Maksim Hayder

Insufficiently protected credentials in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

An incorrect authorization issue allows forceful browsing and an access bypass. This allows an attacker to update entity fields without the system verifying field-level access. This action requires the attacker to already possess permissions to update the entity itself.

Insufficient session invalidation allows revoked users to maintain access to known private uploaded files by using a stale visit token.

An authentication bypass exists in the reaction API endpoint. The system fails to enforce content visibility controls, which allows unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.

An issue exists where the connection reuse key does not include the binding when `CURLOPT INTERFACE` (or the `--interface` command line option) is configured with prefixes such as `if!`, `host!`, or `ifhost!`. This allows a subsequent transfer requesting a different source to silently reuse an existing connection, resulting in the traffic originating from the source address of the previous transfer.

Improper neutralization of special elements used in a template engine allows code injection. The module fails to sufficiently separate field content from template code during the rendering of linked field output. Depending on the installed Twig extensions, this can be used to expose site configuration values, including sensitive data such as credentials or API keys. Exploitation requires the attacker to possess a role with permissions to create or edit content in a field where Linked Field is enabled in the display settings.

This module implements a client-side accessibility checker that automatically reports results to dashboard views via an API. A privilege escalation issue exists because a permission was incorrectly described as a view permission, while it actually grants edit and delete access to module data, leading to a potential access bypass.

On Multisite installations, a missing authorization issue exists within the `tml ms signup handler()` function. Specifically, the `gimmeanotherblog` branch fails to enforce the network's `active signup` registration policy, verifying only if the user is logged in via `is user logged in()`. This allows authenticated attackers with Subscriber-level access or higher to send a POST request with the parameter `stage=gimmeanotherblog` to the signup route. This action bypasses the registration policy and triggers `wpmu create blog()`, resulting in the attacker being assigned the Administrator role on the newly created subsite through `add user to blog()`. The privilege escalation is limited to the new subsite; the attacker does not gain Super Admin or network-level capabilities such as `manage network` or `manage sites` on the main site.