traversal characters into Clair API URL paths.

In Red Hat Quay, an administrator of any repository, by knowing or guessing a target notification's UUID, can read the notification configuration, including sensitive details like webhook URLs, Slack tokens, and email addresses. They can also trigger test notifications for another repository.

In Red Hat Quay's external LDAP authentication handling, when an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling user-existence oracle attacks at the referral DN.

In Red Hat Quay's JWT validation for federated robot accounts and SSO authentication, multiple issues related to audience verification and enforcement of azp and sub claims were identified. An attacker with a validly-signed token from the same identity provider could bypass configured security restrictions.

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks.

OpenStack Octavia through 18.0.0 mishandles QoS policy authorization. By associating another project's QoS policy with an amphora, an authenticated user may prevent deletion of that policy.