0Xbassia

Reflected Cross-Site Scripting (XSS) occurs when the plugin fails to escape the current page URL before outputting it within a JavaScript context on an admin page. This allows an attacker to execute malicious scripts in the browser of high-privilege users.

A Server-Side Request Forgery (SSRF) issue exists in the webhooks feature. This allows staff users to probe internal hosts from the Ghost server. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

A server-side request forgery (SSRF) issue exists in the webhooks feature. This allows users with staff privileges to craft requests that enable the Ghost server to probe and access internal network resources.

The plugin fails to properly validate uploaded files by relying on a client-supplied content type and preserving the original filename. This allows unauthenticated attackers to upload arbitrary PHP files and execute code on the server.

The plugin fails to perform capability, ownership, or nonce checks before updating WooCommerce order item metadata. This allows any authenticated user, including those with subscriber-level access, to tamper with the custom metadata of orders belonging to other customers. The issue stems from a missing capability check within a function.

The plugin fails to verify a user's password during the authentication process. This allows unauthenticated attackers to log in as any registered user, including those with administrator privileges, by providing only the user's email address, leading to privilege escalation.

The plugin fails to perform authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments. This allows unauthenticated attackers to disclose sensitive order and attachment data belonging to other customers.

The plugin fails to verify the password before issuing an authenticated session for a supplied email address in an unauthenticated action. This allows unauthenticated attackers to log in as any registered user, including administrators, or to create arbitrary new accounts, leading to privilege escalation.

Insufficient input sanitization and output escaping allow authenticated users, including those with subscriber-level access, to perform Stored Cross-Site Scripting (XSS). The plugin fails to perform capability, ownership, or nonce checks before saving popup configuration to a product. This allows an attacker to store JavaScript that executes in the browser of visitors viewing the affected product.

The plugin fails to keep the one-time login code confidential. It returns the code and a valid verification token in the response of an unauthenticated action. This allows unauthenticated attackers to log in as any user, including administrators, provided they know the registered mobile number, or to create arbitrary accounts.

An unauthenticated media-proxying endpoint fails to validate the destination of server-side requests. This allows anonymous users to force the site to fetch arbitrary URLs, including internal and private-network addresses, and read the response body. This issue leads to a full-read Server-Side Request Forgery (SSRF), where the server is coerced into making requests to an unintended location, and creates an open proxy.

An unauthenticated site-info endpoint fails to validate the destination of server-side requests. This allows anonymous users to perform Server-Side Request Forgery (SSRF), a technique where an attacker induces a server-side application to make requests to an unintended location. By leveraging a gating nonce exposed on public pages, attackers can force the site to request internal and private-network URLs and retrieve the parsed page metadata.

The plugin fails to verify user capabilities within its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the intended media type of the endpoint. This allows unauthenticated users to upload any file type supported by the WordPress media library through endpoints that are specifically intended to accept only images or videos.

Public shared-view endpoints expose values from columns that the view owner had hidden through three independent paths. First, the `groupBy` function returns raw values for any column named in the request. Second, filter and sort arrays operate on hidden columns, enabling boolean-blind extraction (a technique used to infer data by observing the application's response to true or false queries). Third, the related-data list accepts arbitrary link-column IDs from other tables within the same base. This allows anyone with a shared-view UUID to enumerate hidden-column values, confirm hidden-column values by observing row counts, or read records from unrelated tables in the same base without authentication.

The MagicForm WordPress plugin fails to properly validate file types uploaded via an unauthenticated AJAX action. This occurs when a form's per-field extension allowlist is left empty, enabling unauthenticated attackers to upload PHP files and execute arbitrary code on the server.

The software fails to filter ` proto `, `constructor`, or `prototype` when converting FormData to objects using bracket-notation form keys. An attacker can submit a single HTTP form field with a name starting with ` proto [...]` to mutate `Object.prototype`, leading to prototype pollution across the entire Node.js process. This occurs within the `treatInitial()` and `treatSecond()` functions in `index.cjs`. This issue can be exploited to bypass security checks, inject configuration values, disrupt template rendering, or cause a denial of service by crashing the worker process.

The `parseFormData()` function processes bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. An attacker can use a FormData field name that begins with ` proto ` or contains `. proto .` mid-path to cause the parser to traverse onto `Object.prototype` and assign properties there. This results in prototype pollution, where the prototype chain of every plain object in the running process is contaminated. The issue resides in the `handlePathPart()` function within `src/index.ts`, which fails to reject reserved keys during object-type path segment processing. This can lead to corrupted application state, altered control flow, or denial of service in applications that process attacker-controlled FormData, such as HTTP servers.

Prototype pollution occurs when property paths contain ` proto `, `constructor`, or `prototype`. This issue arises when property paths are exposed as user input, allowing an attacker to modify the prototype of base object classes.

The `setPath` function in `@rvf/set-get` (used by `@rvf/core` to flatten incoming form data into a nested object) fails to block the keys ` proto `, `constructor`, or `prototype` when walking a path. Because field names in submitted form data are passed directly to `setPath` via `preprocessFormData` (and through `parseFormData` or `validate`), an attacker can set arbitrary properties on `Object.prototype` of the running server process. This is a prototype pollution primitive—a condition where an attacker can manipulate the prototype of base objects to change the behavior of the application—that is reachable by default without special configuration. Any endpoint that accepts a form via `parseFormData` or runs a validator created with `createValidator()` is affected. This can lead to bypassing security checks, injecting unintended configuration values, breaking template rendering, or causing a denial of service by crashing the worker process.