CVE Catalog

A SQL injection vulnerability has been identified in the Quiz Master Next WordPress plugin, affecting versions through 11.2.0. The issue arises from inadequate escaping of the user-supplied 'pages' parameter in the qsm_ajax_save_pages() AJAX handler, which only applies basic sanitization. Additionally, the SQL query in qsm_options_questions_tab_content() at line 143 fails to properly prepare the interpolated page IDs before executing the query. This vulnerability allows authenticated attackers with Author-level access or higher to inject SQL payloads that are executed second-order when the quiz's Questions tab is viewed, potentially leading to unauthorized access to sensitive database information.

A stored cross-site scripting vulnerability has been identified in the Tickera WordPress plugin, specifically in versions up to and including 3.6.0.0. The issue arises from inadequate input sanitization and output escaping in the 'price_wrapper' shortcode attribute. This vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary scripts into pages. The injected scripts are executed when a user accesses the page, but only if the corresponding ticket ID is present in their cart cookie.

A SQL injection vulnerability has been identified in the Tickera – Sell Tickets & Manage Events plugin for WordPress, affecting all versions through 3.6.0.0. The vulnerability arises from inadequate escaping of user-supplied data in the 's' parameter, allowing authenticated attackers with custom-level access or higher to inject additional SQL queries. This exploitation could lead to unauthorized access to sensitive information in the database.

A privilege escalation vulnerability has been identified in the Digits: WordPress Mobile Number Signup and Login plugin, affecting all versions through 9.1.0.5. The issue arises from inadequate authorization and role validation in the 'dig_update_wpwc_custom_fields()' function. This vulnerability allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to Administrator by submitting a fake 'digits_reg_userrole' value during profile updates, provided the site administrator has enabled the DIGITS User Role field.

A vulnerability exists in Snowflake Connector for Python in versions prior to 4.7.1, where improper TLS hostname verification may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections. This flaw could be exploited by intercepting or redirecting network traffic and presenting a certificate signed by any trusted Certificate Authority for any domain. As a result, the connector could accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires on-path traffic interception capabilities, such as ARP or DNS poisoning, a rogue access point, BGP hijacking, or through a malicious proxy or exit node. This vulnerability could have exposed credentials, query data, and staged file contents to interception and tampering, and may have allowed the attacker to execute arbitrary SQL within the context of the victim's connector session, limited by the privileges of the affected Snowflake role.

A vulnerability exists in the FunnelKit WordPress plugin in versions prior to 3.15.0.6. The issue arises because the plugin does not properly validate user-supplied file paths before deleting files during a template import process. This flaw enables users with administrator privileges to exploit path traversal to delete arbitrary .json files outside the designated directory. Such actions can disrupt the functionality of other FunnelKit components or WordPress plugins, leading to a denial-of-service condition.

A reflected cross-site scripting vulnerability has been identified in the FunnelKit WordPress plugin, affecting versions prior to 3.15.0.6. The issue arises because the plugin fails to properly escape user-supplied parameters before including them in the HTML response of a page-builder AJAX action. This flaw allows unauthenticated attackers to execute scripts that are reflected back to logged-in users who visit a manipulated page. The vulnerability is only present when the Divi builder is active.

A vulnerability exists in the RTMKit WordPress plugin in versions prior to 2.0.9, where the plugin fails to properly validate user capabilities on a specific theme-builder AJAX action. This flaw allows users with at least the Author role to create and activate a site-wide template that modifies the header, footer, or other global areas visible to all visitors. Such actions are typically reserved for administrators.

A vulnerability exists in the RTMKit WordPress plugin in versions prior to 2.0.9, where an AJAX action fails to perform a proper capability check. This flaw allows users with at least the Contributor role to access the titles of other users' private, draft, pending, scheduled, and trashed posts by exploiting a request-supplied post identifier.

A stored cross-site scripting vulnerability has been identified in the Header Footer Builder for Elementor WordPress plugin, affecting versions prior to 1.2.1. The issue arises because the plugin's dashboard template-import action does not require administrative capabilities, allowing any user with the edit_posts permission, such as Contributors, to import templates. This can be exploited by injecting JavaScript into an Elementor HTML widget, which is then executed in the session of any visitor or administrator who loads the site.

