The WordPress plugin Sastra Essential Addons for Elementor up to version 1.2.3 is affected by a PHP Object Injection vulnerability (CWE-502). An attacker with a WordPress account at Author level can submit crafted serialized data, which may allow manipulation of server-side processing and harmful actions on the server. The attacker needs a valid Author-level login, so unauthenticated exposure is not the main risk, but sites with many contributors or shared accounts are more exposed.
TemplatesCoder · Sastra Essential Addons for Elementor
The Frisbii Pay WordPress plugin (WooCommerce payment gateway) up to and including version 1.8.19 is affected by a PHP Object Injection vulnerability (CWE-502). An authenticated user with Contributor privileges can send crafted data that the plugin deserializes, which can lead to manipulation of server-side processing and, depending on the site, to code execution, data access or data changes. Exploitation requires a low-privileged account and is not known to be actively exploited.
Frisbii · Frisbii Pay
The WordPress plugin WP Media folders up to and including version 1.1.10 is vulnerable to PHP Object Injection. An authenticated user with the Contributor role can submit crafted serialized data, which the plugin processes unsafely, so an attacker may be able to manipulate application logic and cause harmful actions on the server. The plugin is discontinued, and no official patch is known.
dbarrere · WP Media folders
The Finale Lite WordPress plugin for WooCommerce, versions up to and including 2.21.0, contains a PHP Object Injection vulnerability (CWE-502). An authenticated user with the Shop Manager role can supply crafted serialized data that the plugin processes, which may allow manipulation of server-side objects and harmful actions on the server. Exploitation requires a Shop Manager account, and the real impact depends on the code present on the site.
Daman Jeet · Finale Lite
The WordPress plugin News Kit Elementor Addons up to and including version 1.5.0 contains a PHP Object Injection flaw (CWE-502). An attacker with a Subscriber account can submit crafted serialized data that the plugin processes unsafely, which can lead to code execution, data access or manipulation on the server, depending on other installed components. No official patch was available at the time of research, and the fixed version is unknown.
BlazeThemes · News Kit Elementor Addons
The myPOS Checkout WordPress plugin up to and including version 1.4.5 contains a PHP Object Injection vulnerability (CWE-502). An authenticated user with the shop manager role can submit crafted serialized data, which the plugin processes unsafely. This can let an attacker manipulate data and run harmful actions on the server, depending on the other plugins installed. Patchstack rates the CVSS score 7.2, while VulDB rates it 4.7.
myPOS · Checkout WordPress plugin
The WordPress plugin BuddyPress Xprofile Custom Field Types up to and including version 1.3.1 contains a PHP object injection vulnerability (CWE-502). An attacker with a Subscriber account can manipulate serialized data so that the server processes it as PHP objects, which may allow code execution, data access or denial of service. Exploitation requires a logged-in low-privilege account, so sites with open registration are most exposed. No vendor fix was found at the time of writing.
BuddyDev · BuddyPress Xprofile Custom Field Types
The WordPress plugin Dynamic QR Code – generator by sosidee, versions up to and including 1.0.1, contains a PHP Object Injection vulnerability (CWE-502). An attacker with a Contributor-level account can submit crafted serialized data that the plugin processes, which may allow manipulation of server-side objects. Depending on the other installed plugins and themes, this can lead to code execution, data access or denial of service. The CNA Patchstack rates it CVSS 8.8, and no fixed version has been confirmed.
sosidee · Dynamic QR Code – generator
The Extra Fees for WooCommerce WordPress plugin up to and including version 4.4.0 contains a PHP Object Injection vulnerability (CWE-502). An authenticated user with Contributor role can submit crafted serialized data, which the plugin unserializes, allowing manipulation of application logic. Successful exploitation can lead to code execution or data compromise on the server, depending on the classes available in other installed plugins and themes.
Dotstore · Extra Fees for WooCommerce
The WordPress plugin Zippy up to version 1.7.0 contains a PHP Object Injection vulnerability (CWE-502). According to the CVE description, a user with the Editor role can trigger it, which may allow manipulation of how the site processes serialized data and harmful actions on the server. The CVSS 3.1 score is 7.2, and the CVSS vector requires high privileges, so an attacker needs a logged-in Editor account. No vendor fix has been confirmed yet.
