CVE Vulnerability Catalog

The PowerPack Addons for Elementor plugin up to version 3.1.0 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

The Books Gallery plugin up to version 4.8.4 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

Blind SQL Injection vulnerability in WOLF bulk-editor plugin by PluginUs.Net. Improper neutralization of special elements in SQL command allows blind SQL injection.

The FOX (woocommerce-currency-switcher) plugin up to version 1.5.4 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain access to functions that should be protected.

The User Registration plugin up to version 5.2.8 has a missing authorization vulnerability, allowing retrieval of embedded sensitive data. An attacker can exploit this to extract confidential information from the system.

The User Registration plugin up to version 5.2.8 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can gain access to functions that should be protected.

The User Registration plugin up to version 5.2.8 contains a stored XSS (Cross-site Scripting) vulnerability due to improper input neutralization during web page generation. This allows an attacker to inject malicious scripts that will execute in other users' browsers.

The User Registration plugin up to version 5.2.8 contains a Cross-Site Request Forgery (CSRF) vulnerability, allowing an attacker to force an authenticated user to perform unwanted actions. The attack can be carried out without the victim's knowledge.

An incorrect permission assignment for critical resource in AssetView, AssetView CLOUD, and AssetView Cloud +. A local authenticated attacker may gain SYSTEM privileges.

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress up to version 2.8.18 contains a sensitive information exposure vulnerability via ai_wp_footer_hook. This allows authenticated attackers with subscriber-level access and above to extract data such as the server's internal IP address, PHP configuration, WordPress and theme versions, hardening constants, the plugin's full block matrix, and all post meta values including underscore-prefixed protected keys such as API tokens and private integration state written by other plugins.

HCL Connections is vulnerable to a cross-site scripting (XSS) attack that allows an attacker to execute arbitrary script code in the browser of an unsuspecting user. This may lead to stealing cookie-based authentication credentials and compromising user accounts.

The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to and including 3.0. This allows authenticated attackers with editor-level access or above to append additional SQL queries to existing ones.

Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService. This could allow an attacker to load an unauthorized driver.

The WPGraphQL plugin for WordPress has a missing authorization vulnerability that allows retrieving embedded sensitive data. This affects all versions from n/a through 2.23.1.

The Wavlink WL-WN530BE1-A router version 251117 contains a stack-based buffer overflow in the strcpy function of /cgi-bin/ExportAllSettings.cgi in the Settings Export CGI component. Manipulating the HTTP_COOKIE/X-Cmd argument allows remote attack.

The Wavlink WL-WN530BE1-A router version 251117 contains a vulnerability in the popen function of /cgi-bin/uploadVpn.cgi. Manipulating the Type argument leads to OS command injection, and the attack can be performed remotely.

Wavlink WL-WN592AX6 version 250422 is vulnerable to a null pointer dereference in the main function of /cgi-bin/upload.cgi, triggered by manipulation of the Cookie argument. The attack can be performed remotely.

Firefox for iOS directly interpolated the page's HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox's privileged content world and bypass the page's Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.

Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Autofill was not bound to the originating page or rejected when its origin changed. This vulnerability was fixed in Firefox for iOS 157.1.

The AcyMailing plugin for WordPress in versions up to and including 11.1.0 is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint. The acym_cleanVar() sanitizer only strips complete HTML tags, and SubscriberInsertion::replaceUserInformation() together with the archive view template insert the stored subscriber field value into the mail body without HTML encoding. This allows an unauthenticated attacker to inject arbitrary scripts that execute when the online-archive URL for the poisoned subscriber is accessed.