Joshua Martinelle

**Name of the Vulnerable Software and Affected Versions** Gitea Docker image versions prior to 1.26.3 **Description** The official Gitea Docker image contains a configuration flaw in the `app.ini` template where the `REVERSE PROXY TRUSTED PROXIES` variable is set to `*` by default. When reverse-proxy authentication is enabled via the `ENABLE REVERSE PROXY AUTHENTICATION` setting, the application trusts identity headers from any source IP address instead of restricting them to a trusted proxy. This allows an unauthenticated remote attacker to impersonate any user, including administrators, by sending a crafted `X-WEBAUTH-USER` header. If auto-registration is enabled, the attacker can impersonate arbitrary usernames that do not yet exist in the system. This issue is exploitable via the web interface but does not affect the token-based API. Approximately 22,900 unique hosts running Gitea were identified as externally accessible, with an estimated 6,200 instances being targeted in real-world reconnaissance and exploitation attempts. Successful exploitation can lead to full compromise of repositories, CI/CD secrets, SSH keys, and administrative access. **Recommendations** Update Gitea Docker images to version 1.26.4 or newer. Set the `REVERSE PROXY TRUSTED PROXIES` variable to the specific IP addresses of trusted reverse proxies instead of using a wildcard. Disable the `ENABLE REVERSE PROXY AUTHENTICATION` setting if reverse-proxy authentication is not required. Disable user auto-registration if it is not necessary. Restrict direct network access to the Gitea container port to ensure traffic only flows through the intended reverse proxy.

**Name of the Vulnerable Software and Affected Versions** Project Manager WordPress Plugin (affected versions not specified) **Description** The issue is an authenticated SQL injection vulnerability in the `orderby` parameter in the "/pm/v2/activites" API endpoint. This vulnerability affects the 'Project Manager' WordPress Plugin. **Recommendations** As a temporary workaround, consider disabling the `orderby` parameter in the "/pm/v2/activites" route until a patch is available. Restrict access to the "/pm/v2/activites" API endpoint to minimize the risk of exploitation. Avoid using the `orderby` parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 2.1.1 Flowise Chat Embed versions prior to 2.0.0 **Description** The issue is related to a Stored Cross-Site vulnerability due to a lack of input sanitization. **Recommendations** For Flowise versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. For Flowise Chat Embed versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue. As a temporary workaround, consider restricting user input to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Flowise version 1.8.2 Description: An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise, leading to a complete crash of the instance running a vulnerable version due to improper handling of user-supplied input to the "/api/v1/get-upload-file" API endpoint. Recommendations: For Flowise version 1.8.2, as a temporary workaround, consider restricting access to the "/api/v1/get-upload-file" API endpoint until a patch is available. Additionally, avoid using this endpoint with untrusted user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** DevikaAI versions from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards **Description** A stored cross site scripting issue exists due to improperly decoded user input. This allows for the storage and subsequent execution of malicious scripts, potentially leading to unauthorized actions on behalf of the user. **Recommendations** For versions from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards, consider implementing proper input decoding and validation to prevent the storage of malicious scripts. As a temporary workaround, restrict user input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Langflow versions prior to 1.0.13 **Description** The issue allows a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the "/api/v1/users" endpoint. **Recommendations** For Langflow versions prior to 1.0.13, update to version 1.0.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/api/v1/users" endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Solidus versions prior to 4.3.5 **Description** The issue is related to a Stored Cross-Site Scripting vulnerability in the order tracking URL. **Recommendations** For versions prior to 4.3.5, update to version 4.3.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WordPress RSS Aggregator versions prior to 4.23.9 **Description** The issue is related to a Cross-Site Scripting (XSS) vulnerability. This vulnerability is caused by the lack of sanitization of the `notice id` GET parameter. **Recommendations** For versions prior to 4.23.9, update to version 4.23.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the `notice id` parameter in the affected endpoint until a patch is available.

