L0Gs3C

**Name of the Vulnerable Software and Affected Versions** TypeSquare Webfonts for ConoHa versions prior to 2.0.5 **Description** The plugin fails to properly verify if a user is authorized to perform specific actions, leading to an authorization bypass. Authenticated attackers with subscriber-level access or higher can modify site-wide font settings by submitting a POST request to any 'wp-admin' page. The affected settings include the `typesquare auth` option (`fontThemeUseType`), `show post form`, and `typesquare fonttheme`. Additionally, when `fontThemeUseType` is set to 1 or 3, the lack of nonce verification—a unique token used to prevent duplicate or forged requests—makes these branches susceptible to cross-site request forgery. **Recommendations** Update to a version later than 2.0.4.

**Name of the Vulnerable Software and Affected Versions** WeGIA versions 3.5.4 and below **Description** WeGIA is a web manager for institutions, primarily for Portuguese language users. The application does not properly validate and sanitize user inputs in the `id categoria` parameter of the `/html/matPat/editar categoria.php` endpoint, allowing attackers to inject malicious SQL payloads for direct execution. This could lead to complete system compromise, requiring administrative privileges for exploitation. **Recommendations** Update to version 3.5.5 or later.