Local Privilege Escalation via LIBEXTRACTOR_PREFIX Untrusted Search Path
Target: GNU Project libextractor (< 1.16)· CWE: CWE-426: Untrusted Search Path· Status: patched
7.3high
CVE Registry & Advisories
A filterable index of security vulnerabilities discovered through independent research. Disclosed following coordinated disclosure timelines and CNA validation.
/
Showing 15 of 15 advisories
No matching CVEs found
Try clearing your search query or switching the severity filter.
Stack Overflow via Excessive Stack Allocation in OLE2 Plugin
Target: GNU Project libextractor (< 1.15)· CWE: CWE-789 / CWE-121: Stack-based Buffer Overflow· Status: patched
8.7high
Unauthenticated Payment Record Creation via Checkout REST Endpoint
Target: MotoPress Hotel Booking Lite (< 6.2.3)· CWE: CWE-284: Improper Access Control· Status: patched
5.3medium
Subscriber+ Customer Data Modification via IDOR
Target: MotoPress Hotel Booking Lite (< 6.2.3)· CWE: CWE-639: Insecure Direct Object Reference· Status: patched
5.4medium
Unauthenticated API Authentication Bypass via Type Juggling
Target: Tribulant Newsletters (< 4.16)· CWE: CWE-287: Improper Authentication· Status: patched
4.8medium
Unauthenticated Privilege Escalation via Role Selection Field
Target: Ultimate Member Ultimate Member (< 2.12.1)· CWE: CWE-269: Improper Privilege Management· Status: patched
8.1high
Unauthenticated Payment Bypass via Order Status Manipulation
Target: Themewinter Eventin (< 4.1.16)· CWE: CWE-639: Insecure Direct Object Reference· Status: patched
unrated
Unauthenticated Person Data Modification via IDOR
Target: Events Made Easy Events Made Easy (< 3.1.4)· CWE: CWE-639: Insecure Direct Object Reference· Status: patched
5.3medium
Unauthenticated Plugin Settings Modification
Target: User Management User Management (<= 1.2)· CWE: CWE-862: Missing Authorization· Status: patched
5.3medium
Unauthenticated Payment Bypass via Token Detachment
Target: Events Made Easy Events Made Easy (< 3.1.2)· CWE: CWE-284: Improper Access Control· Status: patched
unrated
Unauthenticated Event Aggregator Import Status Manipulation
Target: The Events Calendar The Events Calendar (< 6.16.5.1)· CWE: CWE-284: Improper Access Control· Status: patched
5.3medium
Unauthenticated Stored XSS via Arbitrary SVG Upload
Target: Product Addons Product Addons – WowAddons (< 1.6.15)· CWE: CWE-79: Cross-Site Scripting· Status: patched
8.8high
Subscriber+ Subscription Cancellation via IDOR
Target: ProfilePress ProfilePress (< 4.16.17)· CWE: CWE-639: Insecure Direct Object Reference· Status: patched
8.1high
Contributor+ Stored XSS via Shortcode Attribute
Target: AI Share & Summarize AI Share & Summarize (< 2.0.4)· CWE: CWE-79: Cross-Site Scripting· Status: patched
6.8medium
Email Verification Bypass via Predictable Token
Target: Pie Register Pie Register (<= 3.8.4.9)· CWE: CWE-340: Generation of Predictable Numbers or Identifiers· Status: patched
5.3medium