Trong Pham

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level access. This allows such users to inject arbitrary newline-delimited Apache directives into the root .htaccess file. On Apache servers that honour PHP directives, the injection can be chained with the user's own media upload (a polyglot image carrying a PHP payload) and an auto prepend file directive to achieve Remote Code Execution.

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

**Name of the Vulnerable Software and Affected Versions** Avada Builder (fusion-builder) versions prior to 3.15.3 **Description** Unauthenticated remote code execution is possible via PHP Function Injection. The issue occurs because the `wp conditional tags` case in the `Fusion Builder Conditional Render Helper::get value()` function passes attacker-controlled values from a base64-decoded JSON blob directly to `call user func()` without allowlist validation. This can be exploited through the 'fusion get widget markup' AJAX endpoint, which is registered for unauthenticated users via `wp ajax nopriv fusion get widget markup`. Although the endpoint is protected by a nonce `fusion load nonce`, this value is generated for user ID 0 and is deterministically exposed in the JavaScript output of any public page containing a Post Cards (`[fusion post cards]`) or Table of Contents (`[fusion table of contents]`) element. **Recommendations** Update the plugin to a version later than 3.15.2. As a temporary workaround, restrict access to the 'fusion get widget markup' AJAX endpoint or remove Post Cards and Table of Contents elements from public-facing pages to prevent the exposure of the `fusion load nonce`.

**Name of the Vulnerable Software and Affected Versions** CraftCMS version 3.8.1 **Description** The issue allows a remote attacker to execute arbitrary code via a crafted script to the `Section` parameter. This enables the attacker to potentially gain control over the system, allowing for unauthorized actions. **Recommendations** For CraftCMS version 3.8.1, consider disabling access to the `Section` parameter until a patch is available. As a temporary workaround, restrict the ability to execute scripts via this parameter to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SmartVista SVFE2 version 2.2.22 **Description** The issue is a SQL injection vulnerability. It can be exploited via the `UserForm:j id90` parameter at the "/SVFE2/pages/feegroups/mcc group.jsf" endpoint. **Recommendations** For SmartVista SVFE2 version 2.2.22, consider restricting access to the vulnerable endpoint "/SVFE2/pages/feegroups/mcc group.jsf" to minimize the risk of exploitation. Avoid using the `UserForm:j id90` parameter in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SmartVista SVFE2 version 2.2.22 **Description** A SQL injection issue was found in SmartVista SVFE2, specifically via the `voiceAudit:j id97` parameter at the "/SVFE2/pages/audit/voiceaudit.jsf" endpoint. This allows for potential exploitation. **Recommendations** For SmartVista SVFE2 version 2.2.22, consider restricting access to the `/SVFE2/pages/audit/voiceaudit.jsf` endpoint until a patch is available. As a temporary workaround, avoid using the `voiceAudit:j id97` parameter in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** SmartVista SVFE2 version 2.2.22 **Description** A SQL injection issue was found in SmartVista SVFE2. The issue is related to the `UserForm:j id88`, `UserForm:j id90`, and `UserForm:j id92` parameters at the "/SVFE2/pages/feegroups/country group.jsf" endpoint. **Recommendations** For SmartVista SVFE2 version 2.2.22, as a temporary workaround, consider restricting access to the vulnerable parameters `UserForm:j id88`, `UserForm:j id90`, and `UserForm:j id92` in the "/SVFE2/pages/feegroups/country group.jsf" endpoint until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.