Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ex-Themes WP Timeline – Vertical and Horizontal timeline plugin wp-timelines.This issue affects WP Timeline – Vertical and Horizontal timeline plugin: from n/a through <= 3.6.7. CVSSv3.1 8.1 (HIGH)
Unrestricted Upload of File with Dangerous Type vulnerability in Bit Apps Bit Form bit-form.This issue affects Bit Form: from n/a through <= 2.13.10. CVSSv3.1 8.0 (HIGH)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in abcapp ABCApp Creator abcapp-creator.This issue affects ABCApp Creator: from n/a through <= 1.1.2. CVSSv3.1 8.1 (HIGH)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vmax Studio Vmax Project Manager vmax-project-manager allows PHP Local File Inclusion.This issue affects Vmax Project Manager: from n/a through <= 1.0. CVSSv3.1 9.6 (CRITICAL)
The Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serves as a proxy to the end user's primary network. The WPA2-PSK generation of this dedicated network is flawed and solely based on the serial number. Due to the flawed generation process, the WPA2-PSK can be brute forced offline within seconds. This vulnerability allows an attacker in proximity to the dedicated wireless network to gain unauthorized access to th CVSSv3.1 8.2 (HIGH) · EPSS 20th percentile
Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function. CVSSv3.1 8.0 (HIGH) · EPSS 51th percentile
The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the /includes/ajax-functions.php file all versions up to, and including, 1.6.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple administrative actions, such as replying to arbitrary tickets, updating the status of any pos CVSSv3.1 8.1 (HIGH)
The UltraPress theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, r CVSSv3.1 8.8 (HIGH)
Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype. CVSSv3.1 8.2 (HIGH) · EPSS 47th percentile
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same CVSSv3.1 9.8 (CRITICAL)
Elastic Security Labs published a comprehensive analysis of the CUPS printing system vulnerability chain (CVE-2024-47176/47076/47175/47177) disclosed by Simone Margaritelli on September 26, 2024. The vulnerabilities allow unauthenticated remote code execution via malicious IPP/mDNS advertisements targeting cups-browsed on UNIX systems; exploitation requires user interaction to trigger a print job but chains with a 13-year-old unpatched foomatic-rip command-injection flaw. Elastic provided five detection rules and PoC analysis demonstrating reverse shell execution as the lp user, with over 75,000 CUPS instances exposed on the public internet.
In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc The grc must be initialize first. There can be a condition where if fou is NULL, goto out will be executed and grc would be used uninitialized. CVSSv3.1 9.8 (CRITICAL) · EPSS 2th percentile
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item There is no links_num in struct snd_soc_acpi_mach {}, and we test !link->num_adr as a condition to end the loop in hda_sdw_machine_select(). So an empty item in struct snd_soc_acpi_link_adr array is required. CVSSv3.1 8.0 (HIGH)
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: Fix uaf in __timer_delete_sync There are two paths to access mptcp_pm_del_add_timer, result in a race condition: CPU1 CPU2 ==== ==== net_rx_action napi_poll netlink_sendmsg __napi_poll netlink_unicast process_backlog netlink_unicast_kernel __netif_receive_skb CVSSv3.1 8.1 (HIGH)
In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap: Fix use-after-free error in kunit test This is a clear use-after-free error. We remove it, and rely on checking the return code of vcap_del_rule. CVSSv3.1 8.4 (HIGH)
In the Linux kernel, the following vulnerability has been resolved: kunit/overflow: Fix UB in overflow_allocation_test The 'device_name' array doesn't exist out of the 'overflow_allocation_test' function scope. However, it is being used as a driver name when calling 'kunit_driver_create' from 'kunit_device_register'. It produces the kernel panic with KASAN enabled. Since this variable is used in one place only, remove it and pass the device name into kunit_device_register CVSSv3.1 8.4 (HIGH)
Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking. This issue affects ValeApp: before v2.0.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 48th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oceanic Software ValeApp allows SQL Injection. This issue affects ValeApp: before v2.0.0. CVSSv3.1 9.8 (CRITICAL) · EPSS 24th percentile
Elastic Security Labs disclosed REF6138, a sophisticated Linux malware campaign exploiting Apache2 web servers to deploy KAIJI (DDoS) and RUDEDEVIL (cryptominer) malware families. The attackers established persistence via GSOCKET, Telegram C2 channels, and cron jobs, while conducting cryptocurrency mining and potential money laundering through gambling APIs. Active malware development was confirmed through a file server hosting daily RUDEDEVIL samples with evolving hashes.
Incorrect Authorization vulnerability in National Keep Cyber Security Services CyberMath allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects CyberMath: before CYBM.240816253. CVSSv3.1 9.8 (CRITICAL) · EPSS 27th percentile
Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands. An attacker that has already gained network access could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sign-On Agent or tamper with the agent configuration. This vulnerability cannot be used by an attacker to gain access to user CVSSv3.1 9.1 (CRITICAL) · EPSS 41th percentile
An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to forge communications to affected components. In the event an attacker has already gained network access, they could exploit this vulnerability to retrieve authenticated usernames and group memberships from the Single Sig CVSSv3.1 9.1 (CRITICAL) · EPSS 60th percentile
The REST API TO MiniProgram plugin for WordPress is vulnerable to privilege escalation via account takeovr in all versions up to, and including, 4.7.1 via the updateUserInfo() due to missing validation on the 'openid' user controlled key that determines what user will be updated. This makes it possible for unauthenticated attackers to update arbitrary user's accounts, including their email to a @weixin.com email, which can the be leveraged to reset the password of the user's CVSSv3.1 9.8 (CRITICAL)
External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems e-Belediye allows Manipulating Web Input to File System Calls. This issue affects e-Belediye: before 2.0.642. CVSSv3.1 9.8 (CRITICAL) · EPSS 25th percentile
Elastic Security Labs published an in-depth vulnerability research report on the AJCloud IoT ecosystem, which powers Wi-Fi cameras from multiple vendors including Wansview, Faleemi, Galayou, and others. Researchers discovered a critical access-control vulnerability in AJCloud's platform that allows unauthenticated attackers to remotely access and control any camera connected to the platform by manipulating the deviceId parameter in API requests, gaining full access to video/audio streams and camera controls. The research includes hardware teardown, firmware extraction via exposed UART interfaces, reverse engineering of the Windows desktop app, P2P protocol analysis, and a proof-of-concept exploit demonstrating trivial exploitation across all AJCloud-connected devices.