Manop55555

**Name of the Vulnerable Software and Affected Versions** MC Woocommerce Wishlist versions prior to 1.9.20 **Description** An unauthenticated Cross Site Scripting (XSS) issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. **Recommendations** Update MC Woocommerce Wishlist to version 1.9.20 or later.

**Name of the Vulnerable Software and Affected Versions** GeoDirectory versions prior to 2.8.163 **Description** An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its database, potentially allowing them to view data they are not normally able to retrieve. **Recommendations** Update to a version newer than 2.8.162.

**Name of the Vulnerable Software and Affected Versions** pypdf versions prior to 6.12.2 **Description** An attacker can craft a PDF file that results in long runtimes. This occurs when accessing a stream that utilizes the `/FlateDecode` filter with a PNG predictor. **Recommendations** Update to version 6.12.2. As a temporary workaround, apply the changes from PR #3806.

**Name of the Vulnerable Software and Affected Versions** pypdf versions prior to 6.12.2 **Description** A flaw in the pure-python PDF library allows an attacker to craft a PDF that causes excessive memory consumption. This occurs when extracting text from a page containing a form XObject (a reusable PDF object) that includes self-references. **Recommendations** Update to version 6.12.2. As a temporary workaround, apply the changes from PR #3805.

**Name of the Vulnerable Software and Affected Versions** Nuxt versions prior to 3.21.7 Nuxt versions prior to 4.4.7 **Description** The `<NuxtLink>` component fails to validate the URL scheme of values bound to its `to` or `href` props before rendering them into the `href` attribute of the underlying `<a>` element. If an application binds attacker-controlled input to these props, an attacker can provide a `javascript:` or `vbscript:` URL. When clicked, this executes the script in the origin of the application, leading to reflected DOM-based cross-site scripting (XSS), which is a vulnerability where a script is executed in the user's browser due to the application's failure to sanitize input. Additionally, a `data:text/html,...` payload can be used to create a same-tab phishing surface. This issue also affects applications that re-bind the `href` and `route.href` props from the component's custom slot to their own anchors. **Recommendations** Update to version 3.21.7 or later. Update to version 4.4.7 or later.

**Name of the Vulnerable Software and Affected Versions** pypdf versions prior to 6.12.1 **Description** An attacker can craft a PDF file that causes excessive memory consumption during the parsing of large XMP metadata, which may contain numerous unnecessary elements. **Recommendations** Update to version 6.12.1.