CVE Vulnerability Catalog

The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content. This allows authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature. This allows the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured.

The GetPaid WordPress plugin before 2.8.55 does not verify the authenticity of incoming Worldpay payment notifications. This allows unauthenticated attackers to forge a notification that marks a pending invoice as paid without any payment being made.

The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid. This allows unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete. This allows unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions, potentially leading to exposure of sensitive information or initiation of unintended requests to backend services.

In WSO2 products, when internal roles are removed from a user, the system fails to invalidate previously issued authentication tokens. Users may retain access privileges even after role revocation.

The Class Mediator in WSO2 products fails to properly validate or sanitize messageContext properties used for dynamic values. Authenticated users may access or modify data across invocations.

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed. Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes. Affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4.

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive. This is not unconditional cross-site scripting, but poses a risk. Affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

An Open Redirect vulnerability in the html_sanitize_ex library (HTML5 scrubber component) allows a remote attacker to force visitors to navigate to an attacker-chosen site via a <meta http-equiv="refresh"> element in sanitized HTML. The library keeps attacker-supplied <meta> elements in its output, which can also declare document-wide directives such as Content-Security-Policy. Affected versions are from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction attributes on an <input> element in sanitized HTML. HTML's form attribute associates an input with any form on the page by its id even when the input sits outside that form, and formaction on a submit control overrides the owning form's action. Neither attribute receives a scheme check, so an absolute cross-origin URL survives sanitizing. No script executes. The scrubber allows neither form nor button, so the attacker cannot introduce a form of their own and the rendering page must already contain a form carrying an id. This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.3.

A command injection vulnerability was detected in the ludus_cli_execute component of NocteDefensor LudusMCP (up to version 1.0.24). The vulnerability affects the executeArbitraryCommand/executeCommand function in src/ludusMCP/cliWrapper.ts, where manipulation of the command/args arguments leads to command injection. The attack requires local access.

Missing authorization in the WebSocket consumer in Scripta eScriptorium (through 26.04.1) allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check.

Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium (through 26.04.1) allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect.

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.

A Cross Site Scripting (XSS) vulnerability in the Subscribe to Comments plugin (versions up to 2.3.1) occurs at the author level. This means a user with the author role can inject a malicious script that executes in the browsers of other users.

A Cross Site Scripting (XSS) vulnerability in the MailOptin plugin (versions up to 1.2.78.0) occurs at the contributor level. A user with the contributor role can inject a malicious script that executes in the browsers of other users.

An unauthenticated Broken Access Control vulnerability in the Profile Builder plugin (versions up to 3.16.5) allows an unauthenticated attacker to gain access to functions or data that should be protected.

A Broken Access Control vulnerability from a custom role in the Dokan plugin (versions up to 5.0.10) allows a user with a custom role to gain access to functions or data they should not have permission to.