Shirshak

**Name of the Vulnerable Software and Affected Versions** Autonomy Logic OpenPLC version 3 **Description** An improper neutralization of input during web page generation occurs in the web interface when routing programs based on a query string parameter that is not encoded. This cross-site scripting (XSS) flaw allows attackers to steal session cookies and hijack operator sessions, enabling them to issue commands and gain control over programmable logic controllers and connected physical processes. The issue is present in systems deployed across critical manufacturing, energy, transportation, and water/wastewater sectors. Attackers may use this to pivot across operational technology (OT) networks via unencrypted east-west traffic flows. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Implement runtime segmentation to contain lateral movement within industrial environments.

**Name of the Vulnerable Software and Affected Versions** Schema & Structured Data for WP & AMP versions prior to 1.66 **Description** Insufficient authorization checks during schema generation allow users with the contributor role or higher to access the content of posts they are not permitted to edit. This includes draft, pending, private, and password-protected posts created by other users. **Recommendations** Update to version 1.66 or later.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS WordPress plugin versions prior to 4.0.8 **Description** The plugin fails to verify if a user has the necessary permissions to access a course before returning the lesson discussion content. This allows any authenticated user, including those with subscriber roles, to read comments from courses in which they are not enrolled, including those awaiting moderation. **Recommendations** Update the plugin to version 4.0.8 or later.