Weekly Vulnerabilities Reports > December 30, 2024 to January 5, 2025

A vulnerability has been found in Codezips Gym Management System 1.0 and classified as critical.

A vulnerability was found in Codezips Blood Bank Management System 1.0 and classified as critical.

A vulnerability was found in wangl1989 mysiteforme 1.0.

A vulnerability was found in wangl1989 mysiteforme 1.0.

A vulnerability classified as critical was found in code-projects Online Shoe Store 1.0.

Cross-Site Request Forgery (CSRF) vulnerability in CridioStudio ListingPro allows Authentication Bypass.This issue affects ListingPro: from n/a through 2.9.4.

Missing Authorization vulnerability in gVectors Team wpDiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through 7.6.3.

Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes MasterStudy LMS allows Cross Site Request Forgery.This issue affects MasterStudy LMS: from n/a through 3.2.1.

Cross-Site Request Forgery (CSRF) vulnerability in CreativeThemes Blocksy allows Cross Site Request Forgery.This issue affects Blocksy: from n/a through 2.0.22.

Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.8.

A vulnerability was found in PHPGurukul Land Record System 1.0 and classified as critical.

A vulnerability has been found in PHPGurukul Land Record System 1.0 and classified as critical.

A vulnerability was found in CodeAstro Online Food Ordering System 1.0.

Missing Authorization vulnerability in Leap13 Premium Addons for Elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Premium Addons for Elementor: from n/a through 4.10.56.

A vulnerability was found in code-projects Simple Chat System 1.0.

Local privilege escalation due to DLL hijacking vulnerability.

Local privilege escalation due to DLL hijacking vulnerability.

Panda Security Dome Link Following Local Privilege Escalation Vulnerability.

Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.

Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability.

Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.

Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability.

Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability.

Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability.

Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.

A vulnerability, which was classified as problematic, was found in code-projects Chat System 1.0.

IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause a denial of service using a complex regular expression.

A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0.

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as critical.

A vulnerability has been found in code-projects Chat System 1.0 and classified as critical.

A vulnerability, which was classified as critical, was found in code-projects Chat System 1.0.

A vulnerability classified as critical was found in code-projects Job Recruitment 1.0.

A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0.

A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0.

In WhatsUp Gold versions released before 2024.0.2, an unauthenticated attacker can configure LDAP settings.

A vulnerability was found in code-projects Chat System 1.0 and classified as critical.

IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 is vulnerable to SQL injection.

Missing Authorization vulnerability in gVectors Team wpDiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through 7.6.10.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author allows SQL Injection.This issue affects WP Post Author: from n/a through 3.8.2.

IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code.

IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to traverse directories on the system.

IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause an unhandled SSL exception which could leave the connection in an unexpected or insecure state.

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection via the 'project_id' parameter of the /wp-json/pm/v2/projects/2/task-lists REST API endpoint in all versions up to, and including, 2.6.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as critical.

A vulnerability has been found in code-projects Point of Sales and Inventory Management System 1.0 and classified as critical.

A vulnerability, which was classified as critical, was found in code-projects Point of Sales and Inventory Management System 1.0.

A vulnerability, which was classified as critical, has been found in code-projects Point of Sales and Inventory Management System 1.0.

A vulnerability classified as critical was found in code-projects Point of Sales and Inventory Management System 1.0.

A vulnerability classified as critical has been found in code-projects Point of Sales and Inventory Management System 1.0.

A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0.

A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0.

In WhatsUp Gold versions released before 2024.0.2, an authenticated user can use a specially crafted HTTP request that can lead to information disclosure.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themify Themify Builder allows PHP Local File Inclusion.This issue affects Themify Builder: from n/a through 7.6.3.

Missing Authorization vulnerability in W3 Eden, Inc.

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping.

A vulnerability was found in code-projects Online Shop 1.0.

Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage.

A vulnerability was found in PHPGurukul Land Record System 1.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Reflected XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1001.

A vulnerability, which was classified as problematic, has been found in code-projects Chat System 1.0.

A vulnerability was found in IObit Protected Folder up to 13.6.0.5 and classified as problematic.