Gesundheit Bewegt GmbH · Zippy
The WordPress plugin WPCargo Track & Trace up to and including version 8.0.5 is affected by a PHP Object Injection vulnerability (CWE-502). According to the CVSS vector, an attacker needs high privileges (Author role) and can affect confidentiality, integrity and availability of the server. Patchstack rates the issue as medium priority and expects exploitation to occur, but no exploitation is currently known.
Arni Cinco · WPCargo Track & Trace
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
RT-Labs P-Net is a Profinet device stack used in embedded firmware of industrial devices such as PLCs, I/O modules, drives and sensors. Versions before 1.0.3 do not release RPC sessions allocated for requests naming an unknown interface or object UUID, and do not start a timeout for them. A remote, unauthenticated attacker can exhaust the available sessions with repeated requests, so the device stops answering new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted.
RT-Labs · P-Net
Incorrect default file permissions in ASP.NET Core allow a local, authorized user with low privileges to elevate their privileges. Microsoft's advisory limits the issue to Linux installations of the .NET runtime and targeting-pack tarballs and to source-built .NET tarballs, but the official CVE record and some third-party sources list Windows and macOS as well. The impact is high confidentiality, integrity and availability on the affected host. No confirmed exploitation in the wild is known.
Microsoft · ASP.NET Core
Research and translation in progress – available shortly.
OpenText Advanced Authentication Server, a multi-factor authentication platform, trusts extraneous untrusted data in a way that lets an attacker reach functionality that should be restricted by access controls. The CNA describes it as a logon bypass, but the NVD entry was still awaiting analysis and the weakness classification differs between sources. The vendor advisories list the affected ranges; the attack is network-reachable and needs no privileges or user interaction according to the CVSS v4 vector.
OpenText · Advanced Authentication Server
Research and translation in progress – available shortly.
P-Net, a PROFINET IO stack for embedded industrial field devices, does not release the Application Relationship and RPC session when an RPC request with incorrect endianness is rejected. Repeated requests exhaust the available sessions, and the device stops answering new RPC requests, including Connect, until it is restarted. A remote unauthenticated attacker on the network can cause a denial of service, which can interrupt a production process.
RT-Labs · P-Net
P-Net before 1.0.3, a PROFINET device stack used in industrial I/O devices, dereferences a NULL AR pointer when it handles an implicit read request without a valid AR UUID for a user specific record index. This happens only if the application has registered a read callback. A remote unauthenticated attacker who can reach the device can send such a request and crash it, causing a denial of service. The CVSS 8.7 score is the CNA's; NVD analysis is still pending.
RT-Labs · P-Net
RT-Labs P-Net, a stack for PROFINET device implementations, contains an integer underflow in pf_cpm_c_data_ind(). A crafted short cyclic data frame received while the consumer is in the FRUN or RUN state makes an offset wrap around, so the function reads outside the receive buffer. An attacker on the same network segment without authentication can crash the device (denial of service) or disclose memory content.
RT-Labs · P-Net
The PROFINET stack P-Net before version 1.0.3 does not validate the length of received Ethernet frames in pf_eth_recv() before reading the EtherType, VLAN tags and PROFINET FrameID. The VLAN tag loop has no upper bound, so a truncated frame or a frame containing only VLAN tags makes the function read past the end of the receive buffer. An attacker with layer-2 access to the device's network segment can crash the device (denial of service) or disclose memory content.
RT-Labs · P-Net
P-Net, RT-Labs' embedded Profinet IO device library, dereferences a NULL AR pointer when it handles an implicit read request without a valid target AR UUID for an AR-specific record index or for the expected identification data of a slot or subslot. A remote, unauthenticated attacker who can reach a vulnerable device on the network can send such a request and crash it, causing a denial of service. Only availability is affected, but industrial devices that embed the library may stop until they are restarted.
RT-Labs · P-Net
RT-Labs P-Net, a PROFINET device stack used in embedded industrial devices, contains an out-of-bounds write when parsing AR Vendor Block requests. Only builds with the compile option PNET_OPTION_AR_VENDOR_BLOCKS enabled are affected, and this option is disabled by default. A crafted Connect request sent over the network, without authentication or user interaction, can crash the device (denial of service) and potentially allow arbitrary code execution.
RT-Labs · P-Net
