Jashid Sany

**Name of the Vulnerable Software and Affected Versions** UpdraftPlus: WP Backup & Migration Plugin versions prior to 1.26.7 **Description** Cross-Site Request Forgery (CSRF) occurs when a web application fails to verify that a request was intentionally initiated by the user. The plugin lacks CSRF checks in a backup management action, allowing an attacker to trick a logged-in administrator into restoring an existing backup through a crafted link. This action reverts the site database and files to a previous state. **Recommendations** Update UpdraftPlus: WP Backup & Migration Plugin to version 1.26.7 or later.

**Name of the Vulnerable Software and Affected Versions** AI Engine versions prior to 3.7.2 **Description** The plugin fails to properly confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service. This allows users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host, provided a non-default public API feature is enabled. In other configurations, the issue is reachable by an administrator, which in multisite environments allows a non-super subsite administrator to read network-shared configuration and secrets via the `url` parameter. **Recommendations** Update AI Engine to version 3.7.2 or later. As a temporary mitigation, disable the non-default public API feature to prevent subscriber-level access to this issue. Avoid using the `url` parameter in the affected functionality until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ECS WordPress plugin versions prior to 4.3.8 **Description** An issue exists where the plugin fails to verify post status or user capabilities when rendering an Elementor document via AJAX actions. This allows unauthenticated users to retrieve the rendered content of unpublished documents, such as those marked as private, draft, or pending, by providing the document identifier. **Recommendations** Update the ECS WordPress plugin to version 4.3.8 or later.

**Name of the Vulnerable Software and Affected Versions** CactusViewer version 2.3.0 **Description** A DLL hijacking issue in CactusViewer allows attackers to escalate privileges and execute arbitrary code by using a crafted DLL. DLL hijacking is a technique where an application is tricked into loading a malicious dynamic-link library (DLL) instead of the intended one. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** openlabs docker-wkhtmltopdf-aas versions prior to commit 9f50579 **Description** An OS command injection flaw exists in the `app.py` component. This issue allows attackers to execute arbitrary system commands by sending a specially crafted POST request. **Recommendations** Update openlabs docker-wkhtmltopdf-aas to a version beyond commit 9f50579.