Phat Rio

Contributor PHP Object Injection in ARMember Premium <= 7.0 versions.

**Name of the Vulnerable Software and Affected Versions** Booked versions prior to 3.0.1 **Description** Broken access control allows users with subscriber privileges to perform unauthorized actions. **Recommendations** Update to a version newer than 3.0.0.

**Name of the Vulnerable Software and Affected Versions** Booked versions prior to 3.0.1 **Description** An unauthenticated Cross Site Request Forgery (CSRF) issue exists, which allows an attacker to induce a user to perform actions they did not intend to execute. **Recommendations** Update to a version newer than 3.0.0.

**Name of the Vulnerable Software and Affected Versions** ez Form Calculator Premium versions prior to 2.14.1.3 **Description** The plugin contains a broken access control issue that allows unauthenticated users to bypass authorization restrictions. **Recommendations** Update to a version newer than 2.14.1.2.

Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions.

Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.

Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions.

Contributor Local File Inclusion in Element Pack Pro <= 9.0.6 versions.

Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.

Contributor Arbitrary File Upload in Unlimited Elements for Elementor (Premium) <= 2.0.6 versions.

Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions.

Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.

Unauthenticated SQL Injection in ListingPro <= 2.9.10 versions.

Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

Unauthenticated Privilege Escalation in Support Board < 3.8.9 versions.

Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions.

**Name of the Vulnerable Software and Affected Versions** B2BKing versions prior to 5.2.10 **Description** A missing authorization issue allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails to properly verify if a user has the necessary permissions to perform an action. **Recommendations** Update to version 5.2.10 or later.

**Name of the Vulnerable Software and Affected Versions** NanoCare versions prior to 1.2.2 **Description** A missing authorization issue in Linethemes NanoCare allows for the exploitation of incorrectly configured access control security levels, resulting in broken access control. **Recommendations** Update to version 1.2.2.

**Name of the Vulnerable Software and Affected Versions** WooCommerce Product Filters versions prior to 2.0.6 **Description** An unauthenticated PHP Object Injection issue exists in the software. PHP Object Injection occurs when user-supplied input is passed to the `unserialize()` function without proper validation, potentially allowing an attacker to manipulate objects and execute arbitrary code. **Recommendations** Update to version 2.0.6 or later.