Sam Pizzey

**Name of the Vulnerable Software and Affected Versions** Marimer LLC CSLA .Net versions prior to 8.0 Marimer LLC CSLA .Net version 5.5.4 and earlier **Description** A Directory Traversal vulnerability allows a remote attacker to execute arbitrary code via a crafted script to the `MobileFormatter` component. This issue enables a remote attacker to potentially access and manipulate files on the server. **Recommendations** For Marimer LLC CSLA .Net versions prior to 5.5.4, update to version 5.5.4 or later to resolve the issue. For Marimer LLC CSLA .Net versions 6.x and 7.x, apply the available fix commits to resolve the issue. For Marimer LLC CSLA .Net version 8.0 and later, no action is required as these versions are not affected by this issue.

**Name of the Vulnerable Software and Affected Versions** Better Search Replace plugin for WordPress versions up to, and including, 1.4.4 **Description** The issue is related to PHP Object Injection via deserialization of untrusted input, allowing unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. Approximately 1 million sites are impacted. Over 2,500 attacks targeting this issue have been reported in the past 24 hours. **Recommendations** For versions up to, and including, 1.4.4, update to version 1.4.5 to resolve the issue. As a temporary workaround, consider restricting access to the plugin to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** wp-slimstat (aka Slimstat Analytics) versions prior to 4.1.6.1 **Description** The issue allows for XSS attacks through either an HTTP Referer header or a field associated with JavaScript-based Referer tracking. **Recommendations** For versions prior to 4.1.6.1, update to version 4.1.6.1 or later to resolve the issue.