All CVEs — page 616 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows authenticated attackers with Administrator-level access to execute arbitrary OS commands as the web-server user through insufficient sanitization of the `file` POST parameter in the Backup Migration plugin for WordPress.
The flaw allows authenticated attackers with Subscriber-level access to relink the MailMunch integration, leading to unauthorized access to subscriber data.
The flaw allows unauthenticated attackers to delete arbitrary search-term records via a forged request, potentially leading to loss of valuable search history data.
The flaw allows path traversal by not validating the resolved file path after using path.resolve, potentially leading to unauthorized access or execution of files.
The flaw allows an attacker to bypass authentication by manipulating the session_variables object in the request body, overriding the Authorization header's JWT claims without verification.
The flaw allows an attacker to perform unlimited password-guessing attempts against any account, including administrators, due to the absence of rate-limiting or account lockout mechanisms when the captcha is disabled, which is the default configuration.
The flaw allows an attacker to inject arbitrary API endpoints, potentially leading to unauthorized access or data exfiltration.
The flaw allows unauthenticated access to sensitive resources via URL-encoded paths, potentially enabling unauthorized data exposure.
The flaw allows direct SQL injection due to lack of parameterization and escaping, and includes hardcoded admin credentials, enabling full authentication bypass.
The flaw lies in the CheckToken function, which does not re-fetch the account from the database even if the JWT's HMAC signature is valid. This can lead to unauthorized access to user accounts.
The flaw allows for potential out-of-bounds memory access due to improper validation of offset parameters in the crop function, which could lead to arbitrary code execution if exploited.
The flaw allows a negative ratio to cause image processing functions to fail, potentially crashing the application due to invalid width values.
The flaw allows remote code execution by manipulating the ratio parameter in imagecli's pipeline operation without proper validation, leading to potential crashes or arbitrary code execution.
The flaw in Pluck CMS's admin panel allows attackers to perform cross-site request forgery (CSRF) attacks by manipulating the Referer header, leading to potential unauthorized actions.
The flaw allows unauthenticated attackers to access sensitive information such as API keys and task parameters through the `getCurrentTaskResults()` method in the AIWU plugin for WordPress.