Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.
Author SQL Injection in WP ERP <= 1.17.9 versions.
Administrator SQL Injection in Estatik <= 4.3.5 versions.
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.2 versions.
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7FFFFFFF; WSS4J decodes this while resolving the signature's key...
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
Unauthenticated Denial of Service Attack in WP Store Locator < 3.0.0 versions.
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
Contributor Cross Site Scripting (XSS) in Pixel Manager for WooCommerce <= 1.69.0 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
Unauthenticated Remote Code Execution (RCE) in AcyMailing SMTP Newsletter <= 11.0.5 versions.
Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions.
Unauthenticated SQL Injection in GamiPress <= 8.0.2 versions.
Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.
Unauthenticated Arbitrary File Download in NextGEN Gallery <= 4.5.0 versions.
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.
Author SQL Injection in Quiz Cat <= 3.1.1 versions.
Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.
Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.
Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.
Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.
Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. An attacker who captured an authenticated...
In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and SignedEleme...
WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass.
Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting.
This issue affects Maksisoft Gym: from 0.5.10 before 0.5.11.
A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user.
This vulnerability is due to improper handling of URI encoding in an HTTP request, wh...
AFFECTED_PRODUCTS:
Cisco Catalyst SD-WAN Manager
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can successfully log in to that user's account....
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbitrarily and gain access as any user, inc...
Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.
Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.
Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.
Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.