405,219 results · Feed
-
Medium 6.8
Dynific Addons for Elementor < 1.3.1 - Author+ Stored XSS via Display Name in Post Author Widget
The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a user-controlled profile value before outputting it in a quoted attribute in one of its Elementor widgets, allowing authenticated users with the Auth…
-
Critical 9.6
Somatic Framework <= 1.8.14 - Subscriber+ Arbitrary File Deletion
The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can l…
-
Critical 9.6
Pay With a Tweet <= 1.0.5 - Subscriber+ Arbitrary File Deletion via Button Download Path
The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, …
-
Critical 9.1
PrintAura WooCommerce API <= 4.0.2 - Unauthenticated WooCommerce REST API Authentication Bypass
The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store da…
-
Medium 5.3
Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Disclosure of Post-Payment Redirect URL and Thank-You Message via Unpaid Stripe Checkout Session
The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and than…
-
High 8.1
Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Privilege Escalation via Paid Registration Form When Stripe Gateway Unavailable
The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be…
-
Low 3.7
Download Manager (Free & Pro) - Unauthenticated Missing Authorization via Password Validation
The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-r…
-
Medium 5.3
Data Tables Generator by Supsystic < 1.15.8 - Unauthenticated Table Content Disclosure via IDOR
The Data Tables Generator by Supsystic WordPress plugin before 1.15.8 does not perform any authorization or ownership check before returning the stored contents of a table, relying only on a nonce that is exposed to every anonymous visitor, allowing unauthent…
-
Low 3.7
Download Manager (Free & Pro) - Unauthenticated Protected File Download via Media Preview Download Key
The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a visitor is allowed to access a package before its media-preview renderers issue a download key for it, allowing unauthenticated visitors…
-
Medium 5.3
User Registration & Membership < 5.3.2 - Unauthenticated Payment Before Login Bypass via Omitted Membership Field
The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when a registration is submitted without a membership selection, allowing unauthenticated users to create an account on a payment-gated regi…
-
Medium 4.3
User Registration & Membership < 5.3.2 - Subscriber+ Payment Bypass via Membership Renewal
The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a payment has actually been completed before extending a paid membership subscription, allowing authenticated users with an active paid subscription to renew it indefinitely…
-
High 8.1
User Registration & Membership 5.2.8 - 5.3.1 - Unauthenticated Privilege Escalation via Coupon-Based Payment Bypass
The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be gr…
-
Low 3.8
Code Snippets < 4.1.0 - Admin+ Network-Scoped Snippet Injection via Snippet Import
The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to…
-
Medium 6.8
Elementor < 4.3.6 - Contributor+ Stored XSS via Element ID
The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts…
-
Low 3.5
Live Composer < 2.1.24 - Admin+ Stored XSS via Button
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting atta…
-
Low 3.5
Live Composer < 2.1.24 - Admin+ Stored XSS via Icon
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes wh…
-
Low 3.5
Live Composer < 2.1.24 - Admin+ Stored XSS via Staff
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pages, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even …
-
Low 3.5
Live Composer < 2.1.24 - Admin+ Stored XSS via Social
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks…
-
Low 2.3
Sleipnir Mobile for iPhone / iPad and Sleipnir Mobile for iPhone / iPad Black Edition provided by Fenrir Inc. are vulne…
-
High 7.0
Akaunting 3.3.0 - Stored XSS through imported item names
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting…
-
Medium 6.9
TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions a…
-
Medium 6.9
TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions a…
-
Medium 6.0
libspdm is a sample implementation that follows the DMTF SPDM specifications. In version 1.4.0, both the FINISH request…
-
Medium 5.0
OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch. From versions 2.14.0 …
-
Critical 9.8
NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when…
-
Critical 9.8
AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name
AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in th…
-
High 7.4
pam_usb: deny_remote bypassed by compressed IPv6 addresses in pusb_tmux_has_remote_clients
pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tm…
-
Medium 4.4
pam_usb: Heap out-of-bounds read in pusb_get_tty_from_display_server cmdline scan
pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c (pusb_get_tty_from_display_server) allocates a 4096-byte cmdline buffer, reads up to 4096 bytes from /proc//cmdline, then replaces every NUL separato…
-
High 7.1
pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset
pam_usb provides hardware authentication for Linux using removable media. Prior to version 0.9.3, src/local.c reads XRDP_SESSION with plain getenv(3) at the head of pusb_local_login while every other env consumer in the same function uses secure_getenv(3). Wh…
-
High 7.4
pam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_has_remote_clients
pam_usb provides hardware authentication for Linux using removable media. From version 0.8.0 to before version 0.9.3, the deny_remote feature in pam_usb uses /usr/bin/w -i to detect whether the authenticating user has an active remote tmux session. In pusb_tm…
-
Critical 9.3
Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit
Waline is a comment system with backend support. In versions 3.15.2 and prior, @waline/client renders the comment editor's live preview with marked and no sanitizer (utils/markdown.ts), and the preview is injected with v-html. When a comment is edited, the ed…
-
High 7.2
Stored XSS in the @waline/client UserList widget via an unescaped commenter link field
Waline is a comment system with backend support. In versions 3.15.2 and prior, the @waline/client UserList widget builds its DOM by concatenating server-returned commenter fields directly into root.innerHTML with no HTML escaping. The commenter nick and link …
-
Unscored —
Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec"). When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in l…
-
Unscored —
Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go
Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and …
-
Unscored —
HTTP/1 server crash due to MaxBytesReader header race in net/http
For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes …
-
Unscored —
Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go
Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols"…
-
Unscored —
Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_librar…
-
Unscored —
Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go
When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives. The "-g*" wildcard in the compiler and linker …
-
Unscored —
Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link
Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_…
-
Unscored —
Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link
Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", …