Threat database

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress contains a SQL Injection vulnerability in the 'src_by' parameter affecting all versions up to and including 3.5.1. This vulnerability allows unauthenticated attackers or authenticated users with any POS role to inject malicious SQL commands via the /vitepos/v1/vendor/list REST route, potentially exposing sensitive database information. The vulnerability arises from insufficient escaping and lack of proper query preparation. The CVSS 3.1 score is 7.5 (high severity), indicating a network exploitable flaw with no privileges or user interaction required and high confidentiality impact. No patch information is provided, and no known exploits are reported in the wild.

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress contains a blind SQL Injection vulnerability in all versions up to and including 3.6.1. The flaw exists in the 'src_by[].val.start / src_by[].val.end' parameters with the 'bt' (BETWEEN) operator, allowing authenticated users with vendor-level access or higher to inject additional SQL commands. This vulnerability is due to insufficient escaping and incomplete patching of a previous SQL injection issue. It can lead to unauthorized extraction of sensitive database information.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through 3.6.1.

Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appsbd Vitepos vitepos-lite allows Blind SQL Injection.This issue affects Vitepos: from n/a through <= 3.4.2.

Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.

The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to the save_update_category_img() function accepting user-supplied file types without validation when processing category images. This makes it possible for authenticated attackers, with subscriber level access and above, to upload arbitrary files on the affected site's server which makes remote code execution possible.

Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.7.

Cross-Site Request Forgery (CSRF) vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This issue affects Vite Coupon: from n/a through <= 1.0.9.

Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: from n/a through <= 3.1.4.

The Simple Notification plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Missing Authorization vulnerability in appsbd Vitepos vitepos-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vitepos: from n/a through <= 3.1.3.

Missing Authorization vulnerability in appsbd Simple Notification simple-notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Notification: from n/a through <= 1.3.

Missing Authorization vulnerability in Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification: from 1.5 through n/a.

Missing Authorization vulnerability in appsbd Vitepos.This issue affects Vitepos: from n/a through 3.0.1.