Cyberkareem

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks.

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId to read report layouts and configurations or delete dashboard grid arrangements across tenants.

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DNS-rebinding protection. Attackers can make the OpenPanel server issue requests to internal services, localhost, and cloud metadata endpoints, reading internal HTTP response titles, headers, status codes, and SSL certificate information.

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the victim's browser on the API origin, enabling same-origin credentialed requests to authenticated endpoints.

**Name of the Vulnerable Software and Affected Versions** WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.133 **Description** Administrators can perform SQL injection attacks because the plugin fails to sanitize a user-supplied list of identifiers before incorporating them into a SQL query. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or manipulation of the database. **Recommendations** Update the plugin to version 0.9.133 or later.

**Name of the Vulnerable Software and Affected Versions** TypeBot versions prior to 3.18.0 **Description** An issue exists where an authenticated non-guest workspace member can remove a public custom domain belonging to another workspace, rendering the chatbots on that domain unavailable. The custom-domain delete handler in `handleDeleteCustomDomain.ts` authorizes the caller based on a client-supplied `workspaceId` but transmits the client-supplied domain name to the shared Vercel project before verifying if the domain actually belongs to the specified workspace. **Recommendations** Update to version 3.18.0.

**Name of the Vulnerable Software and Affected Versions** grav-plugin-login versions prior to 3.8.11 **Description** A cross-site request forgery (CSRF) issue exists in the `login.regenerate2FASecret` frontend task. The system regenerates and persists a new Time-based One-Time Password (TOTP) secret for the authenticated session user without implementing an anti-CSRF nonce or Origin/Referer checks. Since the Grav core dispatches the task via the `task:` URI parameter and the default session cookie uses SameSite=Lax, an attacker can trick a logged-in user into visiting a malicious off-site page. This action triggers a top-level GET navigation that rotates the user's TOTP secret, causing the enrolled authenticator to mismatch the server and forcing the user to re-enroll in two-factor authentication (2FA). This issue does not affect sites configured with `session.samesite: Strict`. **Recommendations** Update grav-plugin-login to version 3.8.11 or later. Configure `session.samesite` to `Strict` to prevent the exploitation of this issue.

**Name of the Vulnerable Software and Affected Versions** Grav Flex-Objects versions prior to 1.4.3 **Description** Broken access control exists in the 'admin-next' REST API. Authenticated users possessing only `api.access` permission can perform unauthorized CRUD (Create, Read, Update, Delete) operations and export objects from directories that lack an explicit permissions configuration, thereby bypassing authorization controls. **Recommendations** Update Grav Flex-Objects to version 1.4.3 or later.

**Name of the Vulnerable Software and Affected Versions** grav-plugin-api versions prior to 1.0.6 **Description** The software fails to validate super-admin status across the 'createApiKey', 'generate2fa', and 'disable2fa' endpoints. This allows users with `api.users.write` permissions who are not super-admins to escalate their privileges to super-admin status. An attacker can exploit this to create API keys linked to super-admin accounts or remove two-factor authentication (2FA) from super-admin users, leading to a complete instance takeover. **Recommendations** Update grav-plugin-api to version 1.0.6 or later.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions 9.0.0 through 9.10.0-alpha.1 Parse Server versions 8.x through 8.6.83 **Description** A stored cross-site scripting (XSS) issue exists when the software fails to recognize an uploaded file's extension via the mime package, leading it to preserve the client-supplied Content-Type. A malformed Content-Type that does not follow a valid type/subtype media type format (for example, 'image', 'image/', or 'image//svg+xml') can bypass the `fileUpload.fileExtensions` blocklist and be stored without modification. When using storage adapters that persist and serve the uploaded Content-Type, such as Amazon S3, Google Cloud Storage, or Azure Blob Storage, browsers may fail to parse the malformed value and perform MIME-sniffing. This allows a file starting with HTML to be rendered as HTML, executing embedded scripts in the application's origin against users who access the file URL. The default GridFS storage adapter is not affected. **Recommendations** Update to version 9.10.0-alpha.2 or later. Update to version 8.6.84 or later.