Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Osoft Paint Production Management allows SQL Injection.This issue affects Paint Production Management: before 2.1. CVSSv3.1 9.8 (CRITICAL) · EPSS 19th percentile
Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation.This issue affects Bookreen: before 3.0.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 27th percentile
Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter. CVSSv3.1 9.8 (CRITICAL) · EPSS 49th percentile
The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for subscribers or higher to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 8.8 (HIGH) · EPSS 60th percentile
The WP Project Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.6.4 due to insufficient restriction on the 'save_users_map_name' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'usernames' parameter. CVSSv3.1 8.8 (HIGH) · EPSS 24th percentile
The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.7.7. This is due to insufficient verification on the user being supplied during a Stripe checkout through the plugin. This allows unauthenticated attackers to log in as users who have orders, who are typically customers. CVSSv3.1 9.8 (CRITICAL) · EPSS 51th percentile
The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with contributor-level privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an unauthenticated remote attacker to generate an anonymous session. This allows them to transmit HTTP requests to unauthorized endpoints. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August CVSSv3.1 8.2 (HIGH) · EPSS 100th percentile
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, CVSSv3.1 9.6 (CRITICAL) · EPSS 100th percentile
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface CVSSv3.1 7.5 (HIGH) · EPSS 38th percentile
TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body parameters from end users without sanitizing using server-side logic. It was possible to inject custom SQL commands into the "Student Busing Information" search queries. CVSSv3.1 9.8 (CRITICAL) · EPSS 64th percentile
Assetnote published research on a blind file oracle vulnerability in Flarum that enables attackers to leak arbitrary file contents through a side-channel technique. The vulnerability allows an unauthenticated attacker to infer file existence and exfiltrate sensitive data without direct file access.
A vulnerability has been found in SPA-Cart eCommerce CMS 1.9.0.3. The impacted element is an unknown function of the file /search of the component GET Parameter Handler. Such manipulation of the argument filter[brandid] leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version 1.9.1.4 is sufficient to resolve this issue. You should upgrade the affected component. CVSSv3.1 6.3 (MEDIUM) · EPSS 98th percentile
A flaw has been found in SPA-Cart eCommerce CMS 1.9.0.3. The affected element is an unknown function of the file /search. This manipulation of the argument filter[brandid]/filter[price] causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version 1.9.1.4 is sufficient to fix this issue. It is advisable to upgrade the affected component. CVSSv3.1 3.5 (LOW) · EPSS 99th percentile
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability CVSSv3.1 8.3 (HIGH) · EPSS 77th percentile
Gabriel Landau (Elastic Security Labs) discloses two unpatched zero-day vulnerabilities in Windows (admin-to-PPL and PPL-to-kernel) reported to MSRC in September 2022 that remain unfixed 11+ months later. He releases GodFault and PPLFault as proof-of-concept exploits, and a driverless version of EDRSandBlast that bypasses EDR/AV without requiring vulnerable signed drivers, demonstrating that MSRC's inconsistent policy of blocking vulnerable drivers while refusing to patch admin-to-kernel exploit chains creates a false sense of security.
Netmaker makes networks with WireGuard. A Mass assignment vulnerability was found in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user to escalate privileges to those of an admin user. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. CVSSv3.1 8.8 (HIGH) · EPSS 68th percentile
Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6. If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workar CVSSv3.1 7.5 (HIGH) · EPSS 99th percentile
Elastic Security Labs published an in-depth analysis of BLISTER loader malware's evolution since its 2021 discovery, documenting new capabilities including environmental keying, process instrumentation unhooking, configurable anti-debugging timers, and integration with the MYTHIC C2 framework. The malware continues to evade detection by embedding malicious code in legitimate libraries (notably VLC Media Player), employing updated hashing algorithms, and maintaining low detection rates across antivirus vendors. Recent campaigns in June–August 2023 show active development and deployment targeting victim organizations.
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign file (such as an ordinary .JPG file) and also a folder that has the same name as the benign file, and the contents of the folder (which may include executable content) are processed during an attempt to access only the benign file. This was exploited in the wild in April through Octobe CVSSv3.1 7.8 (HIGH) · EPSS 100th percentile
The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration. CVSSv3.1 9.8 (CRITICAL) · EPSS 48th percentile
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation. CVSSv3.1 9.8 (CRITICAL)
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. CVSSv3.1 9.8 (CRITICAL) · EPSS 86th percentile
An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit. CVSSv3.1 9.8 (CRITICAL) · EPSS 69th percentile