New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

ZITADEL Login V2: Missing authorization when approving device authorizations

ZITADEL Login V2 approves OAuth 2.0 device authorizations with the browser's existing signed-in session, without asking for consent or requiring the user code shown on the device. An attacker who starts a device authorization and gets a signed-in user to open one link can receive that user's tokens, including API access with the ZITADEL project scope. The same missing check allows bypassing project access settings through the OIDC device authorization API.

ZITADEL · ZITADEL

ZITADEL: Account takeover in Login V2 via forgeable verificationCheck cookie

ZITADEL's hosted Login V2 UI trusts a verificationCheck cookie that is derived only from the user ID and the browser fingerprint, so it can be computed by anyone. An unauthenticated attacker who knows the user ID or login name of an active user without any authentication method can set that user's first password, register a passkey, or link an external identity provider, and then sign in as that user. Users who already have a password, passkey or identity provider link are not affected, and the ZITADEL APIs are not affected.

ZITADEL · ZITADEL

ZITADEL: Host header injection in Login V2 enables account takeover

ZITADEL versions 4.0.0 up to 4.19.4 accept untrusted public host headers in the Login V2 UI. An unauthenticated attacker who knows a victim's login name can make genuine password-reset, invite and email-verification emails contain links to the attacker's host. When the victim opens the link, or automated mail scanning fetches it, the attacker captures the single-use code and can take over the account, including instance administrators. User interaction is required, and the default Login V2 deployment is affected.

ZITADEL · ZITADEL

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Imagemagick Imagemagick

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Crawl4AI: Denial of Service via unbounded crawler delay fields

The Docker API server of Crawl4AI does not cap the delay_before_return_html, mean_delay and max_range fields of untrusted crawl requests. A network client that can reach the API can send very large values to /crawl or /crawl/stream, which keeps browser pages busy and stalls the rate limiter. This exhausts the page pool and blocks other crawls, which is a service outage risk without data loss. The default configuration is affected because JWT authentication is disabled by default.

unclecode · Crawl4AI

Crawl4AI: Improper certificate validation via hard-coded Chromium flags

Crawl4AI launches Chromium with --ignore-certificate-errors, so the browser accepts any TLS certificate, and the hard-coded --no-sandbox flag overrides the sandbox setting. A network attacker who can intercept traffic or control DNS for a crawled host can serve forged content to the crawler and read cookies and headers that the crawl sends. The crawled content can then feed downstream systems such as RAG or LLM pipelines. The attack requires a man-in-the-middle or DNS-control position on the crawler's network path.

unclecode · Crawl4AI

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

BuddyBoss Platform: Privilege escalation for subscribers in WordPress plugin

The WordPress plugin BuddyBoss Platform up to and including version 3.5.0 contains a privilege escalation vulnerability (CWE-266). An attacker with a low-privileged Subscriber account can gain higher privileges, potentially up to administrator and full control of the website. The attack is possible over the network without user interaction, so sites with open registration are at highest risk.

BuddyBoss · Buddyboss Platform

10Web Social Photo Feed: PHP Object Injection by Contributor-level users

The WordPress plugin 10Web Social Photo Feed up to and including version 1.5.6 contains a PHP Object Injection flaw (CWE-502) that results from unsafe deserialization of untrusted data. An attacker with a Contributor-level account can exploit it over the network to manipulate how the site processes data, with a possible impact on confidentiality, integrity and availability. No fixed version or vendor workaround is known yet, and no active exploitation or public exploit is recorded.

10Web · Social Photo Feed

Social Snap WordPress plugin: PHP Object Injection via Contributor account

The Social Snap WordPress plugin up to and including version 1.5.4 contains a PHP Object Injection vulnerability (CWE-502) that is rated 8.8 (High) by the CNA Patchstack. An authenticated attacker with a Contributor-level account can submit crafted serialized data, which may allow manipulation of server-side processing and, depending on the available gadget chains, further compromise of the website. The exact vulnerable input is not specified in the sources reviewed.

Socialsnap · Social Snap

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Frisbii Pay WordPress plugin: PHP Object Injection via Contributor role

The Frisbii Pay WordPress plugin (WooCommerce payment gateway) up to and including version 1.8.19 is affected by a PHP Object Injection vulnerability (CWE-502). An authenticated user with Contributor privileges can send crafted data that the plugin deserializes, which can lead to manipulation of server-side processing and, depending on the site, to code execution, data access or data changes. Exploitation requires a low-privileged account and is not known to be actively exploited.

Frisbii · Frisbii Pay

WP Media folders WordPress plugin: PHP Object Injection by Contributor users

The WordPress plugin WP Media folders up to and including version 1.1.10 is vulnerable to PHP Object Injection. An authenticated user with the Contributor role can submit crafted serialized data, which the plugin processes unsafely, so an attacker may be able to manipulate application logic and cause harmful actions on the server. The plugin is discontinued, and no official patch is known.

dbarrere · WP Media folders