Vantastic

Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions.

**Name of the Vulnerable Software and Affected Versions** Uncanny Automator versions prior to 7.3.1.3 **Description** An unauthenticated PHP Object Injection issue exists. PHP Object Injection occurs when untrusted input is passed to the PHP `unserialize()` function, potentially allowing an attacker to manipulate objects and execute arbitrary code. **Recommendations** Update to a version newer than 7.3.1.2.

Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.

**Name of the Vulnerable Software and Affected Versions** Uncanny Automator Pro versions prior to 7.3.0.7 **Description** An issue exists that allows for PHP Object Injection, a condition where untrusted input is passed to the `unserialize()` function, potentially allowing an attacker to manipulate application logic or execute arbitrary code. **Recommendations** Update to a version newer than 7.3.0.6.

**Name of the Vulnerable Software and Affected Versions** Dokan Pro versions prior to 5.0.5 **Description** An issue allows unauthenticated users to perform privilege escalation, which enables an attacker to gain higher access levels within the system without providing valid credentials. **Recommendations** Update to a version newer than 5.0.4.

**Name of the Vulnerable Software and Affected Versions** EventPrime versions prior to 4.3.4.2 **Description** PHP Object Injection occurs when an application deserializes untrusted data, allowing an attacker to manipulate the object structure and potentially execute arbitrary code or perform unauthorized actions. **Recommendations** Update to version 4.3.4.2 or later.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.10 versions.

**Name of the Vulnerable Software and Affected Versions** JetEngine versions prior to 3.8.10.2 **Description** An unauthenticated SQL Injection allows an attacker to execute arbitrary SQL queries on the database without requiring valid credentials. **Recommendations** Update to version 3.8.10.2 or newer.

Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

**Name of the Vulnerable Software and Affected Versions** LearnPress versions prior to 4.3.6 **Description** Improper neutralization of input during web page generation allows for Reflected Cross-Site Scripting (XSS), a flaw where an application includes untrusted data in a web page without proper validation, enabling attackers to execute malicious scripts in the victim's browser. **Recommendations** Update to a version newer than 4.3.6.