A vulnerability exists in the Customer Reviews for WooCommerce WordPress plugin in versions prior to 5.113.0. The issue arises because the plugin does not implement authentication, capability, or nonce checks on a specific media upload AJAX action, when the review media attachment feature is activated. This flaw allows unauthenticated users to upload media files, limited to an allowed list of images and videos, to the Media Library. The uploaded files are then associated with attachment posts, leading to clutter in the media library and potential exhaustion of disk space.

A vulnerability in the Abandoned Cart Lite for WooCommerce WordPress plugin, affecting versions prior to 6.8.2, allows unauthenticated attackers to forge recovery links that log them in as other users. This issue arises because the plugin does not properly secure its cart-recovery tokens or associate them with the user's account. When the automatic-login feature is activated, the forged links can be used to gain unauthorized access.

A privilege escalation vulnerability has been identified in the Redux Framework WordPress plugin, affecting versions prior to 4.5.13. The issue arises because the plugin does not properly restrict which user meta keys can be written when saving custom profile fields. This flaw allows users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile. The vulnerability is present on sites where the plugin's user-profile feature is enabled.

A vulnerability in the AI Engine WordPress plugin, affecting versions prior to 3.5.5, allows users with subscriber-level access to read private conversations of other users and take over their conversation records. This issue arises because the plugin does not verify ownership of chatbot conversations referenced by user-supplied identifiers. The vulnerability is exploitable when the discussions feature is enabled.

An authentication bypass vulnerability has been identified in the Happy Coders OTP Login for WooCommerce WordPress plugin, affecting versions prior to 2.8. The vulnerability arises because the plugin does not properly verify whether a one-time password (OTP) has been validated before allowing user authentication based on a provided identifier. This flaw enables unauthenticated attackers to log in as any existing user, including those with administrative privileges, and to create new user accounts.

A SQL injection vulnerability has been identified in the WP Job Portal WordPress plugin, affecting versions prior to 2.5.5. The issue arises because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL query. This flaw allows authenticated users with subscriber-level (self-registerable) accounts to execute SQL injection attacks.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Appointment Booking WordPress plugin, affecting versions prior to 5.6.3. The vulnerability arises because the plugin's central request dispatcher does not properly validate CSRF nonces on several state-changing actions. This oversight allows attackers to perform privileged actions, such as overwriting booking form configurations or disconnecting payment gateways, by exploiting logged-in administrators.

A stored cross-site scripting vulnerability has been identified in the BetterDocs WordPress plugin, affecting versions prior to 4.5.5. The issue arises because the plugin fails to properly sanitize AI-generated documentation summaries before saving and displaying them. This vulnerability is accessible to unauthenticated users, who can inject malicious payloads that execute in the browsers of anyone viewing the affected page, including administrators. Exploitation requires the AI Doc Summarizer feature to be enabled, along with a configured AI provider API key.

A vulnerability in the Linux kernel's IPv4 handling has been addressed. The issue arose in the 'ip_append_data' function within the paged-allocation branch. Here, the calculations for 'alloclen' and 'pagedlen' were incorrect. While 'datalen' included the 'fraggap' from the previous socket buffer (skb), this gap was not properly accounted for in the new skb's linear area, leading to an oversized 'pagedlen' and an undersized linear area. The non-paged branch correctly accounted for the frag gap, but the paged branch did not. This vulnerability could potentially be exploited by manipulating packet fragmentation, causing data to be incorrectly processed or copied, which could lead to data corruption or other unintended behaviors.

A SQL injection vulnerability has been identified in the SEO Booster plugin for WordPress, affecting all versions through 7.3.1. The issue arises from inadequate escaping of user-supplied data in the 'sort_field' parameter, coupled with a lack of proper preparation in the SQL query. This vulnerability allows authenticated attackers with administrator-level access to inject additional SQL commands into existing queries, potentially leading to the extraction of sensitive information from the database.

A time-based SQL injection vulnerability has been identified in the SEO Booster plugin for WordPress, affecting all versions through 7.3.1. The issue arises from inadequate escaping of user-supplied data in the 'orderby' parameter, allowing authenticated attackers with administrator-level access to inject additional SQL queries. This exploitation could lead to the extraction of sensitive information from the database. Despite the presence of esc_sql() and sanitize_text_field(), these functions do not effectively neutralize SQL keywords, commas, parentheses, or subquery syntax in an unquoted ORDER BY context, leaving the clause fully under attacker control.

