NetAlertX is a network, presence scanner, and alert framework. Prior to version 25.6.7, a vulnerability in the authentication logic allows users to bypass password verification using SHA-256 magic hashes, due to loose comparison in PHP. In vulnerable versions of the application, a password comparison is performed using the `==` operator at line 40 in front/index.php. This introduces a security issue where specially crafted "magic hash" values that evaluate to true in a loose comparison can bypass authentication. Because of the use of `==` instead of the strict `===`, different strings that begin with 0e and are followed by only digits can be interpreted as scientific notation (i.e., zero) and treated as equal. This issue falls under the Login Bypass vulnerability class. Users with certain "weird" passwords that produce magic hashes are particularly affected. Services relying on this logic are at risk of unauthorized access. Version 25.6.7 fixes the vulnerability.
We need to produce a JSON object with the specified fields, synthesizing the data. Given CVE-2025-49414: Description: Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery allows Using Malicious Files. This issue affects FW Gallery: from n/a through 8.0.0. CVSS Score: 10.0 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CWE: CWE-434 EPSS: 0.07% (22nd percentile) Tags: File Upload References: patchstack.com url (two similar), and NVD URL. No KEV mention, no POC mention, no patch availability mentioned explicitly. The patchstack references likely detail the vulnerability but we don't have patch info in the input. I'll need to infer that the vendor may have a fix, but no exact version is provided in the input data. Key points: - product_name: "FW Gallery" (WordPress plugin) - summary: synthesize. Not copy description. Start with impact: "Arbitrary file upload in FW Gallery WordPress plugin versions <= 8.0.0 allows unauthenticated attackers to upload malicious files, leading to remote code execution and full site compromise." Mention that there is no KEV, no known POC, EPSS low. Note that CVSS 10.0 suggests critical risk but EPSS suggests low exploitation probability. - technical_context: CWE-434 Unrestricted File Upload. The plugin handles file uploads without proper validation. CPE string: likely cpe:2.3:a:fastw3b:fw_gallery, but not provided. We can mention it's a WordPress plugin. Explain that under WordPress, uploaded PHP files can be executed, leading to RCE. - risk_assessment: CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with scope change, so the vulnerability affects the web server possibly beyond the plugin. EPSS 0.07% (low exploitation probability). No KEV, no POC. So real-world risk: low probability of exploitation despite critical severity. SSVC: maybe not actively exploited, automatable (likely). - affected_products: FW Gallery plugin for WordPress, versions from n/a through 8.0.0. Mention advisory link: https://patchstack.com/database/wordpress/plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-arbitrary-file-upload-vulnerability?_s_id=cve - remediation: No patch version provided in input, but patchstack advisory might contain fix. Since the input only says "patch available" per vendor advisory? Actually, in the references, there's no explicit patch status. I need to check: patchstack usually provides a fix version, but the input doesn't give one. So I'll say "Upgrade FW Gallery to the latest patched version once released by the developer or apply temporary mitigation." But the CVE description says through 8.0.0. Could be that version 8.0.0 is the vulnerable, and maybe there's a 8.0.1 or later. But not in input. So I'll state: "No patched version confirmed in available data; contact vendor or apply Web Application Firewall rules to block malicious file uploads." I'll not invent version. Workarounds: "Disable the plugin until a fix is available, or restrict file upload capabilities to authenticated users only if possible." This is a WordPress plugin, so typical mitigation: disable it. - exploit_scenario: Attacker sends a crafted HTTP request to the vulnerable endpoint to upload a PHP webshell, then accesses it to execute arbitrary commands on the web server. No POC known, but AC:L suggests easy. - exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default configurations of FW Gallery plugin version 8.0.0 and earlier." Since CVSS says PR:N/UI:N, unauthenticated. The description says "unrestricted upload of file with dangerous type" so likely the upload endpoint is accessible without authentication. Could be that the plugin's file upload endpoint doesn't require authentication, or the check is bypassed. So no specific configuration required. I'll note that the vulnerability is exploitable in default installations. But I need to be precise: the CVSS indicates no privileges required, no user interaction, so likely. I'll state: "No special conditions — remote unauthenticated exploitation against default installations of FW Gallery plugin up to 8.0.0." - attack_chain: Send crafted multipart request with malicious file → Unrestricted file upload bypass → File saved in accessible directory → Execute uploaded script → Gain web server control. (5 steps). I'll phrase as: "Send crafted HTTP request to upload endpoint → Upload malicious PHP file without validation → Access uploaded file via direct URL → Execute arbitrary code → Achieve full server compromise". Make it 5 steps. - confidence_notes: "CVE description and patchstack advisory confirm unauthenticated file upload. EPSS score indicates low exploitation likelihood. No public POC or active exploitation identified. Patch status not independently confirmed — patchstack advisory may contain fix version." I need to be specific: "Vendor advisory (Patchstack) confirms vulnerability but no exact patch version provided in this dataset; fix version may exist. No KEV listing." Actually, I'll check the reference: "patchstack.com/database/wordpress/plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-arbitrary-file-upload-vulnerability" – likely that includes fix info. So I can say "Patchstack advisory likely details a fix, but exact patched version not available in the provided data." - prevalence: WordPress plugin, FW Gallery. Unknown popularity; I'll estimate "medium" (common but not everywhere). Prevalence_basis: "WordPress plugin with some user base, but not extremely widespread." I'll go with "medium" and justification "popular WordPress plugin with a moderate user base". Actually, I can't be sure. Could be low. But since it's a