CVE Vulnerability Catalog

The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress versions up to 2.1 contain a stored Cross-Site Scripting vulnerability via the 'asm_code' Snippet meta, allowing authenticated authors and higher roles to inject arbitrary scripts that execute whenever a user accesses an injected page.

The Premium Packages – Sell Digital Products Securely plugin for WordPress versions up to 7.0.4 contain an authentication bypass vulnerability via the 'wpdmppdl' parameter, allowing unauthenticated attackers to log in as any non-administrator user (e.g., subscriber, customer, author) who owns an order, by decoding the parameter without HMAC or signature verification.

The Accessibility Checker plugin for WordPress up to version 1.46.0 is vulnerable to Stored Cross-Site Scripting via the 'html' parameter. Authenticated attackers with Contributor-level access can inject arbitrary scripts that execute whenever a page with the infected post is viewed.

The Registrations For The Events Calendar plugin for WordPress is vulnerable to SQL injection via JSON keys in the 'standard' parameter of the rtec_records_edit AJAX action. An authenticated attacker with Contributor-level access or higher can inject additional SQL queries and extract sensitive data.

The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL injection via the 'order[0][dir]' parameter in versions up to 1.5.4. Authenticated attackers with subscriber-level access or higher can inject additional SQL queries and extract sensitive data.

The Webpushr Push Notifications plugin for WordPress up to version 4.39.0 is vulnerable to Stored Cross-Site Scripting (XSS) via the 'webpushr_notification_title' and 'webpushr_notification_body' parameters. This is due to insufficient input sanitization in the save_send_notification_flag() function and missing output escaping in the wpp_notification_box() function, which concatenates raw post meta values directly into HTML attribute and textarea contexts.

The WP Shortcode by MyThemeShop plugin for WordPress in versions up to 1.4.17 is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode. This is due to insufficient input sanitization and output escaping in the mts_tabs() function, which outputs the title shortcode attribute directly into the HTML output between anchor tags without applying any escaping functions. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

In the seunshares tool from the selinux policycoreutils package, a missing authorization vulnerability allows a user running in an unconfined context to kill root-owned processes also running in an unconfined context. This issue affects policycoreutils through version 3.10.

The Post Status Notifier Lite WordPress plugin before version 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability. An attacker can trick an admin into clicking a crafted link, resulting in script execution in their session.

The WP Compress WordPress plugin before version 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build URLs of JavaScript files, leading to Reflected XSS. When a visitor follows a crafted link, the plugin's loader injects script elements pointing to an attacker-controlled origin, allowing arbitrary JavaScript execution in the visitor's session on the target site.

In the seunshare tool of selinux policycoreutils, there is a TOCTOU (Time-of-check Time-of-use) race condition vulnerability. A user running seunshare in the unconfined SELinux domain can delete arbitrary root-owned files. This affects policycoreutils up to version 3.10.

Ricoh printers and MFPs do not restrict SSH port forwarding. When SSH is enabled, attackers can use port forwarding to connect to arbitrary hosts on the LAN.

A format string vulnerability was found in GNU nano's multi-buffer error message handling. A specially crafted filename with printf format specifiers can lead to stack information disclosure, denial of service, or arbitrary memory writes.

In @fastify/static before version 10.1.2, the allowedPath callback is evaluated before normalizing dot segments and duplicate path separators. An unauthenticated attacker can bypass allowedPath restrictions by requesting non-canonical paths, allowing files intended to be denied to be served.

The alertmanager templates test endpoint (/api/alertmanager/grafana/config/api/v1/templates/test) in Grafana can execute templates with no memory limits. Mass-executing templates in a short period causes OOM and crashes the Grafana service. The endpoint requires very low privileges and is exploitable with anonymous access enabled.

A path traversal vulnerability exists in boazsegev facil.io up to version 0.7.58 in the http_sendfile2 function of the Public Folder Handler component. Remote exploitation is possible and the exploit has been released.

In publint up to version 0.1.4, an OS command injection vulnerability was found in the package-manager Command Handler component via child_process.exec in src/node/pack.js. Local access is required. The exploit is public.

A vulnerability in Protegent 360 v2.0.0.4 by Unistal Systems allows a local attacker to cause a denial of service (DoS) via the sub_13828 function.

In syncfusion ej2-javascript-ui-controls up to version 33.2.3, an OS command injection vulnerability was found in package.json via child_process.exec. Local access is required. The exploit is public.

In danger-js up to version 13.0.7, an OS command injection vulnerability was found in the CLI component via the File argument in danger.git.diffForFile. Local access is required. Version 13.0.8 fixes the issue.