Nir Yehoshua

**Name of the Vulnerable Software and Affected Versions** WPvivid — Backup, Migration & Staging versions prior to 0.9.133 **Description** The backup restoration process fails to properly validate the destination paths of files extracted from a backup package. This creates a Zip Slip condition, which is a type of path-traversal vulnerability where a crafted archive can force files to be written outside the intended restoration directory. High-privilege users, such as administrators, can exploit this to write arbitrary files elsewhere on the server, potentially leading to server-side code execution if executable content is placed in a web-accessible location. **Recommendations** Update to version 0.9.133 or newer. Review users authorized to initiate backup restorations. Inspect recently restored archives and check for files created outside expected WordPress directories. Inspect `wp-content/plugins` and `wp-content/uploads` for unexpected executable files. Review web-server logs related to recent restore operations. Restrict administrative WordPress accounts using multi-factor authentication (MFA).

**Name of the Vulnerable Software and Affected Versions** Eventin versions prior to 4.1.19 **Description** An issue exists where the software does not properly restrict the changes a guest checkout token can authorize on an order. This allows unauthenticated users to mark their own unpaid orders as completed, resulting in the issuance of a valid paid ticket without any payment being processed. The exploitation involves the `order token` variable. **Recommendations** Update to version 4.1.19 or later.

**Name of the Vulnerable Software and Affected Versions** HP Easy Start for macOS versions prior to 2.16.7.260722 **Description** Security flaws exist that could allow an attacker to perform escalation of privilege, which is the act of gaining higher-level permissions than those originally assigned to a user account. **Recommendations** Update to version 2.16.7.260722 or later.

**Name of the Vulnerable Software and Affected Versions** HP Easy Start for macOS versions prior to 2.16.7.260722 **Description** Security flaws exist that could allow an attacker to perform escalation of privilege, which is the act of gaining higher-level permissions than those originally assigned to a user account. **Recommendations** Update to version 2.16.7.260722 or later.

**Name of the Vulnerable Software and Affected Versions** HP Easy Start for macOS versions prior to 2.16.7.260722 **Description** Security flaws exist that could allow an attacker to perform escalation of privilege, which is the act of gaining higher-level permissions than those originally assigned to a user account. **Recommendations** Update to version 2.16.7.260722 or later.

**Name of the Vulnerable Software and Affected Versions** ProSolution WP Client versions prior to 2.0.11 **Description** Insufficient sanitization and escaping of several parameters before they are reflected into HTML attributes on public pages allow for reflected Cross-Site Scripting (XSS). This issue can be triggered against any visitor, including logged-in administrators. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** Update ProSolution WP Client to version 2.0.11 or later.

**Name of the Vulnerable Software and Affected Versions** Cudy WR3000 2.0 versions prior to 2.5.24 **Description** The Mosquitto MQTT broker authentication plugin contains a hard-coded JWT HMAC signing secret. This allows unauthenticated attackers to extract the secret from the firmware image and forge valid JSON Web Tokens (JWT), which are compact, URL-safe means of representing claims to be transferred between two parties. By crafting arbitrary tokens, attackers can authenticate to the MQTT broker without legitimate credentials and gain unauthorized access to the device mesh networking interface. **Recommendations** Update Cudy WR3000 2.0 to firmware version 2.5.24 or later.

**Name of the Vulnerable Software and Affected Versions** Cudy WR3000 2.0 versions prior to 2.5.24 **Description** Authenticated attackers can execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The `sync command` binary forwards this input directly to a shell execution sink in `command.lua`, allowing those with access to the MQTT broker to compromise the system. **Recommendations** Update Cudy WR3000 2.0 to version 2.5.24.

**Name of the Vulnerable Software and Affected Versions** WPvivid — Backup, Migration & Staging WordPress plugin versions prior to 0.9.131 **Description** An issue exists where the plugin fails to sanitize a value from an unauthenticated request used to construct a log file path. An attacker possessing a site-to-site transfer key can exploit this to create a log file in any writable directory of the site, including the web root, via the `send to site connect` endpoint. The attacker controls the file location, although the file name includes a fixed suffix and the content is limited to the plugin's own log header. **Recommendations** Update WPvivid — Backup, Migration & Staging WordPress plugin to version 0.9.131 or later.

**Name of the Vulnerable Software and Affected Versions** ProSolution WP Client versions prior to 2.0.11 **Description** An arbitrary file upload issue exists in the `proSol handleFileUpload()` function. The flaw stems from missing validation of the `Content-Disposition` header filename, which allows an attacker to override the allow-listed multipart filename before the file is saved. Additionally, a post-save extension check fails to delete the file after it has been written to the system. This allows unauthenticated attackers to upload executable files, potentially leading to remote code execution. The nonce required to access the upload handler is publicly exposed via `wp localize script` on any front-end page that renders the job portal shortcode, enabling unauthenticated visitors to bypass the security check. **Recommendations** Update to a version newer than 2.0.10. As a temporary workaround, restrict access to the `proSol handleFileUpload()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** ProSolution WP Client versions prior to 2.0.9 **Description** Insufficient capability checks on two administrative AJAX actions allow any authenticated user, including those with subscriber privileges, to perform unauthorized actions. Because the nonce (a unique token used to prevent cross-site request forgery) is exposed on the public frontend, an attacker can trigger administrative data synchronization and clear activity records via the `proSol ajaxTablesync` and `proSol ajaxClearlog` calls. **Recommendations** Update ProSolution WP Client to version 2.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** OneCompression library version 1.2.0 **Description** An unsafe deserialization issue exists when the library processes a crafted `model.pt` checkpoint file. The function `QuantizedModelLoader.load quantized model pt()` calls `torch.load` with the `weights only` parameter set to `False`, which triggers Python's pickle machinery. This allows an attacker to embed malicious ` reduce ` methods within the checkpoint file to execute arbitrary Python code and system commands when the file is loaded from a directory selected by the caller. **Recommendations** For version 1.2.0, avoid loading checkpoint files from untrusted sources or directories until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ProSolution WP Client versions prior to 2.0.9 **Description** An issue exists where the plugin fails to validate user-supplied URLs and does not verify the requester's capability or nonce before executing a server-side HTTP request. This allows any authenticated user, including those with subscriber-level privileges, to perform Server-Side Request Forgery (SSRF)—a technique where the server is coerced into making requests to internal hosts and services. The attacker can specify the HTTP method, headers, and body for these requests via the `proSol url validate()` function. **Recommendations** Update ProSolution WP Client to version 2.0.9 or later.

**Name of the Vulnerable Software and Affected Versions** ProSolution WP Client versions prior to 2.0.9 **Description** An issue exists where a cookie value is not sanitized before being used in SQL queries. This cookie is processed on every request without authentication or capability checks, allowing unauthenticated users to read arbitrary data from the database and delete records stored by the plugin. The vulnerable component is the `removesite` cookie. **Recommendations** Update ProSolution WP Client to version 2.0.9 or later. As a temporary mitigation, restrict or block the use of the `removesite` cookie.

Name of the Vulnerable Software and Affected Versions: Bosch IP Helper versions prior to 1.00.0008 Description: The issue allows an attacker to execute arbitrary code on a victim's system by loading a DLL through an uncontrolled search path element. This can happen if the victim is tricked into placing a malicious DLL in the same application directory as the portable IP Helper application. Recommendations: For versions prior to 1.00.0008, update to a version that contains a fix for this issue to prevent arbitrary code execution. As a temporary workaround, consider restricting access to the application directory to minimize the risk of exploitation.