0Xbassia

**Name of the Vulnerable Software and Affected Versions** Fediverse Embeds WordPress plugin versions prior to 1.5.8 **Description** An unauthenticated site-info endpoint fails to validate the destination of server-side requests. This allows anonymous users to perform Server-Side Request Forgery (SSRF), a technique where an attacker induces a server-side application to make requests to an unintended location. By leveraging a gating nonce exposed on public pages, attackers can force the site to request internal and private-network URLs and retrieve the parsed page metadata. **Recommendations** Update Fediverse Embeds WordPress plugin to version 1.5.8 or later.

**Name of the Vulnerable Software and Affected Versions** Fediverse Embeds WordPress plugin versions prior to 1.5.8 **Description** An unauthenticated media-proxying endpoint fails to validate the destination of server-side requests. This allows anonymous users to force the site to fetch arbitrary URLs, including internal and private-network addresses, and read the response body. This issue leads to a full-read Server-Side Request Forgery (SSRF), where the server is coerced into making requests to an unintended location, and creates an open proxy. **Recommendations** Update Fediverse Embeds WordPress plugin to version 1.5.8 or later.

**Name of the Vulnerable Software and Affected Versions** MagicForm versions prior to 0.1.4 **Description** The MagicForm WordPress plugin fails to properly validate file types uploaded via an unauthenticated AJAX action. This occurs when a form's per-field extension allowlist is left empty, enabling unauthenticated attackers to upload PHP files and execute arbitrary code on the server. **Recommendations** Update to a version later than 0.1.3.

**Name of the Vulnerable Software and Affected Versions** Schema & Structured Data for WP & AMP versions prior to 1.60 **Description** The plugin fails to verify user capabilities within its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the intended media type of the endpoint. This allows unauthenticated users to upload any file type supported by the WordPress media library through endpoints that are specifically intended to accept only images or videos. **Recommendations** Update to version 1.60 or later.

**Name of the Vulnerable Software and Affected Versions** NocoDB versions prior to 2026.04.1 **Description** Public shared-view endpoints expose values from columns that the view owner had hidden through three independent paths. First, the `groupBy` function returns raw values for any column named in the request. Second, filter and sort arrays operate on hidden columns, enabling boolean-blind extraction (a technique used to infer data by observing the application's response to true or false queries). Third, the related-data list accepts arbitrary link-column IDs from other tables within the same base. This allows anyone with a shared-view UUID to enumerate hidden-column values, confirm hidden-column values by observing row counts, or read records from unrelated tables in the same base without authentication. **Recommendations** Update to version 2026.04.1.

**Name of the Vulnerable Software and Affected Versions** parse-nested-form-data versions prior to 1.0.1 **Description** The `parseFormData()` function processes bracket and dot-notation FormData field names into nested objects without filtering reserved property keys. An attacker can use a FormData field name that begins with ` proto ` or contains `. proto .` mid-path to cause the parser to traverse onto `Object.prototype` and assign properties there. This results in prototype pollution, where the prototype chain of every plain object in the running process is contaminated. The issue resides in the `handlePathPart()` function within `src/index.ts`, which fails to reject reserved keys during object-type path segment processing. This can lead to corrupted application state, altered control flow, or denial of service in applications that process attacker-controlled FormData, such as HTTP servers. **Recommendations** Update to version 1.0.1. As a temporary workaround, validate field names to ensure they do not contain ` proto `, `constructor`, or `prototype` before calling the `parseFormData()` function.

**Name of the Vulnerable Software and Affected Versions** form-data-objectizer versions prior to 1.0.1 **Description** The software fails to filter ` proto `, `constructor`, or `prototype` when converting FormData to objects using bracket-notation form keys. An attacker can submit a single HTTP form field with a name starting with ` proto [...]` to mutate `Object.prototype`, leading to prototype pollution across the entire Node.js process. This occurs within the `treatInitial()` and `treatSecond()` functions in `index.cjs`. This issue can be exploited to bypass security checks, inject configuration values, disrupt template rendering, or cause a denial of service by crashing the worker process. **Recommendations** Update to version 1.0.1.

**Name of the Vulnerable Software and Affected Versions** deepobj versions prior to 1.0.3 **Description** Prototype pollution occurs when property paths contain ` proto `, `constructor`, or `prototype`. This issue arises when property paths are exposed as user input, allowing an attacker to modify the prototype of base object classes. **Recommendations** Update to version 1.0.3.

**Name of the Vulnerable Software and Affected Versions** RVF versions 6.0.0 through 6.0.3 RVF versions 7.0.0 through 7.0.1 **Description** The `setPath` function in `@rvf/set-get` (used by `@rvf/core` to flatten incoming form data into a nested object) fails to block the keys ` proto `, `constructor`, or `prototype` when walking a path. Because field names in submitted form data are passed directly to `setPath` via `preprocessFormData` (and through `parseFormData` or `validate`), an attacker can set arbitrary properties on `Object.prototype` of the running server process. This is a prototype pollution primitive—a condition where an attacker can manipulate the prototype of base objects to change the behavior of the application—that is reachable by default without special configuration. Any endpoint that accepts a form via `parseFormData` or runs a validator created with `createValidator()` is affected. This can lead to bypassing security checks, injecting unintended configuration values, breaking template rendering, or causing a denial of service by crashing the worker process. **Recommendations** Update RVF versions 6.0.0 through 6.0.3 to version 6.0.4. Update RVF versions 7.0.0 through 7.0.1 to version 7.0.2.