CVE Vulnerability Catalog

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted link to a page displaying one of its galleries.

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page.

The Cookie Consent WordPress plugin before 0.0.10 does not correctly enforce its intended administrator-only capability check on its consent-settings REST routes, so they fall back to an authentication-only gate. Any authenticated user such as a subscriber can update consent settings and, on sites connected to the vendor's paid plan, read stored visitor consent logs.

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page. Users with a role as low as Contributor can store a payload that executes in the browser of a user who views the content and clicks the affected element.

The WP Crowdfunding WordPress plugin before 2.2.1 does not check the campaign-submission capability in one of its AJAX actions. Any authenticated users such as Subscribers can create crowdfunding campaign posts despite not being granted that permission.

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details. Any authenticated users such as Subscribers can read the personal data of any WooCommerce order and enumerate every order in the store.

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification email sent to its backers. Any authenticated users such as Subscribers can alter other users' campaigns.

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed. Authenticated patient-level users can read other patients' bills, invoices and appointment details.

The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers.

The Eventin WordPress plugin before version 4.1.20 does not properly restrict access to stored customer records, allowing users with contributor-level access and above to read other customers' personal data such as names and email addresses.

The LearnPress WordPress plugin before version 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.

The Linkable Loadable Extensions (llext) subsystem in Zephyr OS mishandles PLT/RELA relocation entries when linking relocatable ELF extensions on Xtensa. The lack of validation of the r_offset field allows an out-of-bounds write beyond the extension's text buffer, leading to memory corruption in supervisor context.

The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex as a plain zero-filled static struct k_mutex credential_lock; and never called k_mutex_init() on it. A statically zero-filled k_mutex has an uninitialized wait queue (its dlist head/tail are NULL instead of the self-referential sentinels that k_mutex_init/K_MUTEX_DEFINE install). The uncontended lock path does not touch the wait queue, so the defect is latent and serialized use behaves correctly.

In the Intel ALH driver function dai_alh_get_properties(), lack of range validation for stream_id leads to an out-of-bounds read and kernel information leak. The vulnerability can be exploited from user mode if access to the ALH device is granted.

A security flaw in Open5GS up to 2.7.6 affects the smf_gx_cca_cb function of the SMF Diameter Gx Credit-Control-Answer Handler, leading to denial of service. The attack can be launched remotely, and the exploit has been publicly released.

In tablib prior to 3.10.0, a stored cross-site scripting vulnerability exists in the HTML export functionality. Malicious payloads in dataset titles are interpolated unsanitized into HTML output, allowing arbitrary JavaScript execution.

In Samsung Open Source rlottie, an integer overflow vulnerability leads to buffer overflow, potentially allowing arbitrary code execution.

In Samsung Open Source rlottie, an uncontrolled resource consumption vulnerability leads to excessive memory allocation.

In Open5GS up to 2.7.6, a vulnerability in the fd_msg_sess_get function of the HSS Service component leads to denial of service. The attack can be performed remotely, and the exploit has been publicly disclosed.