Christiaan Swiers

**Name of the Vulnerable Software and Affected Versions** Hibernate (affected versions not specified) **Description** A flaw exists in Hibernate that allows a remote attacker with low privileges to exploit a second-order SQL injection. The issue occurs when specially crafted, unsanitized non-alphanumeric characters are provided in the ID column while using the `InlineIdsOrClauseBuilder`. Successful exploitation could lead to sensitive information disclosure, including the ability to read system files, and allow for data manipulation or deletion within the application's database, potentially resulting in an application-level denial of service. A second-order SQL injection occurs when an application receives data from a trusted source but does not properly sanitize it before using it in a database query. The `InlineIdsOrClauseBuilder` is a component used to construct SQL queries. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vuetify versions 2.0.0 through 2.9.9 **Description** A flaw exists in the 'VDatePicker' component of Vuetify that allows unsanitized HTML to be inserted into a webpage. This is due to the improper handling of the 'title-date-format' property, which can accept a user-defined function and assign its output to the 'innerHTML' property of the title element without proper sanitization. This can lead to a Cross-Site Scripting (XSS) attack. The `title-date-format` property is vulnerable. Version 2.x of Vuetify is End-of-Life and will not receive updates to address this issue. **Recommendations** Versions 2.0.0 through 2.9.9 are affected and will not receive updates. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Vuetify versions 2.2.0-beta.2 through 3.0.0-alpha.10 **Description** The Preset configuration feature of Vuetify is susceptible to Prototype Pollution due to the 'mergeDeep' utility function used for merging options with defaults. A specially crafted, malicious preset can pollute JavaScript objects with arbitrary properties, potentially impacting application behavior. This could lead to resource exhaustion, denial of service, or unauthorized data access. If the application uses Server-Side Rendering (SSR), the vulnerability could affect the entire server process. **Recommendations** Versions 2.2.0-beta.2 through 2.x are End-of-Life and will not receive updates. Versions 2.2.0-beta.2 through 3.0.0-alpha.9 should be updated.

**Name of the Vulnerable Software and Affected Versions** AIOSEO Broken Link Checker Plugin versions up to 1.2.3 **Description** The issue is related to a sql injection vulnerability in the orderBy parameter of the AIOSEO Broken Link Checker Plugin on WordPress. **Recommendations** For AIOSEO Broken Link Checker Plugin versions up to 1.2.3, update to a version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** WP SMTP plugin for WordPress versions 1.2 to 1.2.6 **Description** The issue allows authenticated attackers with administrator-level access and above to perform SQL Injection via the `search` parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. This enables attackers to append additional SQL queries into already existing queries, potentially extracting sensitive information from the database. **Recommendations** For WP SMTP plugin for WordPress versions 1.2 to 1.2.6, consider restricting access to the `search` parameter to minimize the risk of exploitation until a patch is available. Avoid using the `search` parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Smart Slider 3 plugin for WordPress versions up to, and including, 3.5.1.22 **Description** The issue arises from a missing capability check on the upload function, allowing authenticated attackers with contributor-level access and above to upload files, including SVG files. This can be used to conduct stored cross-site scripting attacks. **Recommendations** For versions up to, and including, 3.5.1.22, update to a version higher than 3.5.1.22 to resolve the issue. As a temporary workaround, consider restricting access to the upload function to prevent unauthorized file uploads until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Booster Elite for WooCommerce plugin for WordPress versions up to, and including, 7.1.7 **Description** The issue arises from missing file type validation in the `wc add new product()` function, allowing arbitrary file uploads. This could potentially lead to remote code execution when the user product upload functionality is enabled, exploitable by customer-level attackers and above. **Recommendations** For versions up to, and including, 7.1.7, update to a version newer than 7.1.7 to resolve the issue. As a temporary workaround, consider disabling the user product upload functionality until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Ultimate Member versions 2.1.3 through 2.8.2 **Description** The issue is related to a SQL injection vulnerability in the Ultimate Member plugin for WordPress. This vulnerability can be exploited by unauthenticated attackers to append additional SQL queries to existing ones, potentially allowing them to extract sensitive information from the database. The vulnerability is caused by insufficient escaping on user-supplied parameters and a lack of sufficient preparation on existing SQL queries. It is estimated that over 200,000 websites are potentially affected by this issue. There have been reports of attempts to exploit this vulnerability, highlighting the need for prompt action to secure affected sites. **Recommendations** To resolve the issue, update the Ultimate Member plugin to version 2.8.3 or later. This update addresses the SQL injection vulnerability and helps prevent data breaches. Additionally, consider implementing two-factor authentication and using strong passwords to further enhance security. Regularly updating plugins and themes is also crucial in maintaining the security of WordPress sites.

**Name of the Vulnerable Software and Affected Versions** WordPress Database Administrator plugin versions 1.0.3 and earlier **Description** The issue is related to a SQL injection problem. It occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement via an AJAX action. This AJAX action is available to unauthenticated users, making it accessible to remote attackers. The exploitation of this issue can allow an attacker to execute arbitrary SQL queries. **Recommendations** For WordPress Database Administrator plugin versions 1.0.3 and earlier, as a temporary workaround, consider disabling the AJAX action related to the SQL query until a patch is available. Restrict access to the plugin's functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Export All URLs WordPress plugin versions prior to 4.6 **Description** The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a `parameter` is not properly sanitised and escaped before being outputted back in the page. This could be exploited against high-privilege users, such as admins. **Recommendations** For versions prior to 4.6, update to version 4.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation. Avoid using the vulnerable `parameter` in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Better Search Replace WordPress plugin versions prior to 1.4.1 **Description** The issue concerns the improper sanitization and escaping of table data before it is inserted into a SQL query. This could allow high privilege users to perform SQL Injection attacks. **Recommendations** For versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue.