CVE Database

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, …

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the …

Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.

Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.2.6 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection.This …

Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.

Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.

Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.

Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.

Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.

Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification <= 2.3.1 versions.

Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.

Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.9 versions.

Administrator SQL Injection in Category Discount Woocommerce <= 5.18 versions.

Administrator SQL Injection in Admin Notices Manager <= 1.6.0 versions.

Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

Subscriber Cross Site Scripting (XSS) in Awesome Support <= 6.3.9 versions.

Subscriber Cross Site Scripting (XSS) in oik <= 4.15.4 versions.

Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Trusted Shops Easy Integration for WooCommerce <= 2.0.6 versions.

Custom role Privilege Escalation in Vitepos <= 3.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 5.6.7 versions.

Unauthenticated Cross Site Scripting (XSS) in YITH WooCommerce Ajax Search <= 2.28.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 6.1.3 versions.

Unauthenticated Broken Access Control in Bookly <= 28.2 versions.

Author SQL Injection in WP ERP <= 1.17.9 versions.

Administrator SQL Injection in Estatik <= 4.3.5 versions.

Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 …

Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.

Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

Subscriber Broken Access Control in FormGent <= 1.12.2 versions.