Sanjar Tulkinov

**Name of the Vulnerable Software and Affected Versions** Simple File List WordPress plugin versions prior to 6.3.12 **Description** Unauthenticated users can exploit a lack of validation in the source path of a file-move operation. This allows an attacker to read arbitrary files on the server and relocate critical files outside of the web root, which may result in the disclosure of sensitive information and a complete site takeover. **Recommendations** Update the Simple File List WordPress plugin to version 6.3.12 or later.

The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them.

**Name of the Vulnerable Software and Affected Versions** Appointment Booking Calendar Plugin and Scheduling Plugin versions prior to 1.1.29 **Description** The plugin fails to validate data before passing it to a PHP deserialization function. This allows unauthenticated attackers to inject arbitrary PHP objects. If a suitable gadget chain (a sequence of existing code fragments that can be executed during deserialization) is present on the site, this can be leveraged to achieve remote code execution. **Recommendations** Update the plugin to version 1.1.29 or later.

**Name of the Vulnerable Software and Affected Versions** Koha Community Koha versions 22.11.0 through 22.11.37 Koha Community Koha versions 23.x Koha Community Koha versions 24.0 through 24.11.15 Koha Community Koha versions 25.05.0 through 25.05.10 Koha Community Koha versions 25.11.0 through 25.11.04 Koha Community Koha versions 26.05.0 through 26.05.00 Koha Community Koha versions 26.11.0 through 26.10.99 **Description** An authenticated staff user with the Reports module flag can read arbitrary data from the application database. This occurs when the `Criteria` parameter matches /branchcode/ in the 'reports/catalogue out.pl' endpoint. The issue stems from the `calculate()` function, which concatenates the unmodified `Filter` request parameter directly into a LIKE clause of a SQL statement and executes it via DBI without using bound parameters. This allows for error-based SQL injection, enabling full read access to sensitive tables such as borrowers (containing password hashes, 2FA secrets, and personally identifiable information), borrower password recovery, api keys, and sessions. **Recommendations** Update Koha Community Koha version 22.11.37 to 22.11.38. Update Koha Community Koha versions 23.x to a version where the fix is applied. Update Koha Community Koha versions 24.x to 24.11.16. Update Koha Community Koha versions 25.05.x to 25.05.11. Update Koha Community Koha versions 25.11.x to 25.11.05. Update Koha Community Koha versions 26.05.x to 26.05.01. Update Koha Community Koha versions 26.11.x to 26.11.00.