Intelligence
Explorer.

Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions.

Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.0 versions.

Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR mode and stores the key tag, the IV and the ciphertext with no MAC. decrypt/2 checks only the key tag and the minimum length before it returns the plaintext, and Cloak.Ciphers.Deprecated.AES.CTR decrypts the legacy format the same way. CTR is a stream cipher, so a value XORed into the stored ciphertext is XORed into the plaintext at the same offset. An attacker who can write to the encrypted store (for example through SQL injection or a compromised replica) and who knows or can guess a stored plaintext can replace it with any value of the same length. The application receives that value with no error. This issue affects cloak: from 0.1.0-pre onward.

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.

Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured. This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0.

Unauthenticated Broken Access Control in The7 <= 14.2.2 versions.

Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.

SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.

Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.7.1 versions.

Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Social Rocket <= 1.3.5 versions.

Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions.

Subscriber SQL Injection in UDesign Core <= 4.15.0 versions.

Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions.

Subscriber SQL Injection in ListingPro <= 2.9.12 versions.

Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions.

Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.

Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.