Nhien Pham

The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL Path in all versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable when the [mpg spintax] shortcode is rendered in site-wide content such as a footer or template part, as the vulnerable code path is only reached when the shortcode is active on the requested page.

**Name of the Vulnerable Software and Affected Versions** Pods – Custom Content Types and Fields versions prior to 3.3.9.1 **Description** The Pods – Custom Content Types and Fields plugin for WordPress contains a privilege escalation flaw allowing unauthenticated attackers to gain Administrator privileges or overwrite any user account password, including the site owner's, leading to complete site takeover. The issue resides in the `pods admin` AJAX router, which handles security checks such as method allowlists, nonce verification, login enforcement, and capability gates through the `pods error()` function. Under the JSON `meta-box-loader` compatibility path, `pods error()` only logs failures to the PHP error log and returns false without terminating the request, allowing execution to continue to privileged API methods such as `save user()`. Over 100,000 active installations are potentially affected, and real-world incidents have been reported where attackers added unauthorized administrator users to websites. **Recommendations** Update the plugin to version 3.3.9.1 or the corresponding patched versions for older branches: 2.8.23.4, 2.9.19.4, 3.0.10.4, 3.1.4.2, or 3.2.8.3.

**Name of the Vulnerable Software and Affected Versions** TrueBooker – Appointment Booking and Scheduler System versions prior to 1.2.4 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. This flaw allows unauthenticated attackers to change the password of any user account, including those with administrator privileges, potentially leading to full account takeover. **Recommendations** Update the plugin to a version later than 1.2.3.

**Name of the Vulnerable Software and Affected Versions** CubeWP Framework versions prior to 1.1.31 **Description** The CubeWP Framework plugin for WordPress contains a Directory Traversal flaw within the `cubewp get svg content()` function. This issue allows unauthenticated attackers to read arbitrary files from the server, potentially exposing sensitive information. The flaw is exploitable because the required nonce is publicly emitted in the markup of pages using the CubeWP posts shortcode or widget with AJAX loading enabled, allowing guest visitors to harvest it before sending the AJAX request via the `prev icon` or `next icon` parameters. **Recommendations** Update the plugin to a version later than 1.1.30. As a temporary mitigation, disable AJAX loading for CubeWP posts shortcodes or widgets to prevent the public emission of the nonce.

**Name of the Vulnerable Software and Affected Versions** Web Directory Free versions prior to 1.7.14 **Description** The Web Directory Free plugin for WordPress contains a generic SQL Injection flaw. This issue occurs because the software fails to properly escape user-supplied input and lacks sufficient preparation of the SQL query. Unauthenticated attackers can exploit this by appending malicious SQL queries via the `levels` parameter to extract sensitive information from the database. **Recommendations** Update the plugin to a version newer than 1.7.13. As a temporary mitigation, restrict or disable the use of the `levels` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Microsoft Dynamics 365 Business Central (affected versions not specified) **Description** Weak authentication procedures allow an authorized attacker to elevate privileges locally. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Apache Airflow Providers Snowflake versions prior to 6.4.0 Description: The issue is related to a Failure to Sanitize Special Elements into a Different Plane, also known as Special Element Injection vulnerability. This vulnerability affects the CopyFromExternalStageToSnowflakeOperator, where sanitation of table and stage parameters was added to prevent SQL injection. Recommendations: For versions prior to 6.4.0, upgrade to version 6.4.0, which fixes the issue. As a temporary workaround, consider adding sanitation to the `table` and `stage` parameters in the `CopyFromExternalStageToSnowflakeOperator` to prevent SQL injection.

**Name of the Vulnerable Software and Affected Versions** Post SMTP plugin for WordPress versions up to and including 3.1.2 **Description** The issue allows authenticated attackers with Administrator-level access and above to perform generic SQL Injection via the `columns` parameter due to insufficient escaping and lack of preparation on the existing SQL query. This enables attackers to append additional SQL queries to extract sensitive information from the database. **Recommendations** For Post SMTP plugin for WordPress versions up to and including 3.1.2, consider updating to a version that includes a fix for this issue, as no specific workaround is provided for these versions. As a temporary mitigation measure, restrict access to the `columns` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP Job Portal plugin for WordPress versions up to, and including, 2.2.2 **Description** The issue is related to SQL Injection via the `page id` parameter of the `wpjobportal deactivate()` function due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This allows authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. **Recommendations** For versions up to, and including, 2.2.2, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the `wpjobportal deactivate()` function until a patch is available. Avoid using the `page id` parameter in the affected function until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Apache Airflow version 2.10.0 Description: The issue allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. This is related to the example DAG `example inlet event extra.py` shipped with Apache Airflow. It is recommended to review DAGs based on this example and to avoid exposing example DAGs in deployments. Recommendations: For Apache Airflow version 2.10.0, upgrade to version 2.10.1 or later to resolve the issue. If you must expose the example DAGs, consider upgrading as the primary mitigation measure. As a temporary workaround, consider restricting access to the example DAGs until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8110 Description: The issue is related to the file auditing configuration, where the lack of protection of the SQL query structure allows for authenticated SQL injection. This can enable a remote attacker to execute custom queries and gain access to database table records. Recommendations: For versions below 8110, update to a version 8110 or later to resolve the authenticated SQL injection issue in the file auditing configuration. As a temporary workaround, consider restricting access to the file auditing configuration to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8110 Description: The issue is related to a lack of protection in the SQL query structure, which can be exploited to execute custom queries and gain access to database table records. This is an authenticated SQL Injection vulnerability in the attack surface analyzer's export option. Recommendations: For versions below 8110, update to a version above 8110 to resolve the issue. As a temporary workaround, consider restricting access to the attack surface analyzer's export option until a patch is available. Avoid using the export option in the attack surface analyzer until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8110 Description: The issue is related to a lack of protection of the SQL query structure in the Windows Active Directory management and reporting tool. This can allow a remote attacker to execute custom queries and gain access to database table records. The vulnerability is associated with an authenticated SQL Injection in the attack surface analyzer's dashboard. Recommendations: For Zohocorp ManageEngine ADAudit Plus versions below 8110, update to a version 8110 or later to resolve the issue. As a temporary workaround, consider restricting access to the attack surface analyzer's dashboard until a patch is available. Avoid using the vulnerable SQL query structure in the dashboard until the issue is resolved. At the moment, there is no other information about additional mitigation measures.

**Name of the Vulnerable Software and Affected Versions** Zoho ManageEngine ADAudit Plus versions through 7250 **Description** The issue is related to SQL Injection in the report export option. **Recommendations** For Zoho ManageEngine ADAudit Plus versions through 7250, update to a version later than 7250 to resolve the SQL Injection issue in the report export option.

**Name of the Vulnerable Software and Affected Versions** Zoho ManageEngine ADAudit Plus versions through 7250 **Description** The issue allows SQL Injection in the aggregate report feature. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited. **Recommendations** For versions through 7250, update to a version later than 7250 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zoho ManageEngine ADSelfService Plus versions below 6401 **Description** The issue is related to an uncontrolled resource consumption in the password reset software, which can be exploited by a remote attacker to cause a denial of service. The vulnerability is caused by malicious LDAP input, allowing an attacker to disrupt the service. **Recommendations** For Zoho ManageEngine ADSelfService Plus versions below 6401, consider restricting access to the LDAP functionality until a patch is available. As a temporary workaround, avoid using the vulnerable LDAP query functionality in the affected software until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.