CVE Vulnerability Catalog

Forminator by WPMU DEV through version 1.57.3 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The av_extend call with an underflowing value leads to allocation of 2^32 slots, causing memory exhaustion.

ExtUtils::Typemaps::STL::String versions before 1.06 for Perl may read the SV length before stringifying the argument. Due to unspecified evaluation order in C++, some compilers may evaluate SvCUR on a non-string, leading to abort or segfault.

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The av_extend call with an underflowing value leads to allocation of 2^32 slots, causing memory exhaustion.

Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble after checking only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. This can cause a crash (denial of service) and could expose adjacent memory contents. Affects versions from 2.0.0-incubating before 5.3.0.

Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (datasketches-cpp). compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap() read header fields before checking input length; in the compressed format the size check could be defeated by a 32-bit overflow. A crafted or truncated sketch could cause a read past the end of the input, potentially large in the compressed case, leading to a crash and memory exposure. Affects versions from 3.1.0 before 5.3.0.

Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (datasketches-cpp). A crafted serialized CPC sketch passed to cpc_sketch::deserialize() can cause the decompressor to read past the end of compressed data, and in the hybrid flavor can cause a write outside an internal heap buffer due to unvalidated decoded row indices. This can corrupt heap memory, causing a crash and potentially enabling further exploitation. Affects versions from 2.0.0-incubating before 5.3.0.

Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (datasketches-cpp). When deserializing a sketch in LIST mode, the coupon count was read from input and used as the number of entries to copy into a fixed buffer of 8 entries without checking capacity. A crafted sketch could cause a write of up to 988 bytes past the end of the internal heap buffer, corrupting memory. Affects versions from 1.0.0-incubating before 5.3.0.

ZTE Z80 Ultra's system interfaces lack robust invocation authentication and have inadequate access control. Third-party apps may call these interfaces through reflection and retrieve relevant information.

In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) from version 2.5.0 to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when hovering over the data point.

In Progress® KendoReact (@progress/kendo-react-charts) from version 1.1.0 to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when hovering over the data point.

The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The vulnerability is due to the endpoint's permission callback returning true unconditionally combined with insufficient validation of the input, allowing unauthenticated attackers to read arbitrary files on the server.

The PeproDev Ultimate Profile Solutions plugin for WordPress up to version 8.2.36 is vulnerable to Stored Cross-Site Scripting (XSS) via the 'button' attribute of the 'logout-url' shortcode. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access to inject arbitrary web scripts that execute when a user accesses an injected page.

ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name>' parameter in all versions up to and including 1.7.31 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page, but this requires specific administrator configuration.

The Listdom plugin for WordPress up to version 6.1.2 is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function. Authenticated attackers with administrator-level access can delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

The Retainful plugin (Email Marketing for WordPress and WooCommerce) is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to and including 1.0.10 due to insufficient input sanitization and output escaping.

The Avada theme for WordPress and WooCommerce is vulnerable to Stored Cross-Site Scripting via user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to and including 7.16.1. These fields are emitted in an anchor href without rejecting dangerous URL schemes such as javascript:.

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to and including 44.1 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when an administrator visits the WPO365 wizard page, with the payload stored in the wpo365_errors transient for up to three days.

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling plugin for WordPress is vulnerable to generic SQL Injection via the 'booking[service_id]' parameter in all versions up to and including 5.7.2 due to insufficient escaping and lack of query preparation. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.