Threat briefs

Codeastro Internet Banking System 2.0.0 contains a stored XSS vulnerability in the pages_add_acc_type.php component that allows authenticated attackers to inject malicious JavaScript, potentially leading to session hijacking.

Node Version Manager (nvm) versions 0.31.2 through 0.40.5 are vulnerable to command injection via malicious version strings due to improper sanitization in the nvm_ls function when invoked with tools like nvm use or automated shell hooks.

The Schema App Structured Data plugin for WordPress through version 2.3.2 is vulnerable to stored cross-site scripting due to insufficient sanitization of comment content when the 'Remove Microdata' feature is active.

The Divi Form Builder plugin for WordPress, in versions up to and including 5.1.8, is vulnerable to arbitrary file upload leading to remote code execution due to insufficient file extension validation where user-supplied input is interpolated into a regular expression, allowing unauthenticated attackers to bypass .htaccess protections with specific PHP-executable extensions and upload malicious PHP files to the /wp-content/uploads/de_fb_uploads/ directory for remote execution, particularly on Nginx-based servers where .htaccess is ineffective.

Veeam has released security updates for multiple products, including Veeam Agent for Linux, Veeam Backup and Replication, Veeam Backup for Microsoft 365, and Veeam ONE, to address undisclosed vulnerabilities.

The Labstack Echo web framework Proxy middleware incorrectly establishes a raw tunnel for WebSocket upgrades before validating upstream responses, allowing subsequent HTTP requests to bypass route-level authentication and authorization.

Happy DOM versions up to 20.14.6 are vulnerable to SSRF because they allow default external resource fetching for iframe and link stylesheet elements during untrusted HTML parsing.

An integer overflow vulnerability (CVE-2025-48595) in the Android Framework allows for local code execution, potentially leading to privilege escalation on affected Android devices by a locally present attacker.

Tenda NVR_4H firmware version V27.5.58.6 contains a hardcoded ECDSA private key and self-signed certificate in the read-only partition, enabling full TLS session interception via man-in-the-middle attacks.

EPICS Base versions 7.0.10 and earlier contain multiple critical vulnerabilities in network request processing that could allow unauthenticated remote attackers to cause denial-of-service, disclose memory contents, or execute arbitrary code.

Authenticated MailWatch users can perform unauthorized release or deletion of arbitrary quarantined messages across all domains due to an insufficient ownership check in the quarantine action endpoint.

The DSGVO All in one for WP plugin for WordPress is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of comment content when specific integration settings are enabled.

The Food Store - Online Food Delivery & Pickup WordPress plugin version 1.5.5 and earlier contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts into administrative panels via the service_type cookie.

The Social Web Suite WordPress plugin (up to 4.1.12) is vulnerable to unauthenticated SQL injection via the exclude_posts parameter and an authentication bypass due to insecure default HMAC secret key handling.

The Wild Apricot Login plugin for WordPress (<= 1.0.18) is vulnerable to authentication bypass where attackers can hijack administrative sessions by binding malicious WildApricot accounts to existing WordPress user emails via insecure SSO account mapping.

An authorization bypass vulnerability in the /nodered endpoint of FUXA 1.3.2-2809 allows unauthenticated attackers to execute arbitrary code via specially crafted HTTP requests.

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to unauthenticated account takeover due to missing permission checks and signature validation in its REST API and authentication endpoints.

CVE-2025-0133 is a reflected Cross-Site Scripting vulnerability in PAN-OS GlobalProtect portal and gateway login pages that allows arbitrary JavaScript execution via the user query parameter.

Detection of unauthorized child process creation by the Windows UAC consent.exe binary, a common indicator of UAC bypass and privilege escalation activity.

Itech-gmbh Ilabclient version 3.7.1 stores credentials in cleartext within an Apache Derby database, allowing local attackers to extract configuration data via the ij tool.

OliveTin versions prior to 3000.11.1 are vulnerable to unauthenticated remote code execution via insecure guest configurations and lack of input validation for action arguments.

Exploitation of CVE-2023-4966, known as Citrix Bleed, allows unauthorized data disclosure via the /oauth/idp/.well-known/openid-configuration endpoint, leading to session token theft and potential unauthorized access.

Authenticated attackers with administrator-level privileges can exploit an arbitrary file upload vulnerability (CVE-2026-7537) in the MDJM Event Management plugin for WordPress (versions <= 1.7.8.3) via the `mdjm_send_comm_email` function due to lack of file validation, enabling remote code execution.

The `rmcp` crate before v1.4.0 is vulnerable to DNS rebinding attacks via the Streamable HTTP server transport due to missing Host header validation, potentially allowing arbitrary code execution on a victim's machine if they visit a malicious website.

The Eniture LTL Freight Quotes - Old Dominion Edition WordPress plugin (versions 4.2.10 and below) is vulnerable to unauthenticated SQL injection via the 'edit_id' and 'dropship_edit_id' parameters. Public exploit code is available on Sploitus.

python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations.

A weakness in the D-Link DIR-505 (version 1.10B02) Web Management CGI component allows for remote backdoor creation via argument manipulation.

CVE-2024-51791 is an unauthenticated arbitrary file upload vulnerability in the Made I.T. Forms WordPress plugin allowing remote code execution via a PHP web shell.

PowerJob Server 5.1.2 uses a predictable algorithm to generate JWT signing keys, allowing unauthenticated attackers to forge tokens and achieve full administrative account takeover or OpenAPI authentication bypass.

An unauthenticated SQL injection vulnerability in TI WooCommerce Wishlist versions 2.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the order parameter, facilitating potential database compromise and sensitive data exposure.