Kai Aizen

**Name of the Vulnerable Software and Affected Versions** pgAdmin 4 versions 9.13 through 9.16 **Description** An issue exists where the AI Assistant's `execute sql query` tool fails to properly validate queries supplied by a Large Language Model (LLM). The tool uses `sqlparse` to ensure only one non-transaction-control statement is executed within a read-only transaction. However, a discrepancy between how `sqlparse` and PostgreSQL handle string-literal lexing allows an attacker to smuggle multiple statements. By using a backslash before a quote, an attacker can bypass the validator and execute unauthorized commands, such as `COMMIT` or `CREATE TABLE`, leading to security restriction bypass, data manipulation, or remote code execution. This is achievable via indirect prompt injection, where a malicious payload is placed in an object that the AI Assistant reads. **Recommendations** Update pgAdmin 4 to version 9.17 or later. As a temporary mitigation, restrict the AI Assistant's access to objects that may contain untrusted content to prevent indirect prompt injection.

**Name of the Vulnerable Software and Affected Versions** TelSender versions prior to 1.14.15 **Description** Insufficient input sanitization when processing Telegram API responses allows unauthenticated attackers to perform DOM-Based Cross-Site Scripting (XSS). This occurs when the plugin handles attacker-controlled chat titles, enabling the injection of malicious scripts. The scripts execute when an administrator accesses the TelSender settings page and interacts with the "Tested" button. **Recommendations** Update TelSender to a version newer than 1.14.14. As a temporary mitigation, disable the plugin until a fix is applied.

**Name of the Vulnerable Software and Affected Versions** Jenkins Assembla Plugin versions prior to 1.5 **Description** A missing permission check allows users with Overall/Read permission to force the system to connect to an arbitrary URL using a specified username and password. **Recommendations** Update Jenkins Assembla Plugin to version 1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Jenkins Assembla Plugin versions prior to 1.5 **Description** The XML parser is not configured to prevent XML external entity (XXE) attacks. This allows attackers who can control the responses from the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery (SSRF), which is a technique used to induce the server to make requests to an unintended location. **Recommendations** Update Jenkins Assembla Plugin to version 1.5 or later.

**Name of the Vulnerable Software and Affected Versions** Jenkins Contrast Continuous Application Security Plugin versions prior to 3.12 **Description** Missing permission checks allow users with Overall/Read permission to enumerate the names of configured Contrast metadata. **Recommendations** Update Jenkins Contrast Continuous Application Security Plugin to version 3.12 or later.

**Name of the Vulnerable Software and Affected Versions** LWP::UserAgent versions prior to 6.83 **Description** LWP::UserAgent leaks Authorization and Proxy-Authorization headers during cross-origin redirects. When a 3xx response is received, the redirect handler only removes the Host and Cookie headers before the subsequent request. Consequently, caller-supplied Authorization and Proxy-Authorization headers are transmitted unchanged to the redirect target, even if the scheme, host, or port changes. This allows a redirect to an attacker-controlled host to disclose the caller's credentials. **Recommendations** Update to version 6.83 or later.

**Name of the Vulnerable Software and Affected Versions** HTTP Headers plugin for WordPress versions prior to 1.19.3 **Description** Insufficient sanitization of custom header name and value fields before they are written to the Apache .htaccess file via the `insert with markers()` function allows authenticated attackers with Administrator-level access or higher to perform CRLF Injection. This involves injecting arbitrary newline characters and additional Apache directives into the .htaccess configuration file through the 'Custom Headers' settings, which can result in Apache configuration parse errors and a potential site-wide denial of service. **Recommendations** Update the plugin to a version newer than 1.19.2. As a temporary workaround, restrict access to the 'Custom Headers' settings to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Riaxe Product Customizer versions prior to 2.1.3 **Description** The plugin contains a privilege escalation flaw due to an unauthenticated AJAX action ''wp ajax nopriv install-imprint'' that maps to the `ink pd add option()` function. This function processes the `option` and `opt value` variables from $ POST and executes `delete option()` and `add option()` using these values without nonce verification, capability checks, or an option name allowlist. Unauthenticated attackers can update arbitrary WordPress options, which may be used to enable user registration and set the default user role to administrator, leading to full site takeover. **Recommendations** Update to a version later than 2.1.2.

**Name of the Vulnerable Software and Affected Versions** Riaxe Product Customizer versions prior to 2.1.3 **Description** An issue exists in the Riaxe Product Customizer plugin for WordPress where unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive information from the database. This occurs due to insufficient escaping of user-supplied parameters and inadequate preparation of the SQL query. The flaw is located in the 'options' parameter keys within `product data` of the '/wp-json/InkXEProductDesignerLite/add-item-to-cart' REST API endpoint. **Recommendations** Update the plugin to a version later than 2.1.2. As a temporary workaround, restrict access to the '/wp-json/InkXEProductDesignerLite/add-item-to-cart' REST API endpoint or avoid using the `product data` parameter until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Riaxe Product Customizer versions prior to 2.1.3 **Description** An authorization bypass exists due to the registration of a REST API route ''/wp-json/InkXEProductDesignerLite/customer/delete customer'' without a permission callback. This configuration allows unauthenticated access to the `inkxe delete customer()` function, which processes an array of user IDs from the request body and passes them to `wp delete user()` without performing authentication or authorization checks. Consequently, unauthenticated attackers can delete arbitrary WordPress user accounts, including administrator accounts, resulting in complete site lockout and data loss. **Recommendations** Update to a version later than 2.1.2. As a temporary workaround, restrict access to the ''/wp-json/InkXEProductDesignerLite/customer/delete customer'' endpoint.

