CVE Vulnerability Catalog

The Bit Form plugin for WordPress, up to and including version 3.2.0, is vulnerable to generic SQL Injection via the 'data[queryCondition]' parameter. The vulnerability is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. This allows authenticated attackers with administrator-level access and above to append additional SQL queries to existing ones, which can be used to extract sensitive information from the database.

The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.4 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid.

The Embed Google Photos album WordPress plugin through version 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.

The affiliate-toolkit plugin for WordPress, up to and including version 3.8.8, is vulnerable to time-based SQL Injection via the 'orderby' parameter. The vulnerability is due to insufficient escaping of the user-supplied parameter and lack of sufficient preparation of the existing SQL query. This allows authenticated attackers with administrator-level access and above to append additional SQL queries to existing ones, which can be used to extract sensitive information from the database.

The Astro Booking Engine plugin for WordPress up to version 1.4.0 is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the options deletion functionality. This allows unauthenticated attackers to delete all plugin settings via a forged request, provided they can trick a site administrator into performing an action such as clicking a link.

A vulnerability was determined in SourceCodester Air Cargo Management System 1.0 in the file /classes/Master.php?f=save_cargo_type. Executing a manipulation of the argument ID can lead to SQL injection. The attack can be executed remotely, and the exploit has been publicly disclosed.

A vulnerability was found in francoisjacquet RosarioSIS up to version 12.8 in the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation is possible. Upgrading to version 12.9 addresses the issue.

A vulnerability was found in RosarioSIS up to version 12.7.4, in the student medical module. Manipulation of the 'table' argument in Medical.inc.php leads to SQL injection. The attack can be launched remotely.

A flaw was found in RosarioSIS up to version 12.8, affecting the DBUpdate function in Discipline/Referrals.php. This manipulation causes an authorization bypass. The attack can be initiated remotely, and the exploit has been published.

A vulnerability was identified in fm-mcp-servers version 0.0.3, affecting the downloadReport function in src/smadex-reporting/src/index.ts. Manipulation of the downloadUrl argument leads to server-side request forgery (SSRF). The attack can only be performed from a local environment.

A weakness was identified in Hospital Management System version 1.0, affecting the file viewdoctortimings.php. Manipulation of the delid argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A security flaw was discovered in swagger-testcase-mcp (commit 5babb27c951fb404bc2b25ec80593616e49054e5), affecting the loadSource function in src/utils/swagger-parser.ts. Manipulation results in server-side request forgery (SSRF). The attack can be carried out remotely, and the exploit is public.

A vulnerability was found in DTStack Taier version 1.4.0, affecting the MultipartFile.getOriginalFilename function in UploadController.java. Manipulation of the File argument leads to path traversal. The attack can be initiated remotely.

A vulnerability in lamp-cloud up to version 5.10.0 affects an unknown part of DefGenProjectController.java in the Code Generator component. Manipulation of outputDir/parent/projectPrefix arguments leads to path traversal. The attack can be launched remotely, and the exploit has been publicly disclosed.

OpenChoreo prior to versions 1.0.3, 1.1.3, and 1.2.0-rc.2 has a vulnerability in the POST /api/v1alpha1/autobuild endpoint. Webhook provider selection relies on attacker-controlled X-Event-Key, and Bitbucket requests are accepted without HMAC-SHA256 verification. This allows unauthenticated build triggers for components matched by repository URL and branch, including cross-provider attacks using attacker-supplied commit SHAs.

FreePBX before versions 16.0.47 and 17.0.30 has a vulnerability in the Framework module that allows a crafted backup to restore the hidden AUTHTYPE setting with the value none. An authenticated user with backup-restore access can disable FreePBX authentication during restoration, bypassing the UI removal of AUTHTYPE=none.

Trigger.dev from version 4.4.2 to 4.5.0-rc.4 has a vulnerability in the POST /api/v1/runs/:runParam/replay endpoint. The database query does not filter by runtimeEnvironmentId, allowing any valid environment API key to replay another tenant's run by friendlyId. Additionally, when payloadType "application/store" is used, payload bytes can be overwritten by an attacker, leading to unauthorized actions.

Russh prior to version 0.62.4 has a denial-of-service vulnerability. An authenticated SSH client can send a pty-req channel request with more than 130 terminal-mode records. The parser in russh/src/server/encrypted.rs stores terminal modes in a fixed 130-entry array but continues increasing the mode count, leading to an out-of-bounds slice and panic before the pty_request handler runs.

dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator, enabling title spoofing, clipboard manipulation, or other escape-sequence attacks.

Trix prior to version 2.1.18 is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a <span> with an empty data-trix-attachment="{}" value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and execute when another user renders and clicks the content.