A reflected cross-site scripting vulnerability has been identified in the Product Feed Manager for WooCommerce - Sell on 200+ Online Marketplaces plugin for WordPress. This vulnerability affects all versions through 7.6.1 and allows unauthenticated attackers to inject arbitrary web scripts. The issue arises from inadequate input sanitization and output escaping, particularly via the 's' search parameter. Exploitation requires tricking a user into clicking a link that contains the injected script, which then executes on the user's page.

A vulnerability allowing authentication bypass has been identified in the SAML Single Sign On – SSO Login plugin for WordPress, affecting all versions through 5.4.3. This vulnerability arises from the plugin's improper handling of the 'SignatureMethod' Algorithm attribute within the 'SAMLResponse' parameter. Instead of applying the user's configured algorithm, the plugin allows attackers to dictate the algorithm, leading to the misinterpretation of the Identity Provider's RSA public key as a shared secret. Exploiting this flaw, attackers can forge SAML assertions, target any WordPress user, including administrators, and gain access to their accounts by stealing authentication cookies.

A stored cross-site scripting vulnerability has been identified in the RPB Chessboard WordPress plugin, affecting all versions up to and including 8.1.2. This vulnerability arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into comment content. The injected scripts are executed when users access the affected pages. WordPress's default sanitization does not address this issue, as the malicious payloads can exploit allowed tags and attributes, with the harmful HTML generated at render time by the plugin's comment filter.

A vulnerability in Grafana Loki allows queries with large limits to cause significant memory allocations. This issue can impact the service's availability, depending on how it is deployed.

A stored cross-site scripting vulnerability has been identified in the Easy Accordion – AI-Powered FAQ & Accordion Blocks, Product FAQ plugin for WordPress. This issue affects all versions up to and including 3.1.6. The vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These scripts are executed when a user accesses the compromised page.

A vulnerability exists in the Catch Themes Demo Import plugin for WordPress, specifically in versions through 3.3. The issue is a missing authorization that allows authenticated users with subscriber-level access and above to exploit the 'activate_plugin' GET parameter. This vulnerability enables the unauthorized installation of a hardcoded plugin, 'essential-content-types', from the WordPress Plugin Repository.

A stored cross-site scripting vulnerability has been identified in the GiveWP Donation Plugin and Fundraising Platform for WordPress. This issue affects all versions through 4.16.3 and arises from inadequate input sanitization and output escaping. The vulnerability allows authenticated attackers with give worker-level access or higher to inject arbitrary scripts into pages. These scripts are executed when a user accesses the injected page, specifically after a donor clicks the 'Share on Twitter' button in the Sequoia donation confirmation view. At this point, the unescaped 'twitter_message' value is processed within a JavaScript template literal, leading to the execution of the injected script.

A stored cross-site scripting vulnerability has been identified in the MxChat – AI Chatbot & Content Generation for WordPress plugin, affecting all versions through 3.2.10. The vulnerability arises from inadequate input sanitization and output escaping, allowing authenticated attackers with administrator-level permissions to inject arbitrary scripts into pages. These scripts execute when users access the affected pages. This issue is present in multi-site installations where unfiltered_html has been disabled.

A SQL injection vulnerability has been identified in the MultiVendorX - WooCommerce Multivendor Marketplace AI Powered Solutions plugin for WordPress, affecting all versions through 5.0.9. The vulnerability arises from inadequate escaping of user-supplied data in the 'order_by' parameter, allowing authenticated attackers with subscriber-level access or higher to inject additional SQL queries. This exploitation could lead to unauthorized access to sensitive database information. The issue is particularly concerning because it can be exploited by any logged-in user when the plugin's store approval setting automatically approves store owners, a default configuration. This approval allows users to self-register as store owners and gain access to the vulnerable transactions endpoint via the Stores REST API.

A SQL injection vulnerability has been identified in the Advance Product Search - Voice & Ajax Search for WooCommerce plugin for WordPress, affecting all versions through 1.4.4. The vulnerability arises from inadequate escaping of user-supplied parameters in the 's' and 'match' fields, allowing unauthenticated attackers to inject additional SQL queries. This exploitation could lead to unauthorized access to sensitive information within the database.