**Name of the Vulnerable Software and Affected Versions** HTML5 Video Player version < 2.5.25 **Description** The issue is an unauthenticated SQL injection vulnerability. It affects the `id` parameter in the `get view` function. **Recommendations** For version < 2.5.25, update to version 2.5.25 or later to resolve the issue. As a temporary workaround, consider restricting access to the `get view` function until a patch is available. Avoid using the `id` parameter in the affected function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Appwrite versions prior to v1.4.14 **Description** The issue is related to a Server-Side Request Forgery (SSRF) that can be exploited via the "/v1/avatars/favicon" endpoint. This is due to an incomplete fix of a previously identified issue. **Recommendations** For versions prior to v1.4.14, update to version v1.4.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/v1/avatars/favicon" endpoint until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** My Calendar WordPress Plugin version < 3.4.22 **Description** The issue is related to an unauthenticated SQL injection vulnerability. This vulnerability is present in the `from` and `to` parameters in the "/my-calendar/v1/events" rest route. It allows a remote attacker to execute arbitrary SQL queries to the database. **Recommendations** For My Calendar WordPress Plugin version < 3.4.22, update to version 3.4.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/my-calendar/v1/events" API endpoint until a patch is available. Avoid using the `from` and `to` parameters in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions <= 4.4.11 **Description** A post-authentication stored cross-site scripting issue exists, allowing HTML, including script tags, to be injected into field names. This injection triggers when users visit the Categories or Entries pages after the field is added to a category or section. **Recommendations** For Craft CMS versions <= 4.4.11, update to version 4.4.12 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** WP Popup Banners WordPress Plugin version <= 1.2.5 **Description** The issue is an authenticated SQL injection vulnerability. It affects the `value` parameter in the `get popup data` action. **Recommendations** For WP Popup Banners WordPress Plugin version <= 1.2.5, consider updating to a version greater than 1.2.5 to resolve the issue. As a temporary workaround, restrict access to the `get popup data` action to minimize the risk of exploitation. Avoid using the `value` parameter in the affected action until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Formidable PRO2PDF WordPress Plugin versions prior to 3.11 **Description** The issue is an authenticated SQL injection vulnerability. It affects the `fieldmap` parameter in the `fpropdf export file` action. **Recommendations** For versions prior to 3.11, update to version 3.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the `fpropdf export file` action to minimize the risk of exploitation. Avoid using the `fieldmap` parameter in the affected action until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Meta Data and Taxonomies Filter WordPress plugin versions prior to 1.3.1 **Description** The issue is a reflected cross-site scripting vulnerability in the `tax name` parameter of the mdf get tax options in widget action. This can only be triggered by an authenticated user. **Recommendations** For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the mdf get tax options in widget action to minimize the risk of exploitation. Avoid using the `tax name` parameter in the affected action until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** The Lead Generated WordPress Plugin version <= 1.23 **Description** The issue is related to an unauthenticated insecure deserialization problem. The `tve labels` parameter of the `tve api form submit` action is passed to the PHP `unserialize()` function without proper sanitization or verification. This could lead to PHP object injection, which, when combined with specific class implementations or gadget chains, and a POP chain, could be used to perform various malicious actions. **Recommendations** For The Lead Generated WordPress Plugin version <= 1.23, consider updating to a version that fixes this issue, as using the `unserialize()` function without proper input validation poses a significant risk. As a temporary workaround, consider restricting access to the `tve api form submit` action to minimize the risk of exploitation. Avoid using the `tve labels` parameter in the affected action until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Events Made Easy WordPress Plugin version <= 2.3.14 **Description** The issue is an authenticated SQL injection vulnerability. It affects the `search name` parameter in the `eme recurrences list` action. **Recommendations** For Events Made Easy WordPress Plugin version <= 2.3.14, update to a version greater than 2.3.14 to resolve the issue. As a temporary workaround, consider restricting access to the `eme recurrences list` action to minimize the risk of exploitation. Avoid using the `search name` parameter in the affected action until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** BuddyForms WordPress plugin versions prior to 2.7.8 **Description** The issue is related to an unauthenticated insecure deserialization problem. An attacker could exploit this to call files using a PHAR wrapper, which deserializes data and calls arbitrary PHP Objects. This can be used for malicious actions if a POP chain is also present. **Recommendations** For versions prior to 2.7.8, update to version 2.7.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's deserialization functionality until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Login with Phone Number WordPress Plugin version < 1.4.2 **Description** The issue is related to an authenticated SQL injection vulnerability in the `lwp forgot password` action. Specifically, the vulnerability is associated with the lack of protection measures for the SQL query structure, which can be exploited by a remote attacker to execute arbitrary code. The `ID` parameter of the `lwp forgot password` action is vulnerable. **Recommendations** For Login with Phone Number WordPress Plugin version < 1.4.2, update to version 1.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `lwp forgot password` action until a patch is available. Avoid using the `ID` parameter in the affected action until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Quick Event Manager WordPress Plugin version prior to 9.7.5 **Description** The issue is related to a reflected cross-site scripting vulnerability. It affects the `category` parameter of the `qem ajax calendar` action. This vulnerability can be exploited by a remote attacker to conduct a cross-site scripting (XSS) attack, potentially due to insufficient protection of the webpage structure. **Recommendations** For versions prior to 9.7.5, update to version 9.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the `qem ajax calendar` action or avoiding the use of the `category` parameter in this action until the update is applied.