New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

oapi-codegen: Code injection via non-string enum values in OpenAPI specs

oapi-codegen versions 2.0.0 up to 2.8.0 allow code injection through non-literal enum entries in integer, number or boolean schemas of an OpenAPI document. An attacker who controls the OpenAPI document can craft an enum entry that closes the const block in the code template and inserts a func init() function. The injected code runs when the generated package is built and imported, typically on developer machines or CI runners. The NVD rating (CVSS 4.0 8.7) assumes that a user must process the malicious document (UI:P).

oapi-codegen · oapi-codegen

oapi-codegen: Code injection via crafted servers[].x-go-name value

oapi-codegen, a Go tool that generates Go code from OpenAPI specifications, does not escape the servers[].x-go-name value in its server-urls template. An attacker who controls an OpenAPI document can inject Go code, including a func init() that runs when a victim builds or imports the generated package. The attack requires that a developer or CI/CD pipeline generates code from the malicious document.

oapi-codegen · oapi-codegen

open npm package: OS command injection via PowerShell on Windows

The npm package open (versions 7.2.0 to before 11.0.0) can execute PowerShell code on Windows and WSL when crafted URLs are passed to it. Attackers can embed $(...) subexpressions in URLs, for example OAuth authorization_endpoint values from malicious MCP servers, which run when the package passes them unescaped to PowerShell. Exploitation requires a user to open or process such a URL, for example by connecting to a malicious MCP server.

sindresorhus · open

Research and translation in progress – available shortly.

Newsmatic WordPress theme: Unauthenticated blind SQL injection via slug parameter

The Newsmatic theme for WordPress does not sufficiently escape the 'slug' parameter and does not use prepared SQL statements. An unauthenticated attacker can append SQL queries to existing database queries over the network. This can be used to extract sensitive information from the database, such as user accounts and password hashes, on any public site running the affected theme.

blazethemes · Newsmatic

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Yamaha LAN Monitor for Windows: Insecure DLL loading in installer

The installer of Yamaha LAN Monitor for Windows up to version 1.9.3 loads Dynamic Link Libraries from an insecure search path. If the installer is started from a directory containing a specially crafted DLL, the DLL is loaded and code runs with administrative privileges. The attacker must place the file locally and the user must run the installer; the issue affects only installation and not already installed copies.

Yamaha Corporation · Yamaha LAN Monitor for Windows

Research and translation in progress – available shortly.

Guardian/CMC: OS command injection in update function

Two OS command injection vulnerabilities in the update installation function of Nozomi Networks Guardian and CMC allow arbitrary commands to run with root privileges. The cause is insufficient validation of update bundle contents. An attacker needs administrative privileges and must get a crafted update bundle installed, for example via the web management interface. Successful exploitation allows reading or modifying sensitive data, changing the appliance configuration, or shutting down the appliance.

Nozomi Networks · Guardian and CMC

Nozomi Guardian/CMC: Signature verification bypass in update bundles

Nozomi Networks Guardian and Central Management Console (CMC) before version 26.4.0 contain a flaw in update bundle validation. An attacker with administrative privileges can supply a crafted update bundle that passes signature verification but runs an unsigned script with root privileges during installation. This allows reading or modifying sensitive data, changing the appliance configuration, or shutting down the appliance.

Nozomi Networks · Guardian/CMC

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

WordPress Login with phone number: Broken authentication

The WordPress plugin Login with phone number up to and including version 1.8.78 contains a broken authentication flaw (CWE-1390, CVSS 8.8 per the CNA). According to Patchstack, an attacker can bypass the login system or log in as other users without their password. Patchstack lists the required privilege as Subscriber, so a low-privilege account may be needed, but the exact precondition is not confirmed.

Hamid Alinia · Login with phone number

BuddyPress plugin: Blind SQL injection

The WordPress plugin BuddyPress contains a blind SQL injection vulnerability (CWE-89) in versions up to and including 14.5.2. An authenticated attacker with a low-privilege account can inject SQL commands and extract database content, including user accounts and private data, although this is slow and requires many requests. Patchstack rates the issue as high priority with a CVSS score of 8.5, while VulDB gives 6.3; the NVD analysis is still pending.

WordPress BuddyPress · BuddyPress

Motors WordPress plugin: Blind SQL injection

The Motors - Car Dealership & Classified Listings WordPress plugin up to and including 1.4.126 contains a blind SQL injection vulnerability (CWE-89). An unauthenticated remote attacker can send crafted requests to read, modify or delete database contents, including user accounts and private data. Patchstack rates the issue as high priority with a CVSS score of 9.3.

StylemixThemes · Motors

Research and translation in progress – available shortly.