Martino Spagnuolo

The HTTP/3 parser fails to verify that the received body length aligns with a previously announced content-length when a stream is closed using a frame with an empty payload. This discrepancy can lead to desynchronization between the proxy and the backend server, potentially enabling request smuggling, which is a technique used to interfere with the way a website processes sequences of HTTP requests.

A Server-Side Request Forgery (SSRF) issue exists in MailerPress. This allows for Server Side Request Forgery. The vulnerability affects the `mailerpress` component.

A Server-Side Request Forgery (SSRF) vulnerability exists in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One. This issue allows Server Side Request Forgery.

A missing authorization flaw exists in DesertThemes SoftMe, allowing exploitation due to incorrectly configured access control security levels.

The software contains a missing authorization flaw due to incorrectly configured access control security levels.

An improper validation of the specified quantity in input exists in Bonus for Woo, potentially allowing access to functionality not properly constrained by Access Control Lists (ACLs).

This issue is a Cross-Site Request Forgery (CSRF) vulnerability that allows Object Injection.

Name of the Vulnerable Software and Affected Versions: ameliabooking Booking System Trafft versions through 1.0.14 Description: The Booking System Trafft software contains a Stored Cross-site Scripting (XSS) issue. This occurs due to improper neutralization of input during web page generation. Recommendations: Update ameliabooking Booking System Trafft to a version later than 1.0.14.

The Employee Directory – Staff Listing & Team Directory Plugin for WordPress is susceptible to object injection due to deserialization of untrusted data. This issue allows for potential code execution.

Deserialization of untrusted data in the software allows for object injection.

The software contains a deserialization of untrusted data issue, which allows for object injection.

An improper control of generation of code ('Code Injection') vulnerability exists in emarket-design YouTube Showcase, allowing Object Injection.

Deserialization of untrusted data in WP Easy Contact allows for object injection.

Name of the Vulnerable Software and Affected Versions: CubeWP Framework versions n/a through 1.1.24 Description: An incorrect privilege assignment issue exists in CubeWP Framework, allowing for privilege escalation. Recommendations: Update CubeWP Framework to a version later than 1.1.24.

Name of the Vulnerable Software and Affected Versions: StoryMap versions through 2.1 Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in StoryMap, which also allows for SQL Injection. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Infility Global versions through 2.14.7 Description: This issue involves an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability, in Infility Global. The vulnerability allows Path Traversal. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Made IT Forms versions not specified through 2.9.0 Description: An unrestricted file upload issue with dangerous file types exists in Made IT Forms, allowing for the upload of a web shell to a web server. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: miniOrange Prevent files / folders access versions n/a through 2.6.0 Description: A path traversal vulnerability exists in miniOrange Prevent files / folders access, allowing attackers to traverse file paths. This issue allows path traversal within the application. Recommendations: Update miniOrange Prevent files / folders access to a version later than 2.6.0.

Name of the Vulnerable Software and Affected Versions: DELUCKS SEO versions through 2.6.0 Description: An incorrect privilege assignment issue exists in DELUCKS SEO, allowing for privilege escalation. Recommendations: Update DELUCKS SEO to a version later than 2.6.0.

Name of the Vulnerable Software and Affected Versions: BuddyPress XProfile Custom Image Field versions through 3.0.1 Description: This issue involves an improper limitation of a pathname to a restricted directory, also known as a path traversal. This allows an attacker to access restricted directories. Recommendations: Update BuddyPress XProfile Custom Image Field to a version later than 3.0.1.