New vulnerabilities – clearly explained

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

oapi-codegen: Code injection via non-string enum values in OpenAPI specs

oapi-codegen versions 2.0.0 up to 2.8.0 allow code injection through non-literal enum entries in integer, number or boolean schemas of an OpenAPI document. An attacker who controls the OpenAPI document can craft an enum entry that closes the const block in the code template and inserts a func init() function. The injected code runs when the generated package is built and imported, typically on developer machines or CI runners. The NVD rating (CVSS 4.0 8.7) assumes that a user must process the malicious document (UI:P).

oapi-codegen · oapi-codegen

oapi-codegen: Code injection via crafted servers[].x-go-name value

oapi-codegen, a Go tool that generates Go code from OpenAPI specifications, does not escape the servers[].x-go-name value in its server-urls template. An attacker who controls an OpenAPI document can inject Go code, including a func init() that runs when a victim builds or imports the generated package. The attack requires that a developer or CI/CD pipeline generates code from the malicious document.

oapi-codegen · oapi-codegen

open npm package: OS command injection via PowerShell on Windows

The npm package open (versions 7.2.0 to before 11.0.0) can execute PowerShell code on Windows and WSL when crafted URLs are passed to it. Attackers can embed $(...) subexpressions in URLs, for example OAuth authorization_endpoint values from malicious MCP servers, which run when the package passes them unescaped to PowerShell. Exploitation requires a user to open or process such a URL, for example by connecting to a malicious MCP server.

sindresorhus · open

NewsmanApp: Stored Cross-Site Scripting via billing name fields

The NewsmanApp WordPress plugin up to and including version 3.7.29 does not properly sanitise or escape the billing first name and billing last name fields. An unauthenticated attacker can store malicious scripts that run in the browser of any user who opens an affected page. The flaw only applies when Newsman Remarketing is enabled and a non-empty Remarketing ID is configured.

Newsman · NewsmanApp

Newsmatic WordPress theme: Unauthenticated blind SQL injection via slug parameter

The Newsmatic theme for WordPress does not sufficiently escape the 'slug' parameter and does not use prepared SQL statements. An unauthenticated attacker can append SQL queries to existing database queries over the network. This can be used to extract sensitive information from the database, such as user accounts and password hashes, on any public site running the affected theme.

blazethemes · Newsmatic

Yamaha NWR100: Insecure storage of sensitive information in configuration export

The Yamaha wireless LAN router NWR100 stores configuration files generated by its CONFIG export function insecurely. An unauthenticated attacker who can reach the Web GUI can read these exported configuration files. By default the Web GUI is not reachable from the internet, but it is reachable from devices connected over the wireless LAN, and the impact depends on what the file contains, which the public advisories do not specify.

Yamaha Corporation · NWR100

Research and translation in progress – available shortly.

Yamaha LAN Monitor for Windows: Insecure DLL loading in installer

The installer of Yamaha LAN Monitor for Windows up to version 1.9.3 loads Dynamic Link Libraries from an insecure search path. If the installer is started from a directory containing a specially crafted DLL, the DLL is loaded and code runs with administrative privileges. The attacker must place the file locally and the user must run the installer; the issue affects only installation and not already installed copies.

Yamaha Corporation · Yamaha LAN Monitor for Windows

Research and translation in progress – available shortly.

Guardian/CMC: OS command injection in update function

Two OS command injection vulnerabilities in the update installation function of Nozomi Networks Guardian and CMC allow arbitrary commands to run with root privileges. The cause is insufficient validation of update bundle contents. An attacker needs administrative privileges and must get a crafted update bundle installed, for example via the web management interface. Successful exploitation allows reading or modifying sensitive data, changing the appliance configuration, or shutting down the appliance.

Nozomi Networks · Guardian and CMC

Nozomi Guardian/CMC: Signature verification bypass in update bundles

Nozomi Networks Guardian and Central Management Console (CMC) before version 26.4.0 contain a flaw in update bundle validation. An attacker with administrative privileges can supply a crafted update bundle that passes signature verification but runs an unsigned script with root privileges during installation. This allows reading or modifying sensitive data, changing the appliance configuration, or shutting down the appliance.

Nozomi Networks · Guardian/CMC

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

WP Swings Upsell Order Bump Offer for WooCommerce: Reflected cross-site scripting

The WordPress plugin Upsell Order Bump Offer for WooCommerce by WP Swings contains a reflected cross-site scripting (XSS) vulnerability (CWE-79). An attacker can craft a link that injects malicious scripts into the site, which can be used to steal visitor data or hijack accounts. Exploitation requires a victim, such as a shopper or store administrator, to open the crafted link or page.

WP Swings · Upsell Order Bump Offer for WooCommerce

WordPress Login with phone number: Broken authentication

The WordPress plugin Login with phone number up to and including version 1.8.78 contains a broken authentication flaw (CWE-1390, CVSS 8.8 per the CNA). According to Patchstack, an attacker can bypass the login system or log in as other users without their password. Patchstack lists the required privilege as Subscriber, so a low-privilege account may be needed, but the exact precondition is not confirmed.

Hamid Alinia · Login with phone number

BuddyPress plugin: Blind SQL injection

The WordPress plugin BuddyPress contains a blind SQL injection vulnerability (CWE-89) in versions up to and including 14.5.2. An authenticated attacker with a low-privilege account can inject SQL commands and extract database content, including user accounts and private data, although this is slow and requires many requests. Patchstack rates the issue as high priority with a CVSS score of 8.5, while VulDB gives 6.3; the NVD analysis is still pending.

WordPress BuddyPress · BuddyPress

Motors WordPress plugin: Blind SQL injection

The Motors - Car Dealership & Classified Listings WordPress plugin up to and including 1.4.126 contains a blind SQL injection vulnerability (CWE-89). An unauthenticated remote attacker can send crafted requests to read, modify or delete database contents, including user accounts and private data. Patchstack rates the issue as high priority with a CVSS score of 9.3.

StylemixThemes · Motors

Broadcast Live Video WordPress plugin: Broken access control

The WordPress plugin Broadcast Live Video (videowhisper-live-streaming-integration) up to and including version 7.3.9 contains a broken access control flaw classified as missing authorization (CWE-862). An authenticated low-privileged user, such as a subscriber account, may be able to perform actions they should not be allowed to, which can affect site integrity and availability. Sources disagree on the exact flaw and score: the CNA rates it 7.1, while VulDB classifies it as CWE-306 with 5.4.

VideoWhisper.com · Broadcast Live Video

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

WordPress TableOn plugin: Reflected cross-site scripting

The TableOn plugin for WordPress (posts-table-filterable), versions up to and including 1.0.7, contains a reflected cross-site scripting vulnerability (CWE-79). An attacker can craft a link or page that injects malicious scripts into the site, which run in the browser of a visitor. Exploitation requires that a user, for example a logged-in administrator, clicks the crafted link or visits the crafted page.

PluginUs.Net · TableOn