Denver Jackson

**Name of the Vulnerable Software and Affected Versions** ThumbPress versions prior to 6.3.2 **Description** Missing authorization allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version newer than 6.3.2.

**Name of the Vulnerable Software and Affected Versions** Frisbii Pay versions prior to 1.8.3 **Description** An issue exists that allows a user with Contributor privileges to escalate their privileges within the system. **Recommendations** Update to a version newer than 1.8.2.

Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.

**Name of the Vulnerable Software and Affected Versions** Château versions prior to 1.2.2 **Description** Unauthenticated PHP Object Injection occurs in the software. PHP Object Injection is a vulnerability that allows an attacker to inject malicious objects into a PHP application, which can lead to unauthorized code execution or other security breaches. **Recommendations** Update to a version newer than 1.2.1.

Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions.

Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.

Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

Subscriber Arbitrary File Upload in Webenvo <= 0.0.6 versions.

**Name of the Vulnerable Software and Affected Versions** ShiftUp versions 1.3 and earlier **Description** An unauthenticated PHP Object Injection issue exists in the software. PHP Object Injection occurs when user-supplied input is passed to the `unserialize()` function without proper validation, potentially allowing an attacker to manipulate the application logic or execute arbitrary code. **Recommendations** Disable or isolate the software immediately. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

**Name of the Vulnerable Software and Affected Versions** Zoya versions prior to 1.5 **Description** Unauthenticated PHP Object Injection occurs in the Zoya WordPress theme. PHP Object Injection is a vulnerability that allows an attacker to pass malicious serialized objects into the application, which can lead to unauthorized code execution or other critical impacts. **Recommendations** Update to a version later than 1.4.

Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.

Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions.

Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.

**Name of the Vulnerable Software and Affected Versions** SingleMalt versions prior to 1.6 **Description** An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when user-supplied input is passed to the `unserialize()` function without proper validation, potentially allowing an attacker to manipulate the application logic or execute arbitrary code. **Recommendations** Update to a version newer than 1.5.