Qdtad

**Name of the Vulnerable Software and Affected Versions** Novalnet Payment Gateway for WooCommerce versions prior to 12.10.4 **Description** The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, allowing an attacker to inject a PHP Object. While no native POP chain (a sequence of gadgets used to achieve code execution) is present in the software, the presence of a POP chain in other installed plugins or themes could enable an unauthenticated attacker to execute code, retrieve sensitive data, or delete arbitrary files. **Recommendations** Update to a version newer than 12.10.3.

**Name of the Vulnerable Software and Affected Versions** 워드프레스 결제 심플페이 versions prior to 5.5.7 **Description** An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database, potentially allowing them to view data they are not normally able to retrieve. **Recommendations** Update 워드프레스 결제 심플페이 to version 5.5.7 or later.

**Name of the Vulnerable Software and Affected Versions** Vitepos versions prior to 3.4.3 **Description** The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress allows unauthenticated attackers to extract sensitive user or configuration data due to sensitive information exposure. **Recommendations** Update to a version newer than 3.4.2.