The Multi Step for Contact Form 7 WordPress plugin up to version 2.9.1 contains a stored cross-site scripting (XSS) vulnerability via the multipart field name parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access affected pages. Exploitation requires specific plugin options ('Save every step' and 'Expandable' table) to be enabled, which are disabled by default.
The BuddyForms WordPress plugin up to version 2.10.6 is vulnerable to stored cross-site scripting (XSS) via the 'buddyforms_form_content' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires a form configured with the public_submit option, which is enabled by default in the plugin's bundled Post Simple template. The vulnerability has a medium severity with a CVSS score of 5.4.
The Lightbox & Modal Popup WordPress Plugin – FooBox up to version 2.8.7 is vulnerable to a stored DOM-based cross-site scripting (XSS) flaw via the img alt attribute inside the .wp-caption container. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users view the affected pages. Exploitation requires bbPress 2.6.20 installed with a public forum and specific conditions on topic approval, enabling subscriber-level attackers to exploit the flaw. Without bbPress, exploitation requires contributor-level access or higher.
FV Player 8 WordPress plugin versions up to 8.1.9 are vulnerable to stored cross-site scripting (XSS) via the 'fv_player_videos' parameter. This vulnerability allows authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. Exploitation requires the administrator to enable the 'Allow visitors to upload videos to their profile' setting, which controls access to the vulnerable save functionality.
A critical vulnerability exists in Tenda AC18 firmware versions 15.03.05.05_multi and 15.03.05.19 Build 6318. The flaw is in the Firmware Upgrade Handler component, specifically in the /cgi-bin/upgrade endpoint, where insufficient verification of the upgradeFile argument allows remote attackers to manipulate data authenticity. Public exploit code is available for this vulnerability.
Mereithhh VanBlog versions up to 0.54.0 contain a cross-site scripting (XSS) vulnerability in the Image Upload Endpoint component. The vulnerability arises from a weakness in the file packages/server/src/types/access/access.ts. This flaw can be exploited remotely through manipulation, potentially allowing an attacker to execute XSS attacks. Public exploit code is available, but the vendor has not responded to the disclosure. The vulnerability has a low CVSS score of 3.5.
The Shipo WordPress plugin versions 1.6 through 1.8.0 contain an authentication bypass vulnerability. This flaw arises because the plugin's authenticate_rest_user() function improperly trusts the LOGGED_IN_COOKIE value without verifying its cryptographic signature. Attackers can bypass intended route restrictions and impersonate any user, including administrators, via the REST API, enabling unauthorized actions such as creating new administrator accounts.
Ettercap versions up to 0.8.5.1 have a heap out-of-bounds read vulnerability in the dissector_socks() function. This flaw allows network-adjacent attackers to read heap memory by sending crafted SOCKS5 authentication packets with unchecked username/password lengths. The vulnerability can lead to disclosure of sensitive memory contents, including credentials logged by Ettercap.
Dokploy versions before 0.31.1 have an OS command injection vulnerability in the getComposeContainerCommand() function. Authenticated organization members can exploit this flaw by injecting shell commands via the serviceName parameter. These commands are executed as root when scheduled backups run, allowing attackers to take over the host through the mounted Docker socket.
The MemberDash WordPress plugin up to and including version 1.8.7 contains a privilege escalation vulnerability. This flaw arises from a mass-assignment issue in the user_account_manager() function, allowing authenticated users with subscriber-level access or higher to modify arbitrary user accounts, including administrators. Attackers can overwrite email addresses and passwords of any WordPress user, potentially gaining full administrative control of the site.
Ettercap versions through 0.8.5.1 have a heap out-of-bounds read vulnerability in the dissector_mountd() function. This flaw occurs because the function independently validates RPC credential and directory lengths without ensuring they do not exceed the packet boundary. An attacker on the network can exploit this by sending a crafted MOUNT MNT call, causing the program to read up to 100 bytes beyond the heap buffer and leak memory contents to the console and logs.
Frappe india-payroll versions before 16.0.4 have a missing authorization vulnerability in specific methods of tax_regime_selector.py. This flaw allows authenticated users with low privileges to access payroll data of other employees and modify tax regimes on draft salary assignments. The vulnerability affects confidentiality and integrity of payroll data.
@kolkov/angular-editor versions before 3.0.4 have a cross-site scripting (XSS) vulnerability in the toggleEditorMode() function. This function assigns source view text directly to innerHTML without sanitization, allowing attackers to inject HTML with event handlers like img onerror. When users toggle views, the malicious script executes in the application's origin.
@kolkov/angular-editor versions before 3.0.3 have a cross-site scripting (XSS) vulnerability in the refreshView() function. This function writes HTML from ngModel or reactive form controls directly to innerHTML without using Angular's DomSanitizer, bypassing the default sanitization. An attacker can inject HTML containing event-handler attributes that execute scripts in the application's origin when loaded into the editor.
A vulnerability in CoolerMaster MASTERPLUS+ 1.9.6 affects the Device Driver component WinRing0x64.sys, specifically the function sub_11504. The flaw involves improper handling of the PhysicalAddress argument, resulting in incorrect default permissions. Exploitation requires local access. The vendor has not responded to disclosure attempts, and no patch information is available.
Pulse versions from 5.0.17 up to but not including 6.8.0 contain a missing authorization vulnerability in the /api/ai/approvals endpoints. This flaw allows authenticated users with viewer-level privileges to manage approval requests improperly. Attackers can list pending approval requests, exposing proposed commands and targets, and can approve or deny requests from other users, affecting decision and audit states.
The Cloud Storage Manager for Fluent Forms WordPress plugin (up to version 1.2.0) contains an arbitrary file write vulnerability due to missing authorization checks and insufficient path validation in Google Drive file handling. This flaw allows unauthenticated attackers to write files outside the intended directory, potentially leading to remote code execution if a PHP file is written to a web-accessible location.
A cross-site scripting (XSS) vulnerability exists in Opixido OCMS in the admin/TUI/index.php component due to improper handling of the 'img' argument. This flaw allows remote attackers to inject malicious scripts. The product uses continuous delivery with rolling releases, so specific affected or fixed versions are not available. The vendor did not respond to early disclosure attempts. Exploit code has been published. The CVSS score is 4.3, indicating medium severity.
Axeloz Filesharing versions prior to 2.14.3 have a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts via raw HTML or javascript: Markdown links in bundle descriptions. When recipients view the public bundle preview page, the injected script executes through Alpine x-html, enabling attackers to steal the owner's token from localStorage and perform owner-scoped actions on victim bundles.
The gateio-client package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.