M3Ssap0

**Name of the Vulnerable Software and Affected Versions** Amministrazione Trasparente plugin for WordPress versions prior to 9.1 **Description** The Amministrazione Trasparente plugin for WordPress is susceptible to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions and above to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This issue only affects multi-site installations and installations where unfiltered html has been disabled. **Recommendations** Update the Amministrazione Trasparente plugin to version 9.1 or later.

**Name of the Vulnerable Software and Affected Versions** The Newsletters plugin for WordPress versions up to, and including, 4.9.9.9 **Description** The issue allows authenticated attackers with Administrator-level access and above to include and execute arbitrary files on the server via the `file` parameter, enabling them to bypass access controls, obtain sensitive data, or achieve code execution. This is particularly concerning in cases where images and other “safe” file types can be uploaded and included. **Recommendations** For The Newsletters plugin for WordPress versions up to, and including, 4.9.9.9, consider disabling the `file` parameter to prevent exploitation until a patch is available. Restrict access to sensitive files and directories to minimize the risk of arbitrary file inclusion. Avoid using the `file` parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WP Attachments plugin for WordPress versions up to, and including, 5.0.12 **Description** The issue is related to Reflected Cross-Site Scripting, which allows unauthenticated attackers to inject arbitrary web scripts in pages. This is possible due to insufficient input sanitization and output escaping of the `attachment id` parameter. Attackers can exploit this by tricking a user into performing an action, such as clicking on a link. **Recommendations** For versions up to, and including, 5.0.12, update to a version later than 5.0.12 to resolve the issue. As a temporary workaround, consider restricting access to the `attachment id` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress versions up to, and including, 8.9.1 **Description** The issue is related to Limited Code Execution due to the unsanitized use of user-supplied input in the `call user func()` function, specifically via the `get table records` function. This allows authenticated attackers with Custom-level access to execute arbitrary PHP functions that meet specific constraints, such as static methods or global functions accepting a single array parameter. **Recommendations** For versions up to, and including, 8.9.1, consider disabling the `get table records` function or restricting access to it until a patch is available. Additionally, limiting the use of the `call user func()` function with user-supplied input can help mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress versions up to, and including, 8.9.1 **Description** The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the `clean html` and `form fields` parameters. This allows authenticated attackers with Custom-level access to inject arbitrary web scripts in pages, which will execute when a user accesses an injected page. **Recommendations** For versions up to, and including, 8.9.1, update to a version higher than 8.9.1 to resolve the issue. As a temporary workaround, consider restricting access to the `clean html` and `form fields` parameters to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cacti version 1.2.24 **Description** The issue is related to insufficient validation of arguments passed to a command in the `lib/snmp.php` file, allowing an authenticated privileged user to perform command injection and obtain remote code execution on the underlying server under certain conditions. The `lib/snmp.php` file has a set of functions that accept input variables and place them into an `exec` call without proper escape or validation. **Recommendations** For Cacti version 1.2.24, upgrade to version 1.2.25 to address the issue. As a temporary workaround, consider restricting access to the `lib/snmp.php` file or disabling the vulnerable functions until a patch is available. Avoid using malicious strings in the SNMP options of a Device to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cacti version 1.2.24 **Description** The issue is related to the use of open redirection in the `auth changepassword.php` component of the Cacti network monitoring software. This can allow a remote attacker to redirect a user to an arbitrary URL. The `auth changepassword.php` file accepts a `ref` URL parameter, which is reflected in the form used to perform the change password operation, and its value is used to perform a redirect via the `header` PHP function. A user can be tricked into performing the change password operation and then interacting with a malicious website, potentially leading to malware downloads or credential provision. **Recommendations** For Cacti version 1.2.24, upgrade to version 1.2.25 to address the issue. As a temporary workaround, consider restricting access to the `auth changepassword.php` file to minimize the risk of exploitation. Avoid using the `ref` parameter in the affected URL until the issue is resolved.