CVE Vulnerability Catalog

The Extra Product Options Builder for WooCommerce plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file before serving it, allowing unauthenticated users who obtain a file's stored name to retrieve it. The plugin writes a deny-all rule into its upload directories, so disclosure only occurs on servers that honor it, such as Apache; on default nginx setups, files are already served directly.

The CatFolders Document Gallery & PDF Library WordPress plugin before version 2.0.7 lacks authorization checks in some REST API endpoints, allowing unauthenticated users to retrieve the title, type, size, and URL of media attachments assigned to any folders, including unpublished ones.

The WP Directory Kit WordPress plugin before version 1.5.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection. On multisite, a single-site admin can read data from the entire network.

The WCPOS – Point of Sale (POS) plugin for WooCommerce up to version 1.9.14 is vulnerable to Code Injection via the 'thermal' template engine. Authenticated attackers with Shop Manager-level access can inject arbitrary PHP code into a template that is subsequently executed on the server, leading to remote code execution.

The All-in-One WP Migration and Backup WordPress plugin before version 7.108 does not restrict migration import to network administrators on multisite, allowing a subsite admin to execute arbitrary PHP code across the entire network.

The Royal Elementor Addons plugin for WordPress up to version 1.7.1064 contains a Server-Side Request Forgery (SSRF) vulnerability in the Form Builder widget. An attacker with Contributor-level access can make requests to arbitrary locations, including internal services.

The Podlove Podcast Publisher plugin for WordPress up to version 4.5.3 contains an arbitrary file deletion vulnerability. Authenticated attackers with Contributor-level access can delete arbitrary files on the server, potentially leading to remote code execution.

The Platnosci Online Blue Media (Autopay) plugin for WordPress up to version 5.0.0 contains a Stored Cross-Site Scripting (XSS) vulnerability. Unauthenticated attackers can inject arbitrary scripts that will execute on the WooCommerce checkout page.

The Query Wrangler plugin for WordPress up to version 1.5.57 contains a remote code execution vulnerability. Missing capability check and nonce verification in the AJAX handler allow authenticated attackers with Subscriber-level access to execute code on the server.

A SQL injection vulnerability has been found in Evergreen up to versions 3.14.11/3.15.11/3.16.5/3.17-beta1. It affects an unknown function in the file /osrf-gateway-v1 of the open-ils.fielder OpenSRF Service component. The attack can be executed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in the Online Shopping System 1.0 by code-projects. It affects an unknown function in the file /login.php of the Login component. Manipulation of the email argument results in SQL injection. The attack can be performed remotely, and the exploit has been made public.

Pandora contains a denial-of-service vulnerability in its handling of DAA (Direct Access Archive) files. When extracting the internal ISO image, compressed chunks are decompressed using zlib.decompress() without enforcing a limit on the resulting uncompressed data. An attacker can submit a crafted DAA file with highly compressed data, causing excessive memory and CPU consumption, potentially making the extraction worker unresponsive or terminating it, affecting service availability.

SiYuan before v3.7.4 contains an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.

A weakness has been identified in Jinher OA 1.0. An unknown function of the file /C6/JHSoft.Web.HrmAttendance/attendance_out_approve.aspx is affected. Manipulation of the argument httpOID causes SQL injection. The attack can be initiated remotely. The exploit has been made public and could be used for attacks. The vendor was contacted but did not respond.

A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. An unknown function of the file /etc/config/easycwmp is affected. The manipulation results in hard-coded credentials. Remote attack is possible but highly complex and difficult to exploit. The exploit has been released publicly and may be used. The vendor was contacted but did not respond.

A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206 involving hard-coded credentials in the /etc/shadow file. The attack can be initiated remotely but requires high complexity and is difficult to exploit. The exploit is publicly available.

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0, where SQL injection in /edit_teacher.php via the ID argument can lead to SQL injection. The attack can be performed remotely, and the exploit is publicly disclosed.

In @fastify/multipart, a multipart form-data parser for Fastify, versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects during processing. An unauthenticated client can repeat this to cause persistent disk consumption and denial of service. The issue is fixed in version 10.1.1.

In @fastify/multipart, versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client aborts the connection before sending the terminating boundary, saveRequestFiles() never settles, and the temporary file is never cleaned up. An unauthenticated client can repeat this to permanently leak temporary files and suspended handler executions, leading to disk and event-loop exhaustion. The issue is fixed in version 10.1.1.