CVE Vulnerability Catalog

An information disclosure vulnerability in Koollab LMS allowed an authenticated learner to obtain correct quiz answers from the course status endpoint without completing the assessment legitimately, compromising assessment integrity.

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception.

An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts, by supplying a valid user UUID without providing primary credentials via the 2FA validation endpoint.

A TOTP two-factor authentication bypass vulnerability in Koollab LMS allowed an attacker to supply a client-controlled seed to generate a matching one-time password and bypass the second authentication factor, potentially enabling unauthorised access to administrator accounts.

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the plugin then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.

The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders.

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption written into the page DOM without escaping. An authenticated user with Author-level access can store a JavaScript payload that executes in any visitor's browser, including an administrator, who clicks the link.

The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints. This allows unauthenticated users to retrieve information about non-published WooCommerce products (e.g., draft, pending, or private).

The Survey Form Block plugin for WordPress up to version 1.0.1 allows unauthorized data access due to a missing capability check in the `get_all_data()` function. Authenticated attackers with subscriber access can export all survey submission data and column metadata.

The WP Photo Album Plus plugin for WordPress up to version 9.2.04.002 is vulnerable to SQL Injection via the 'table' parameter. Insufficient escaping and query preparation allow authenticated attackers with administrator access to append additional SQL queries. The lack of a nonce in the export endpoint also enables CSRF attacks.

The Event Booking Manager for WooCommerce plugin up to version 5.3.7 allows authorization bypass. Lack of proper permission checks allows authenticated attackers with contributor access to modify global payment settings, including WooCommerce payment enablement, cart behavior, and login requirements.

The WowStore plugin for WordPress up to version 4.4.24 is vulnerable to Stored Cross-Site Scripting via the 'currentPostId' block attribute. Insufficient input sanitization and output escaping allow authenticated attackers with contributor access to inject arbitrary scripts that execute whenever a user visits an infected page.

The WowStore plugin for WordPress up to version 4.4.24 is vulnerable to Stored Cross-Site Scripting via the 'filterMobileText' block attribute. The `wp_kses_post` sanitization is ineffective because the payload is stored in a Gutenberg block comment as JSON, which is preserved. Authenticated attackers with contributor access can inject arbitrary scripts.

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7anyapi_form_field' Post Meta in all versions up to and including 3.0.6 due to insufficient input sanitization and output escaping.

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the post_thumbnail and newsletters_post_thumbnail shortcodes in versions up to and including 4.15 due to insufficient input sanitization and output escaping in the post_thumbnail() method.

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the [newsletters_post] shortcode in versions up to and including 4.15 due to insufficient input sanitization and output escaping in the posts_single() function and shortcode_posts() handler.

In the goshs file server before version 2.1.5, the sendFile handler in httpserver/handler.go opened files using a cleaned path but derived the authorization filename from raw req.URL.Path. A trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.

In the goshs file server before version 2.1.5, the multipart upload handler in httpserver/updown.go split part.FileName() on / but did not reject .., allowing an unauthenticated attacker to upload a file with a filename containing .. and create a file outside the served tree. This issue is fixed in version 2.1.5.

In Netty before versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating CRLF characters (\r\n). An attacker controlling the filename can inject arbitrary MIME headers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

In Pagy from version 43.0.0 to 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as <locale>.yml path components, allowing untrusted params[:locale] values with absolute paths or ../ sequences to create a file existence and readability oracle for YAML files. This issue is fixed in version 43.5.6.