Denver Jackson

**Name of the Vulnerable Software and Affected Versions** ThumbPress versions prior to 6.3.2 **Description** Missing authorization allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version newer than 6.3.2.

**Name of the Vulnerable Software and Affected Versions** Frisbii Pay versions prior to 1.8.3 **Description** An issue exists that allows a user with Contributor privileges to escalate their privileges within the system. **Recommendations** Update to a version newer than 1.8.2.

**Name of the Vulnerable Software and Affected Versions** SingleMalt versions prior to 1.6 **Description** An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when user-supplied input is passed to the `unserialize()` function without proper validation, potentially allowing an attacker to manipulate the application logic or execute arbitrary code. **Recommendations** Update to a version newer than 1.5.

**Name of the Vulnerable Software and Affected Versions** Château versions prior to 1.2.2 **Description** Unauthenticated PHP Object Injection occurs in the software. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into a PHP application, which can lead to unauthorized code execution or other security breaches. **Recommendations** Update to a version newer than 1.2.1.

**Name of the Vulnerable Software and Affected Versions** ShiftUp versions 1.3 and earlier **Description** An unauthenticated PHP Object Injection issue exists in the software. PHP Object Injection occurs when user-supplied input is passed to the `unserialize()` function without proper validation, potentially allowing an attacker to manipulate the application logic or execute arbitrary code. **Recommendations** Disable or isolate the software immediately. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zoya versions prior to 1.5 **Description** Unauthenticated PHP Object Injection occurs in the Zoya WordPress theme. PHP Object Injection is a vulnerability that allows an attacker to pass malicious serialized objects into the application, which can lead to unauthorized code execution or other critical impacts. **Recommendations** Update to a version later than 1.4.

**Name of the Vulnerable Software and Affected Versions** Léonie versions prior to 1.2.2 **Description** Unauthenticated PHP Object Injection occurs in the Léonie WordPress theme. PHP Object Injection is a vulnerability that allows an attacker to pass malicious serialized objects into the application, which can lead to unauthorized code execution or other critical impacts. **Recommendations** Update to a version newer than 1.2.1.

**Name of the Vulnerable Software and Affected Versions** Ashtanga versions prior to 1.3 **Description** Unauthenticated PHP Object Injection occurs in the Ashtanga theme. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into the application, which can lead to unauthorized code execution or other critical system compromises. **Recommendations** Update to a version later than 1.2.

**Name of the Vulnerable Software and Affected Versions** Behold versions prior to 1.6 **Description** Unauthenticated PHP Object Injection occurs in the Behold theme. PHP Object Injection is a vulnerability that allows an attacker to pass specially crafted data to the application, which is then unserialized, potentially leading to unauthorized code execution or other malicious actions. **Recommendations** Update to a version newer than 1.5.

**Name of the Vulnerable Software and Affected Versions** Micdrop versions prior to 1.3.2 **Description** Unauthenticated PHP Object Injection occurs in the Micdrop theme. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into the application, which can lead to unauthorized code execution or other critical system compromises. **Recommendations** Update to a version newer than 1.3.1.

**Name of the Vulnerable Software and Affected Versions** Laurits versions prior to 1.5.2 **Description** Unauthenticated PHP Object Injection occurs in the Laurits theme. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into a PHP application, which can lead to unauthorized code execution or other critical system compromises. **Recommendations** Update to a version newer than 1.5.1.

**Name of the Vulnerable Software and Affected Versions** Esmée versions prior to 1.5 **Description** Unauthenticated PHP Object Injection occurs in the Esmée theme. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into a PHP application, which can lead to unauthorized code execution or other critical system compromises. **Recommendations** Update to a version newer than 1.4.

**Name of the Vulnerable Software and Affected Versions** TechLink versions prior to 1.4 **Description** Unauthenticated PHP Object Injection occurs in the software. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into a PHP application, which can lead to unauthorized code execution or other security breaches. **Recommendations** Update to a version later than 1.3.

**Name of the Vulnerable Software and Affected Versions** Roisin versions prior to 1.5 **Description** Unauthenticated PHP Object Injection occurs in the software. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into a PHP application, which can lead to unauthorized code execution or other security breaches. **Recommendations** Update to a version later than 1.4.

**Name of the Vulnerable Software and Affected Versions** LuxeDrive versions prior to 1.5 **Description** Unauthenticated PHP Object Injection occurs in the LuxeDrive theme. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into the application, which can lead to unauthorized code execution or other critical system compromises. **Recommendations** Update to a version later than 1.4.

**Name of the Vulnerable Software and Affected Versions** Valeska versions prior to 1.2.3 **Description** Unauthenticated PHP Object Injection occurs in the Valeska theme. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into the application, which can lead to unauthorized code execution or other critical system compromises. **Recommendations** Update to a version newer than 1.2.2.

**Name of the Vulnerable Software and Affected Versions** Elated-Themes Aperitif versions prior to 1.7 **Description** Untrusted data deserialization in the software allows for object injection. This occurs when the application fails to properly validate or sanitize data before deserializing it, enabling an attacker to inject malicious objects into the application logic. **Recommendations** Update Elated-Themes Aperitif to version 1.7 or later.

**Name of the Vulnerable Software and Affected Versions** Töbel versions prior to 1.8.2 **Description** Untrusted data deserialization in the software allows for object injection. Object injection occurs when an application deserializes a malicious object, potentially leading to arbitrary code execution or other unauthorized actions. **Recommendations** Update to a version newer than 1.8.1.

**Name of the Vulnerable Software and Affected Versions** Askka versions prior to 1.3.1 **Description** Deserialization of untrusted data in Elated-Themes Askka allows Object Injection, a technique where an attacker can manipulate serialized objects to execute arbitrary code or interfere with application logic. **Recommendations** Update to a version later than 1.3.1.

**Name of the Vulnerable Software and Affected Versions** Charity Zone versions prior to 1.1.2 **Description** The Charity Zone theme for WordPress allows authenticated attackers with Subscriber-level access and above to upload arbitrary files to the server. This issue occurs due to missing file type validation, which could potentially lead to remote code execution. **Recommendations** Update Charity Zone to version 1.1.2 or later.