CVE Vulnerability Catalog

The WPBot – AI ChatBot plugin for WordPress up to version 8.5.9 is vulnerable to Sensitive Information Exposure via the wpbot_send_email_transcript_free function. This allows unauthenticated attackers to exfiltrate full chat transcripts and associated user PII (names, email addresses, phone numbers) stored in the wpbot_user and wpbot_conversation tables to an attacker-controlled email address.

The Tutor LMS plugin for WordPress up to version 4.0.1 is vulnerable to generic SQL Injection via the 'coupon_code' parameter due to insufficient escaping and lack of proper query preparation. Authenticated attackers with administrator-level access or higher can append additional SQL queries to existing ones, potentially extracting sensitive information from the database.

The StoreGrowth: Smart Sales Booster for WooCommerce plugin up to version 2.1.0 is vulnerable to authorization bypass. The plugin does not properly verify user authorization, allowing unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary data. The 'ajd_protected' nonce used as the sole gate is exposed to unauthenticated visitors on every frontend page via the BoGo module.

The Storegrowth Sales Booster plugin for WordPress up to version 2.1.0 is vulnerable to Missing Authorization in the bogo_category_msg_create() AJAX handler. The handler is registered for both authenticated and unauthenticated users, with only a nonce ('ajd_protected') that is publicly emitted on every frontend page. This allows unauthenticated attackers to modify the BOGO category-message configuration stored in the spsg_bogo_general_settings option.

Quick.CMS is vulnerable to Path Traversal via the URI path component of HTTP requests. An authenticated attacker with admin privileges can read files in the parent directory of the webroot using ../ sequences in the URI.

Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files within the application's directory structure, revealing directory structure and absolute paths.

The payment integration with GiroCheckout does not properly validate payment status responses. An attacker can use a successful payment response from one transaction and apply it to another, gaining access to multiple valid tickets with only one payment.

The cowboy HTTP server from version 2.0.0-pre.4 to 2.17.x is vulnerable to memory exhaustion due to unlimited resources. An unauthenticated attacker can send many HTTP/1.1 headers with the same name, causing continuous binary memory growth, potentially exhausting Erlang VM memory.

SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifiers into a diagnostic trace when activated by a privileged user. An attacker with access to the trace can obtain identifiers allowing impersonation of legitimate users.

The Shortcodify plugin for WordPress up to version 1.4.3 is vulnerable to Stored Cross-Site Scripting via the 'name' shortcode attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute when a page is visited.

The MCP server in alibabacloud-rds-openapi-mcp-server listens on all network interfaces by default, allowing remote attackers to invoke MCP tools without authorization.

The News Theme V8 for WordPress is vulnerable to Reflected XSS. An attacker can inject malicious script via improperly sanitized input.

ELECOM wireless LAN routers and access points are vulnerable to Reflected XSS in the WebUI. This could allow arbitrary script execution in a logged-in user's browser.

The Taskbuilder plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter. Authenticated attackers with subscriber-level access can inject additional SQL queries.

The web UI has a vulnerability due to improper validation of the post-login redirect. An unauthenticated attacker can redirect users to a malicious website.

The GamiPress plugin for WordPress is vulnerable to Stored XSS via the 'heading_size' shortcode attribute. Authenticated attackers with contributor-level access can inject malicious scripts.

The SMS Alert plugin for WordPress is vulnerable to SQL Injection via the 'checkout_payment_plans' and 'order_status' settings. Authenticated attackers with admin access can inject SQL queries.

The SMS Alert plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter. Authenticated attackers with admin access can inject SQL queries.

The SMS Alert plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter. Authenticated attackers with admin access can inject SQL queries.

In Bouncy Castle for Java (versions 1.73 to 1.78), three ML-KEM (CRYSTALS-Kyber) routines divide polynomial coefficients by the modulus q, allowing an attacker who measures the timing of many decapsulations with the same private key to recover that key. This affects Poly.toMsg (KyberSlash1) and ciphertext compression functions (KyberSlash2).