Vivien Lebas

**Name of the Vulnerable Software and Affected Versions** User Profile Builder WordPress plugin versions prior to 4.0.1 **Description** Insufficient validation of deserialized data occurs when importing a configuration file, which allows high privilege users, such as administrators, to perform PHP Object Injection. PHP Object Injection is a technique where an attacker leverages the way a programming language handles objects to execute unauthorized code or manipulate application logic. This issue resides in a free add-on that is disabled by default. Because no POP chain (a sequence of gadgets used to achieve code execution) exists within the plugin itself, exploitation requires a suitable gadget from another installed component. **Recommendations** Update User Profile Builder WordPress plugin to version 4.0.1 or later. As a temporary mitigation, ensure the free add-on used for importing configuration files remains disabled.

**Name of the Vulnerable Software and Affected Versions** PaperCut NG/MF (affected versions not specified) **Description** The login component fails to properly restrict excessive authentication attempts. This allows an unauthenticated remote attacker to conduct unrestricted brute-force or credential-stuffing attacks, as account lockout and rate-limiting mechanisms may not be triggered in certain configurations. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PaperCut NG/MF (affected versions not specified) **Description** An observable timing discrepancy exists in the authentication component. An unauthenticated remote attacker can perform username enumeration by measuring response times during login attempts. This occurs because the system only executes a password hash comparison when a valid account is supplied, creating a timing oracle—a side-channel attack where the time taken to process a request reveals information about the internal state of the system—that confirms whether an account exists. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.