commercial plugin? "FW Gallery" might be a gallery plugin, not in the top list. I'll say "unknown" because I have no installation numbers. The prevalence field says ONE word from set, so I can put "unknown" and prevalence_basis "insufficient data to estimate deployment scale". That's safe. The instruction says if genuinely cannot estimate output 'unknown'. I'll do that. - assessed_cvss_vector: I need my own vector. The provided CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That sounds reasonable for unauthenticated file upload. I'll keep it but might tweak. Since no specific conditions, I'll use that same vector. But I'll assess: AV:N (network exploitable), AC:L (low complexity), PR:N (no privileges required), UI:N (no user interaction), Scope: Changed (the vulnerable component is the plugin, but the impact is on the web server, so S:C). Impact: High for C, I, A. That matches. So I'll use: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Rationale: "No authentication required, network vector, low complexity; scope change from plugin to server leading to full compromise." - assessed_cvss40_vector: Convert. CVSS 4.0: AV:N (Network) -> AV:N, AC:L -> AC:L, AT:N (no attack requirements), PR:N, UI:N, VC:H, VI:H, VA:H (since vulnerable system is the plugin? Actually scope changed: the vulnerable component is the plugin, but the attack impacts the web server. In CVSS 4.0, we have Vulnerable System confidentiality/integrity/availability (VC, VI, VA) and Subsequent System (SC, SI, SA). For a scope change, we need to assign impact to both. Since the plugin is the vulnerable component, and the attack compromises the server (subsequent system) with full high impact. The vulnerable component itself might also have high impact? Typically, file upload in plugin might allow compromise of the plugin's data, but full server compromise. I'll set VC:H, VI:H, VA:H (since the vulnerability allows modifying plugin files, database, etc.), and SC:H, SI:H, SA:H (server compromise). That's typical for file upload leading to RCE. So: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Also need to note Attack Requirements: none, so AT:N. That's fine. Rationale for CVSS 4.0: "Full compromise of both the plugin and the underlying server due to arbitrary code execution." I'll include the vector. Now, all fields as plain text. I'll craft the JSON. - summary: "Arbitrary file upload in FW Gallery WordPress plugin versions up to 8.0.0 allows unauthenticated attackers to upload malicious PHP files and execute code on the server, leading to complete site takeover. CVSS 10.0 signals critical severity, but EPSS score of 0.07% indicates low likelihood of real-world exploitation; no public exploit code or active exploitation has been identified at time of analysis." - technical_context: "CWE-434: Unrestricted Upload of File with Dangerous Type. The FW Gallery plugin (cpe:2.3:a:fastw3b:fw_gallery) fails to validate file types during upload, allowing PHP scripts or other executable files to be stored in a web-accessible directory. In WordPress, such files can be directly accessed and executed, leading to remote code execution." - risk_assessment: "CVSS 10.0 reflects network-accessible, low-complexity, unauthenticated exploitation with full system compromise. However, EPSS probability of exploitation is only 0.07% (22nd percentile), suggesting that despite high severity, the vulnerability is not being actively targeted. No CISA KEV entry and no public exploit code reduce immediate risk. Risk is high if exploited, but current threat activity is low." - affected_products: "FW Gallery plugin for WordPress, versions from unknown through 8.0.0 inclusive. The vendor advisory is available at Patchstack: https://patchstack.com/database/wordpress/plugin/fw-gallery/vulnerability/wordpress-fw-gallery-8-0-0-arbitrary-file-upload-vulnerability?_s_id=cve." - remediation: "Upgrade FW Gallery to a patched version beyond 8.0.0 when released by Fastw3b; the Patchstack advisory likely provides the exact fix version. If no patch is available, disable the FW Gallery plugin entirely until a fix is deployed. Apply a Web Application Firewall (WAF) rule to block uploads of executable file types (e.g., .php, .phtml) to the plugin's upload endpoint. Note that WAF may be bypassed if filename manipulation is used; plugin deactivation is the most effective interim measure." - exploit_scenario: "An unauthenticated attacker sends a crafted multipart HTTP request to the vulnerable file upload endpoint, uploading a PHP webshell. The attacker then navigates to the uploaded file's URL to execute commands, gaining full control of the WordPress server." - exploitation_conditions: "No special conditions — remote unauthenticated exploitation against default configurations of FW Gallery plugin version 8.0.0 and earlier." - attack_chain: "Send crafted HTTP request to upload endpoint → Upload malicious PHP file due to missing type validation → File stored in web-accessible directory → Access uploaded file via direct URL → Execute arbitrary code → Achieve full server compromise" - confidence_notes: "Vulnerability confirmed by Patchstack advisory; CVSS vector and description confirm unauthenticated access and full scope change. No public POC or KEV listing identified. Exact patch version not specified in provided data; check Patchstack for newer version." - prevalence: "unknown" - prevalence_basis: "insufficient data to estimate deployment scale" - assessed_cvss_vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" - assessed_cvss_rationale: "Unrestricted file upload via network, no authentication or user interaction, and full impact to both plugin and server." - assessed_cvss40_vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H" Now, format JSON. Ensure all fields are plain text strings. The attack_chain is a chain with arrows, so no bullet points. I'll make it: "Send crafted HTTP request to upload endpoint → Upload malicious PHP file due to missing type validation → File stored in web-accessible directory → Access uploaded file via direct URL → Execute arbitrary code → Achieve full server compromise
Remote code execution in LogisticsHub WordPress theme allows unauthenticated attackers to upload arbitrary files, including web shells, enabling full server compromise. Affected versions range from n/a through 1.1.6. This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS base score of 10.0, though the EPSS exploitation probability is low (0.07%); no active exploitation or public proof-of-concept has been confirmed at the time of analysis.