**Name of the Vulnerable Software and Affected Versions** 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery versions prior to 1.16.18 **Description** This plugin for WordPress allows unauthenticated attackers to retrieve flipbook page metadata for draft, private, and password-protected flipbooks. This occurs due to a missing capability check in the `send post pages json()` function. **Recommendations** Update to a version later than 1.16.17. As a temporary workaround, consider disabling the `send post pages json()` function until the update is applied.

Name of the Vulnerable Software and Affected Versions Advanced Contact form 7 DB plugin for WordPress versions up to and including 2.0.9 Description The Advanced Contact form 7 DB plugin for WordPress has a flaw that allows unauthorized data access. This is due to a missing capability check on the `vsz cf7 export to excel` function. Attackers with Subscriber-level access or higher can export form submissions to an excel file. Recommendations Update to a version later than 2.0.9.

**Name of the Vulnerable Software and Affected Versions** Advanced Contact form 7 DB versions prior to 2.1.0 **Description** Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the `vsz cf7 save setting callback()` function. A nonce is a unique token used to prevent the replay of requests. This flaw allows unauthenticated attackers to delete form entries by tricking a site administrator into clicking a malicious link. **Recommendations** Update Advanced Contact form 7 DB to a version newer than 2.0.9.

Name of the Vulnerable Software and Affected Versions Riaxe Product Customizer plugin for WordPress versions up to and including 2.4 Description The Riaxe Product Customizer plugin for WordPress is susceptible to exposure of sensitive information. The '/wp-json/InkXEProductDesignerLite/orders' API endpoint lacks authentication or authorization checks due to its 'permission callback' being set to ' return true'. This allows unauthenticated attackers to retrieve customer first and last names, customer IDs, order IDs, order totals, order dates, currencies, and order statuses directly from the database. Recommendations Update the Riaxe Product Customizer plugin to a version later than 2.4.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Provider for Databricks versions 1.10.0 through 1.11.9 **Description** The software does not properly validate certificates when connecting to Databricks, potentially allowing a man-in-the-middle attack where traffic is intercepted, manipulated, or credentials are stolen without the user being notified. **Recommendations** Upgrade to version 1.12.0 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MimeTypes Link Icons plugin for WordPress versions up to and including 3.2.20 **Description** The MimeTypes Link Icons plugin for WordPress is susceptible to Server-Side Request Forgery. This occurs because the plugin makes outbound HTTP requests to user-controlled URLs without sufficient validation when the "Show file size" option is enabled. Authenticated attackers with Contributor-level access or higher can leverage this to make web requests to arbitrary locations from the web application. This could allow querying and modification of information from internal services through crafted links within post content. **Recommendations** Update the MimeTypes Link Icons plugin to a version later than 3.2.20.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow versions 3.1.0 through 3.1.7 **Description** Apache Airflow versions 3.1.0 through 3.1.7 contain a missing authorization issue within the Human-in-the-Loop (HITL) endpoints of the Execution API. This allows any authenticated task instance to perform actions—reading, approving, or rejecting—on HITL workflows belonging to other task instances. The HITL endpoints are part of the Execution API, which manages the execution of tasks within Airflow workflows. The issue stems from a lack of proper access controls, enabling unauthorized access and manipulation of HITL workflows. **Recommendations** Upgrade to Apache Airflow version 3.1.8 or later.

**Name of the Vulnerable Software and Affected Versions** ingress-nginx versions prior to 1.13.7 ingress-nginx versions prior to 1.14.3 **Description** A security issue exists due to insufficient input validation when processing Ingress resource annotations. An attacker can use the `nginx.ingress.kubernetes.io/rewrite-target` annotation to inject arbitrary configuration directives into the nginx.conf file. This configuration injection can lead to arbitrary code execution within the context of the ingress-nginx controller and the disclosure of Secrets accessible to the controller, which, in default installations, may include all Secrets cluster-wide. **Recommendations** Update ingress-nginx to version 1.13.7 or later. Update ingress-nginx to version 1.14.3 or later. As a temporary mitigation, restrict or avoid using the `nginx.ingress.kubernetes.io/rewrite-target` annotation.

**Name of the Vulnerable Software and Affected Versions** Friendly Functions for Welcart plugin for WordPress versions through 1.2.5 **Description** The Friendly Functions for Welcart plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is caused by a lack of, or incorrect, nonce validation on the settings page. An unauthenticated attacker could potentially update plugin settings by forging a request, provided they can trick a site administrator into performing an action, such as clicking a malicious link. **Recommendations** Update the Friendly Functions for Welcart plugin to a version later than 1.2.5.

**Name of the Vulnerable Software and Affected Versions** ACF to REST API plugin for WordPress versions through 3.3.4 **Description** The ACF to REST API plugin for WordPress is affected by an Insecure Direct Object Reference issue. Insufficient capability checks in the `update item permissions check()` method allow authenticated attackers with Contributor-level access or higher to modify ACF fields. Attackers can modify posts they do not own, user accounts, comments, taxonomy terms, and global options. This is possible through the `/wp-json/acf/v3/{type}/{id}` API endpoints, where `{type}` and `{id}` represent the object type and identifier, respectively. The issue stems from a lack of object-specific permission checks, only verifying the `edit posts` capability. **Recommendations** Update the ACF to REST API plugin to a version later than 3.3.4.