CVEs

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions.

Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Subscriber Cross Site Scripting (XSS) in AcyMailing SMTP Newsletter <= 10.11.1 versions.

Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.

Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions.

Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.

Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.

Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions.

Subscriber SQL Injection in CubeWP <= 1.1.30 versions.

Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions.

Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

Subscriber Path Traversal in Do Lasso <= 358 versions.

Subscriber SQL Injection in Do Lasso <= 358 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions.

Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.

Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.

Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.

Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.

Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.

Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.

Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.

Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.

Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the…

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.

HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions.

HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under…

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an…

A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the `/tmp` directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to…

A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication (IPC) message parsing. By sending a specially crafted message, the attacker can cause…

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. …

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type…

Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies…

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql…