A stored cross-site scripting (XSS) vulnerability exists in 10Web Form Maker versions up to 1.15.50. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can execute in the context of other users. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, and user interaction needed. It impacts confidentiality, integrity, and availability with low to high impact levels. No patch or remediation information is currently provided.
A missing authorization vulnerability exists in weDevs weDocs (up to version 2.6.1) that allows attackers to exploit incorrectly configured access control security levels. This flaw enables unauthorized remote attackers to access sensitive information without authentication.
A stored cross-site scripting (XSS) vulnerability exists in WPMU DEV Hummingbird plugin versions up to 3.21.2. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of other users. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A Cross-Site Scripting (XSS) vulnerability exists in Welcart e-Commerce up to version 2.12.6 due to improper neutralization of script-related HTML tags. This flaw allows an attacker to inject code, potentially impacting the integrity and availability of the application.
A stored cross-site scripting (XSS) vulnerability exists in the wpWax Directorist plugin up to version 8.10.6. This vulnerability involves improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can impact confidentiality, integrity, and availability.
A stored cross-site scripting (XSS) vulnerability exists in the WP Wham Checkout Files Upload for WooCommerce plugin, affecting versions up to and including 2.4.0. This vulnerability allows an attacker to inject malicious scripts that can be executed in the context of users visiting the affected web pages.
A stored cross-site scripting (XSS) vulnerability exists in FolioVision FV Flowplayer Video Player (fv-wordpress-flowplayer) versions up to 7.5.56.7212. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of users' browsers when they view affected web pages.
An Incorrect Privilege Assignment vulnerability exists in Webful Creations RepairBuddy computer-repair-shop software, allowing privilege escalation. The vulnerability affects versions up to 4.1234. It has a CVSS 3.1 base score of 6.3, indicating a medium severity level. The vulnerability allows an attacker with some privileges to escalate their privileges further without user interaction. No public exploits or known active exploitation are reported. No patch or remediation information is currently available.
A stored Cross-site Scripting (XSS) vulnerability exists in Flying Images by Gijo Varghese, affecting versions up to 2.4.15. This vulnerability allows attackers to inject malicious scripts that execute in users' browsers when they view affected pages.
Apache Airflow's logout endpoint fails to properly revoke tokens on the server when revocation encounters errors, including database failures or tokens from external issuers with long identifiers. As a result, tokens remain valid after logout, allowing continued API access until token expiration. Users should upgrade to Apache Airflow 3.4.0 or later to address this issue.
A stored cross-site scripting (XSS) vulnerability exists in Welcart e-Commerce versions up to 2.12.6. This vulnerability allows an attacker to inject malicious scripts that are stored and later executed in the context of users' browsers when they view affected pages. The flaw is due to improper neutralization of input during web page generation.
A stored cross-site scripting (XSS) vulnerability exists in DynamiApps Frontend Admin (acf-frontend-form-element) up to version 3.30.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in the context of the affected application.
Apache Airflow's API endpoint for deleting an asset's queued events improperly checked permissions, allowing an authenticated user with edit permission on one DAG and read access to others to delete queued events for DAGs they can only read. This flaw enables suppression of asset-triggered runs for DAGs without proper edit rights. The issue was incompletely fixed in version 3.3.2, and users should upgrade to version 3.4.0 or later to fully resolve it.
Apache Airflow's secrets masker failed to mask secrets nested deeper than five levels in data structures, causing sensitive information such as Connection passwords or Variable values to be exposed in task logs and rendered templates. This exposure allows users who can read these logs or templates but should not have access to the secrets to view them in cleartext. The issue is resolved in Apache Airflow version 3.4.0 and later.
Apache Airflow's asset API endpoints exposed the IDs of DAGs related to assets without verifying if the caller had permission to view those DAGs. This allowed authenticated users with asset read access to infer the existence of DAGs they were not authorized to see. Users should upgrade to Apache Airflow version 3.4.0 or later to address this issue.
Apache Airflow versions with the non-default [core] test_connection setting enabled have a vulnerability where asynchronous connection tests improperly handle permissions. Specifically, users with create permission but without edit permission can overwrite existing connections if the test completes and commits the connection under an existing ID. This issue is fixed in Apache Airflow 3.4.0 and later.
Apache Airflow versions prior to 3.4.0 did not reject reserved serialization keys inside a Dag run's configuration. This flaw allowed users authorized to trigger a Dag with a deadline alert and asynchronous callback to pass a crafted configuration that could cause the scheduler to crash repeatedly or cause improper object reconstruction inside the Triggerer after a missed deadline. Upgrading to Apache Airflow 3.4.0 or later resolves this issue.
Apache Airflow versions prior to 3.4.0 had a flaw in their secrets masker where sensitive keys were only matched in snake_case form. As a result, sensitive values stored under camelCase keys such as privateKey, connectionString, webhookUrl, or accessKey were not redacted in task logs, rendered templates, or API responses. This could allow unauthorized users with access to task logs or rendered templates to view sensitive credentials in cleartext. Upgrading to Apache Airflow 3.4.0 or later addresses this issue.
A Reflected Cross-site Scripting (XSS) vulnerability exists in WP Inventory Manager versions up to 2.5.9. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected web application.
The Apache Airflow connections API failed to mask the apprise provider's config connection extra, which may contain notification-service credentials. This flaw allows users with permission to read connections to retrieve these credentials in cleartext. The issue is addressed in Apache Airflow version 3.4.0 and later, where connection credentials are treated as write-only.