A vulnerability allowing sensitive information exposure has been identified in the List Category Posts plugin for WordPress, affecting all versions through 0.95.0. The issue arises from the 'sanitize_status' function, which fails to properly authorize requests. This flaw enables authenticated attackers with contributor-level access and above to access titles, full content, excerpts, dates, authors, and custom-field metadata from other users' pending-review, scheduled, and trashed posts. The vulnerability can be exploited by embedding a crafted [catlist] shortcode into their own draft and previewing it. This issue bypasses a previous fix for a similar vulnerability, CVE-2025-11377, which was addressed in version 0.93.0.

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Landing Page Builder WordPress plugin, specifically in versions through 1.5.3.6. The issue arises from inadequate nonce validation in the 'ulpb_admin_ajax' function, allowing unauthenticated attackers to manipulate posts and associated metadata. Exploitation requires tricking an administrator or editor into clicking a link, as the attack must leverage the victim's session cookies to bypass capability checks.

A stack-based buffer overflow vulnerability has been identified in the libsolv library, specifically within the PGP verification component. This vulnerability arises from improper length handling when copying the EdDSA 's' MPI into a stack buffer. A remote attacker could exploit this flaw by crafting a malicious Ed25519 PGP signature with mismatched MPI lengths. When this signature is processed, it could lead to a denial-of-service condition in automated package or repository processing workflows.

An out-of-bounds write vulnerability has been identified in QEMU. This issue allows a local attacker within a guest virtual machine to write data beyond the allocated memory. The vulnerability arises when the function 'cpu_physical_memory_map()' returns a shorter length than expected, leading to unauthorized memory access. Exploitation of this flaw could result in unauthorized access to guest memory, corruption of heap-allocated objects, and potentially cause information disclosure, data integrity issues, or a denial-of-service condition.

A denial-of-service vulnerability has been identified in the Feast Feature Server, specifically within the '/ws/chat' WebSocket endpoint. This issue allows remote attackers to establish persistent WebSocket connections without authentication. By opening numerous simultaneous connections, an attacker can deplete server resources such as memory, CPU, and file descriptors, causing a complete denial of service for legitimate users. The vulnerability affects Feast Feature Server versions through 0.58.0.

A vulnerability exists in Keycloak's JWT authorization grant preview feature, specifically in version 26.5.2. When this feature is enabled, Keycloak does not properly validate the disabled status of user accounts during JWT authorization processing. This flaw allows remote attackers with low privileges to exploit the system by using a valid assertion token from an external identity provider to obtain a JWT for a disabled user, thereby gaining unauthorized access to sensitive resources.

An authorization bypass vulnerability has been identified in RafyMrX TOKO-ONLINE-ROTI versions prior to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. The issue arises in an unknown function within the file proses/add.php, where manipulation of the argument kd_cs allows for unauthorized access. This vulnerability can be exploited remotely.

A SQL injection vulnerability has been identified in the H3C SecPath F1000-C8300 series firewall, affecting versions prior to 20260522. The issue arises in the web interface, specifically within the log_fw_nbc_mail_jsondata function. The vulnerability can be exploited remotely by injecting a UNION SELECT payload into the subject parameter, allowing attackers to access SQLite metadata, such as table names from sqlite_master.

A vulnerability in PlaywrightCapture allows for the unintentional sharing of state between Capture objects within the same Python process. This issue arises because capture-specific configuration and runtime data are stored as mutable class-level variables instead of instance-level variables. As a result, multiple Capture objects can inadvertently share sensitive information such as HTTP headers, cookies, browser storage, HTTP credentials, proxy settings, user-agent information, geolocation data, and captured request details. In environments with multiple users or concurrent operations, this could lead to the unauthorized disclosure of authentication cookies, credentials, or other personal data, and could allow requests to be made using another user's authentication context or proxy configuration, potentially causing unauthorized access to remote resources or disrupting other capture processes.

A policy bypass vulnerability has been identified in Anubis, a Web AI Firewall Utility, in versions 1.22.0 prior to 1.26.0-pre1. The vulnerability arises because the PathChecker.Check() function in lib/policy/checker.go improperly trusts the client-controlled X-Original-URI header when matching request paths. This flaw allows HTTP clients to bypass Anubis challenges by exploiting default ALLOW rules that match certain paths, such as those under the well-known directory. As a result, requests can be forwarded to upstream resources without the usual bot protection measures.

