Snicco

**Name of the Vulnerable Software and Affected Versions** WP 2FA versions through 2.6.3 **Description** The issue affects the WP 2FA plugin, allowing insertion of sensitive information into log files. This enables accessing functionality not properly constrained by Access Control Lists (ACLs). **Recommendations** For WP 2FA versions through 2.6.3, update to a version later than 2.6.3 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Solid Security versions prior to 9.3.1 **Description** The issue affects Solid Security, allowing for an HTTP Denial of Service (DoS) due to the use of a less trusted source vulnerability. **Recommendations** For versions prior to 9.3.1, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Cwicly versions 1.4.0.2 and earlier **Description** The issue is related to improper control of code generation, allowing code injection. This means that an attacker could potentially inject malicious code into the system. **Recommendations** For versions 1.4.0.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Soflyy Oxygen Builder versions prior to 4.9 **Description** The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which allows code injection in Soflyy Oxygen Builder. This is a critical issue that can be remotely exploited. The vendor has been reported to be ignoring the issue and refusing to patch it. **Recommendations** For versions prior to 4.9, update to a newer version as soon as possible to mitigate the risk. As a temporary workaround, consider restricting access to the vulnerable component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Soflyy Breakdance versions 1.7.2 and earlier **Description** The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which allows for code injection in Soflyy Breakdance. **Recommendations** For Soflyy Breakdance versions 1.7.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Bricks Builder versions 1.9.6 and earlier **Description** A critical remote code execution vulnerability in Bricks Builder, a WordPress site builder, allows unauthenticated attackers to execute arbitrary PHP code on vulnerable installations. This issue affects over 25,000 websites and is being actively exploited by threat actors. The vulnerability is caused by improper control of code generation, enabling attackers to run malicious PHP code on susceptible installations. **Recommendations** For Bricks Builder version 1.9.6 and earlier: Update to version 1.9.6.1 or later to mitigate the risk of remote code execution. As a temporary workaround, consider disabling any vulnerable functions or modules in Bricks Builder until a patch is available. Restrict access to the Bricks Builder plugin to minimize the risk of exploitation. Avoid using any potentially vulnerable parameters or variables in the Bricks Builder plugin until the issue is resolved. Apply additional security measures, such as installing security plugins like Wordfence or Sucuri, using strong passwords, and regularly backing up the website.