The Charitable - Donation Plugin for WordPress - Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the privacy settings fields in all versions up to, and including, 1.8.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. This issue was partially fixed in version 1.8.6.1 and fully fixed in version 1.8.6.2.
A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post requests to System Information Reporter, leading to creation of files anywhere on the filesystem and possibly overwriting existing files and exposing sensitive information disclosure.
The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_promo_form() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the plugin’s support‐form handler to send arbitrary emails to the site’s support address.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).This issue affects Klaro Cookie & Consent Management: from 0.0.0 before 3.0.7.
A security vulnerability in all (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability in iroha Board (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL while being logged in to the affected product, arbitrary learning histories may be registered.
Cross-Site Request Forgery in Homerunner for WordPress allows unauthenticated attackers to update plugin settings if they can trick a site administrator into performing an action like clicking a link. The vulnerability stems from missing nonce validation in the main_settings() function, affecting all versions up to 1.0.29. Exploitation requires user interaction and no public exploit or active exploitation is currently known.
An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sending crafted API requests that bypassed UI-enforced role restrictions.
Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.
pycode-browser before version 1.0 is prone to a predictable temporary file vulnerability.
A privilege escalation vulnerability in GitLab CE/EE affecting all (CVSS 3.1). Remediation should follow standard vulnerability management procedures.
An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users to assign unrelated compliance frameworks to projects by sending crafted GraphQL mutations that bypassed framework-specific permission checks.
Snyk CLI before version 1.1297.3 writes container registry credentials and Snyk authentication tokens verbatim into local debug log files when invoked with DEBUG or TRACE logging levels, enabling any party with read access to those logs to harvest credentials for downstream systems. Three command paths are affected: `snyk container test/monitor` (registry credentials via env vars or CLI flags), `snyk auth` at TRACE level (Snyk OAuth tokens), and `snyk iac test` with remote IAC bundles at TRACE level (docker registry tokens). No public exploit or active exploitation has been identified; vendor patch v1.1297.3 released 2025-06-23 is confirmed available.
Rejected reason: Not a vulnerability. No vendor patch available.