A vulnerability in Wekan's header-login feature prior to version 9.46 allows an unauthenticated attacker to bypass the IP allowlist and gain full access to any user account, including admin. The issue arises because the allowlist check relies on the client-controlled X-Forwarded-For header, which can be easily spoofed. Attackers who can reach the Wekan HTTP port directly can exploit this flaw by sending a request that appears to come from a trusted IP, along with a username header. This manipulation tricks the application into issuing a valid login token for the specified user, effectively enabling account takeover.

A vulnerability has been identified in the GitHub Actions workflow of MaaAssistantArknights, specifically in the release-preparation.yml file. This issue arises from the improper handling of pull request titles, which are injected into shell commands without proper sanitization. As a result, a non-draft pull request from a forked repository, titled 'Release v', could execute arbitrary shell commands on the GitHub Actions runner during the changelog generation job. The vulnerability affects the latest version of MaaAssistantArknights.

An authentication bypass vulnerability has been identified in the Qinglong timed task management platform, prior to version 2.20.1. The issue arises in the init guard middleware, which fails to properly validate the '/open/user/init' path. This oversight allows an unauthenticated attacker to send a PUT request to '/open/user/init' and reset administrator credentials on an initialized instance. The vulnerability exists because the '/open/*' paths are whitelisted from JWT authentication and are rewritten to '/api/user/init' after the guard has already been bypassed.

A broken access control vulnerability has been identified in Wekan, an open-source kanban application built with Meteor. This issue affects versions through 9.36. The vulnerability arises because the DDP update allow rules for Cards, Lists, and Swimlanes only verify the current 'boardId' of a document, which reflects the attacker's own board. They do not validate the new 'boardId' being set in the update modifier. As a result, any authenticated user with write access to their own board can manipulate the 'boardId' of cards, lists, or swimlanes, transferring them to a private board they do not belong to. This exploitation bypasses board-level access controls, allowing users to inject arbitrary content into boards they cannot access or read.

A stored DOM Cross-Site Scripting vulnerability has been identified in the WWBN AVideo platform, specifically in versions prior to 29.0, within the YPTSocket plugin. This vulnerability allows unauthenticated remote attackers to execute arbitrary JavaScript in the context of authenticated administrators who are currently viewing a page with the YPTSocket online-users debug panel. The issue arises because the plugin's WebSocket connection handler reads attacker-controlled query parameters from the WebSocket URL without proper validation. These parameters are then broadcasted to all connected clients, where the injected JavaScript is executed, potentially leading to unauthorized access to sensitive information such as non-HttpOnly cookies and the CSRF token, as well as the ability to perform actions on behalf of the administrator.

A vulnerability in the Wekan `cloneBoard` Meteor method, present in versions prior to 9.35, allows any authenticated user to clone private boards into their own account without authorization. The method uses a caller-supplied board ID to export the entire board, including cards, comments, attachments, member information, and activities, without checking if the user is allowed to access the board. This issue has been addressed in version 9.35.

A server-side request forgery (SSRF) vulnerability has been identified in Wekan, an open-source kanban application built with Meteor. This vulnerability exists in versions prior to 9.32. The issue arises because webhook integration URLs are stored from user input without proper validation. These URLs are later fetched by the server, allowing an attacker to send requests to internal services or metadata endpoints. The vulnerability affects board administrators who can configure malicious webhook URLs that trigger server-side requests to private or internal resources.

An authorization bypass vulnerability has been identified in Wekan, an open-source kanban application built with Meteor. This issue affects versions of Wekan prior to 9.32. The vulnerability arises in the 'copyBoard' Meteor DDP method, located in 'server/publications/boards.js'. The method allows any authenticated user to copy a board by providing a board ID, without verifying user ID, membership, or admin status. As a result, users can duplicate private boards they do not belong to, including all associated cards, checklists, custom fields, labels, and rules. In contrast, the equivalent REST API endpoint correctly enforces admin access requirements.

A vulnerability in Wekan's OIDC integration allows authenticated users to escalate privileges to admin. This issue affects Wekan versions prior to 9.32. The vulnerability arises because six Meteor methods related to OIDC are globally callable without authorization checks, unlike their non-OIDC counterparts which require admin rights. Exploitation of this vulnerability enables unauthorized creation and modification of organizations and teams, and can also grant global admin privileges under certain conditions.