CVE Vulnerability Catalog

The Askeet plugin for WordPress is vulnerable to SQL Injection via the 'sql_query' parameter in multiple AJAX actions (askeet_execute_sql_query, askeet_export_all_results) in all versions up to and including 3.0. The askeet_is_safe_query() filter can be bypassed using MySQL conditional comments (e.g., /*!UNION*/), allowing authenticated attackers with Administrator-level access to append additional SQL queries to existing ones, enabling extraction of sensitive information from the database.

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page. This makes it possible for authenticated attackers with Editor-level access and above to inject arbitrary web scripts that execute when an Administrator runs the scan feature.

The Super Progressive Web Apps plugin for WordPress up to version 2.2.43 is vulnerable to Stored Cross-Site Scripting (XSS) via the `superpwa_settings[offline_message_txt]` setting. The offline message value is stored without sanitization, passed to the frontend via `wp_localize_script()` without escaping, and rendered using `innerHTML` in the JavaScript snackbar component. This allows authenticated attackers with Administrator-level access or above to inject arbitrary web scripts that execute whenever a user triggers the offline snackbar.

The endpoint /v3/import/{token}_{clusterId}.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster with private registry secrets, a nil pointer dereference causes HTTP 502. For non-existent cluster IDs, it returns HTTP 200. This observable difference constitutes a reliable enumeration oracle.

Rancher has a denial-of-service vulnerability in multiple TLS listeners. dynamiclistener automatically appends to each serving certificate any hostname presented via SNI, allowing an unauthenticated attacker to send a large number of TLS requests with distinct hostnames, causing the certificate to accumulate an unbounded number of SANs. Eventually, the certificate grows large enough that TLS handshakes fail, causing denial of service.

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected.

The Seraphinite Accelerator plugin for WordPress up to version 2.29.15 is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter. The CacheExtractPreparePageParams() function uses loose comparison (!=) for HMAC verification, allowing bypass, and insufficient output escaping in _CbContentFinishSkip() enables script injection. The attack requires user interaction, such as clicking a crafted link.

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.2.5. The translate_page() function unconditionally replaces internal #!trpst# and #!trpen# marker tokens with literal angle brackets across the entire HTML output after WordPress has already sanitized and escaped user input, allowing attackers to bypass WordPress's normal HTML escaping by using these tokens in the search query. This allows unauthenticated attackers to inject arbitrary web scripts that execute if a user clicks a specially crafted link.

The User Access Manager plugin for WordPress up to version 2.3.12 is vulnerable to Second-Order SQL Injection via the 'id' parameter in the AJAX action wp_ajax_save-attachment-compat. Insufficient validation of the objectId value and subsequent unparameterized use in SQL queries allow authenticated attackers with subscriber-level access to inject additional SQL queries and extract sensitive data from the database.

The WP Post Author plugin for WordPress is vulnerable to generic SQL Injection via the 'wpma_metabox_authors_list' parameter in all versions up to and including 3.9.1. Authenticated attackers with author-level access can append additional SQL queries to extract sensitive information from the database. Exploitation is a two-step chain involving saving a crafted guest-author token and triggering the injection when an admin loads the post list screen.

The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via 'curselrevs[]' Parameter in all versions up to and including 14.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level access and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to and including 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level access and above to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The affected admin page lacks nonce or CSRF protection on the GET request, meaning an unauthenticated attacker could exploit this vulnerability by tricking an authenticated administrator into issuing a crafted request. Additionally, the vulnerability is only triggered when the 'orderby' parameter is also present and non-empty alongside the 'order' parameter.

The Groundhogg plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.5.2. The REST endpoint GET /wp-json/gh/v4/contacts/<id> only checks the view_contacts capability, not view_others_contacts, allowing authenticated attackers (e.g., Sales Rep role) to read any contact record, including PII, contact meta, owner IDs, admin edit URLs, and full capability sets of linked WordPress users.

In OpenStack Ironic through 38.0.0, a project reader making a crafted request can return Portgroups assigned to Nodes owned or leased by another project.

In Apache Qpid Broker-J through 10.0.1, it was not possible to govern the rate at which the broker would respond to an echo flow, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. The issue is fixed in version 10.1.0.

In Apache Qpid Broker-J through 10.0.1, it was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service.

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Broker-J through 10.0.1.

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Broker-J through 10.0.1.

An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2 through 1.1.0.

In Apache Qpid Proton-Dotnet through 1.0.0, there is no limit on the maximum number of transfer frames per incoming delivery. An authenticated attacker can cause excessive resource usage and potential denial of service.