A vulnerability was found in IObit Protected Folder up to 13.6.0.5.

A vulnerability has been found in IOBit Protected Folder up to 1.3.0 and classified as problematic.

In the Linux kernel, the following vulnerability has been resolved: media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case.

A vulnerability classified as problematic was found in osuuu LightPicture up to 1.2.2.

A vulnerability classified as problematic has been found in Emlog Pro up to 2.4.3.

A vulnerability was found in wangl1989 mysiteforme 1.0.

A vulnerability has been found in Emlog Pro 2.4.3 and classified as problematic.

A vulnerability classified as problematic was found in Emlog Pro up to 2.4.3.

The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping.

The Taskbuilder – WordPress Project & Task Management plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppm_tasks shortcode in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping on user supplied attributes.

The Scratch & Win – Giveaways and Contests.

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files.

Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP.This issue affects GiveWP: from n/a through 2.25.1.

Missing Authorization vulnerability in wpdevart Responsive Image Gallery, Gallery Album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tyche Softwares Arconix Shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through 2.1.14.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeLooks Enter Addons allows Stored XSS.This issue affects Enter Addons: from n/a through 2.1.9.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in moveaddons Move Addons for Elementor allows Stored XSS.This issue affects Move Addons for Elementor: from n/a through 1.3.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode - WP Business Directory Plugins GeoDirectory allows Stored XSS.This issue affects GeoDirectory: from n/a through 2.3.84.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.3.987.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 6.0.7.

A vulnerability classified as problematic has been found in PHPGurukul Land Record System 1.0.

A vulnerability was found in PHPGurukul Land Record System 1.0.

A vulnerability was found in PHPGurukul Land Record System 1.0.

A vulnerability, which was classified as problematic, was found in PHPGurukul Land Record System 1.0.

A vulnerability classified as problematic was found in PHPGurukul Land Record System 1.0.

A vulnerability, which was classified as problematic, has been found in PHPGurukul Land Record System 1.0.

A vulnerability classified as problematic has been found in PHPGurukul Land Record System 1.0.

A vulnerability was found in SourceCodester Multi Role Login System 1.0.

Cross-Site Request Forgery (CSRF) vulnerability in Codebard CodeBard Help Desk allows Cross Site Request Forgery.This issue affects CodeBard Help Desk: from n/a through 1.1.1.

A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210.

Missing Authorization vulnerability in Poll Maker Team Poll Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through 4.7.1.

A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical.

A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210.

A vulnerability, which was classified as critical, was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210.

A vulnerability has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical.

A vulnerability classified as critical was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210.

A vulnerability, which was classified as critical, has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210.

A vulnerability was found in CodeAstro Online Food Ordering System 1.0 and classified as critical.

A vulnerability classified as problematic was found in Antabot White-Jotter up to 0.2.2.

A vulnerability was found in ZeroWdd studentmanager 1.0.

A vulnerability has been found in code-projects Local Storage Todo App 1.0 and classified as problematic.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Contest Gallery Contest Gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through 24.0.3.

A vulnerability classified as problematic has been found in Antabot White-Jotter up to 0.2.2.

IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could could allow a physical user to obtain sensitive information due to not masking passwords during entry.

IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.4 due to missing validation on a user controlled key.

Missing Authorization vulnerability in 10Web 10Web Map Builder for Google Maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10Web Map Builder for Google Maps: from n/a through 1.0.73.

Missing Authorization vulnerability in 10Web 10WebAnalytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 10WebAnalytics: from n/a through 1.2.12.

Missing Authorization vulnerability in CusRev Customer Reviews for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Reviews for WooCommerce: from n/a through 5.36.0.

Missing Authorization vulnerability in weDevs WP ERP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.12.6.

Missing Authorization vulnerability in RedLettuce Plugins WP Word Count allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Word Count: from n/a through 3.2.4.

Cross-Site Request Forgery (CSRF) vulnerability in Groundhogg Inc.

Missing Authorization vulnerability in WP Royal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1001.

Cross-Site Request Forgery (CSRF) vulnerability in Searchiq SearchIQ.This issue affects SearchIQ: from n/a through 4.6.