Remote code execution in Easy Stripe WordPress plugin version 1.1 and earlier allows unauthenticated attackers to inject and execute arbitrary code on the underlying server. The vulnerability has a critical CVSS score of 10.0 but EPSS indicates a low exploitation probability (0.07%), and no active exploitation has been reported.
Unauthenticated object injection in the WooCommerce Product Multi-Action WordPress plugin up to version 1.3 allows remote attackers to achieve arbitrary code execution, data theft, and full site compromise via deserialization of untrusted user-supplied data. The vulnerability is exploitable over the network with no user interaction or privileges, carrying a CVSS score of 9.8. At present, no active exploitation or public exploit code is known, and the EPSS (0.11%) suggests low near-term exploitation probability.
Privilege escalation in Service Finder Booking plugin for WordPress allows unauthenticated attackers to gain full administrative control. This vulnerability, affecting all versions up to 6.0, arises from incorrect privilege assignment (CWE-266) and carries a CVSS score of 9.8, though EPSS indicates a low exploitation probability (0.08%) with no public exploit or active exploitation known.
Unprivileged attackers can gain administrative control of WordPress sites running InspiryThemes RealHomes up to version 4.4.0 by exploiting an incorrect privilege assignment vulnerability. No authentication or user interaction is required, leading to full site compromise with a CVSS 9.8 critical rating. While no active exploitation is known and EPSS probability is low, the flaw is reachable over the network if user registration is enabled.
Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.
User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-controllable page names) This allows attackers to inject JavaScript and compromise user sessions under certain conditions. This issue affects Mediawiki - SecurePoll extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
SQL injection in the Click & Pledge Connect WordPress plugin allows unauthenticated attackers to escalate privileges and potentially compromise affected sites. The vulnerability exists in versions 25.04010101 through WP6.8 and carries a critical CVSS score due to its full technical impact and easy exploitability, though no public exploit or active exploitation has been observed.
Unauthenticated SQL injection in the designthemes LMS WordPress theme through version 9.1 allows remote attackers to extract arbitrary data from the database, potentially exposing sensitive user information or causing limited availability impact via scope change. Exploitation requires no user interaction or privileges, but EPSS score of 0.04% indicates low likelihood of future exploitation, and no active exploitation has been confirmed.
Unauthenticated SQL injection vulnerability in the NGG Smart Image Search WordPress plugin up to version 3.4.1 allows remote attackers to execute arbitrary SQL commands, primarily compromising database confidentiality. While rated Critical (CVSS 9.3) with a network attack vector, the EPSS probability of exploitation is only 0.04%, and no public exploits or active exploitation have been reported.
Unauthenticated SQL injection in the WordPress plugin Video List Manager through version 1.7 allows remote attackers to execute arbitrary SQL commands on the backing database, leading to exposure of sensitive data and potential partial denial of service. No authentication or user interaction is required, and the attack vector is network-accessible, but the EPSS exploitation probability is very low (0.04%), and no active exploitation or public exploit code is known at this time.
Blind SQL injection in bSecure – Your Universal Checkout WordPress plugin allows unauthenticated remote attackers to exfiltrate sensitive database contents, including user credentials and order data, via crafted HTTP requests to the checkout endpoint. The vulnerability affects all plugin versions up to 1.7.9 and requires no user interaction or special privileges. While no active exploitation or public exploit is currently known (EPSS 0.04%, not listed in CISA KEV), the CVSS 9.3 critical score reflects the high ease of exploitation and severe confidentiality impact across a changed scope, making patching a high priority.
Arbitrary file upload vulnerability in the Bulk Featured Image WordPress plugin (versions up to 1.2.1) allows authenticated attackers with high privileges to upload malicious files, such as web shells, leading to remote code execution on the server. The flaw has a CVSS score of 9.1 due to an unrestricted file upload mechanism; however, no active exploitation has been confirmed and the EPSS exploitation probability is very low (0.07%).