Vulnerabilidades

Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET…

Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST…

Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped authorization checks and access…

Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MStore API: from n/a through 4.18.4.

Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions.

The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user.

Incorrect Privilege Assignment vulnerability in Jetmonsters JetFormBuilder allows Privilege Escalation. This issue affects JetFormBuilder: from n/a through 3.6.1.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.

Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Profile Builder Pro <= 3.15.0 versions.

Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.

Inclusión local de ficheros no autenticada en versiones de Quirky menor o igual a 1.23.

Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Configure to Order.…

Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.

Subscriber SQL Injection in Taskbuilder <= 5.0.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.

MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, the team join endpoint (POST /multi-juicer/api/teams/{team}/join) accepted requests with any Content-Type, including text/plain. Because that content type…

Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.

Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8.

Quick.CMS deserializa datos controlados por el usuario recibidos a través de HTTP en texto plano sin garantizar la integridad o la autenticidad. Esto permite a los atacantes manipular cargas útiles serializadas en tránsito e inyectar objetos maliciosos. Debido a que la deserialización se realiza sin una validación…

El plugin de WordPress Form Builder CP anterior a la versión 1.2.47 no sanea correctamente un valor de configuración de formulario antes de almacenarlo y usarlo como parte de una ejecución de script del lado del cliente, permitiendo a usuarios autenticados con acceso de nivel Editor o superior realizar ataques de…

Se ha descubierto una falla de seguridad en Ruijie EG105G-P 2.340. El elemento afectado es la función nslookup del archivo /cgi-bin/luci/API/diagnose del componente JSON-RPC Diagnose Endpoint. Realizar una manipulación del argumento params.target resulta en inyección de comandos. Es posible iniciar el ataque de forma…