Texuguinho1234

The `spreadAttributes` function in the server-side rendering pipeline iterates over object keys and passes them to the `addAttribute()` function, which interpolates the key into the HTML output without escaping. When a developer uses the spread syntax `{...props}` on an HTML element and the object keys originate from untrusted sources such as APIs, CMS, or URL parameters, an attacker can inject arbitrary HTML attributes. This includes event handlers like `onmousemove` and `onclick`, or breaking out of the attribute context to inject new elements, leading to cross-site scripting (XSS).

An issue exists in the DataGrid component where authenticated users can extract database contents. Attackers can perform time-based blind SQL injection—a technique used to infer data by observing the time the server takes to respond to specific queries—by injecting malicious SQL via the `sortDirection` parameter in the 'ajax/getDataGridPager.php' endpoint.

GitPython is a Python library used to interact with Git repositories. The ` clone()` function validates the `multi options` variable as an original list but then executes `shlex.split(" ".join(multi options))`. This allows a string that starts with a safe option, such as `--branch`, to pass validation while containing unsafe options like `--config core.hooksPath=/x`. After the split operation, the unsafe option becomes a separate token that Git applies, potentially leading to the execution of attacker-controlled hooks during the clone process. This issue also affects `Submodule.update()` via `clone multi options`. The vulnerability occurs when applications pass user-controlled input to `clone from()`, `clone()`, or `Submodule.update()`.

An issue exists in the performance and fault management framework where improper handling of deserialized data leads to SQL Injection. In the 'managers.php' file, the application processes the `selected graphs array` variable using a custom unserialize function. While object injection is prevented, arbitrary string arrays can still be deserialized. These values are subsequently passed to the `db execute()` function and merged into a SQL DELETE statement via an implode operation without integer validation. This allows for SQL Injection when utilizing SNMP agent management permissions.

Wazuh is a free and open source platform used for threat prevention, detection, and response. A Remote Code Execution (RCE) issue exists due to the deserialization of untrusted data within the cluster synchronization protocol. This affects deployments using cluster mode (master/worker architecture). An attacker who gains access to a worker node—via initial access, insider threats, or supply chain attacks—can achieve full RCE on the master node with root privileges by sending a specially crafted DAPI request. The issue involves the `as wazuh object()` function, unsafe reflective object loading, and implicit cluster trust assumptions, allowing for Python runtime abuse and dynamic import exploitation.