Leo Trinh

Nagios XI is affected by a remote command execution issue in the WinRM Configuration Wizard. A lack of proper input validation allows an authenticated administrator to inject shell metacharacters into backend command invocations. Successful exploitation can lead to arbitrary command execution with the privileges of the Nagios XI web application user. The vulnerable component is the WinRM Configuration Wizard. The issue involves insufficient validation of user-supplied input.

The FluentSMTP plugin for WordPress is vulnerable to PHP Object Injection via deserialization of untrusted input in the `formatResult` function. This allows unauthenticated attackers to inject a PHP object. No known POP chain is present in the vulnerable software, but if a POP chain is present via an additional plugin or theme, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. The vulnerability was partially patched in version 2.2.82. Over 300,000 WordPress sites are potentially exposed to this issue.

The issue is caused by a missing capability check on the `update metadata` function, allowing unauthenticated attackers to insert new and update existing metadata beginning with `rank math`, and delete arbitrary existing user metadata and term metadata. This can lead to a loss of access to the administrator dashboard for any registered users, including Administrators.

The issue is related to PHP Object Injection via deserialization of untrusted input in the `set redirections` function. This allows authenticated attackers with Administrator-level access and above to inject a PHP Object. No known POP chain is present in the vulnerable software, but if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Name of the Vulnerable Software and Affected Versions: Code Embed plugin for WordPress versions up to, and including, 2.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's script embed functionality due to insufficient restrictions on who can utilize the functionality. This allows authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Recommendations: For Code Embed plugin for WordPress versions up to, and including, 2.4: Update to the latest patched version as soon as possible to mitigate the risk of exploitation. Additionally, consider monitoring for signs of compromise.

The issue is related to time-based SQL Injection via the `order` parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers, with GiveWP Manager-level access and above, to append additional SQL queries into already existing queries within the Legacy View mode, which can be used to extract sensitive information from the database.