The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesave_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the sinotype_config function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Cross-Site Request Forgery in the Customify WordPress theme version 0.4.11 allows unauthenticated remote attackers to reset a site's theme customization settings by tricking an authenticated administrator into clicking a malicious link. The flaw is rooted in missing nonce validation on the `reset_customize_section` function in `inc/customizer/class-customizer.php`. No active exploitation has been reported (not in CISA KEV), and an EPSS score of 0.01% (1st percentile) confirms negligible real-world exploitation probability, making this a low-urgency but patchable integrity issue.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi Advertisement Information Technologies Trade Inc.
A arbitrary file access vulnerability in Backup Bolt (CVSS 3.8). Remediation should follow standard vulnerability management procedures.
A security vulnerability in HCL MyXalytics (CVSS 3.5). Remediation should follow standard vulnerability management procedures.
DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and below allow for deseriaization of untrusted data because of the way the DataChain library reads serialized objects from environment variables (such as DATACHAIN__METASTORE and DATACHAIN__WAREHOUSE) in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads. This issue is fixed in version 0.34.2.
Rejected reason: Further research determined the issue is not an independent vulnerability as it originates from Apache Felix. No vendor patch available.
Rejected reason: Further research determined the issue is not an open source vulnerability. No vendor patch available.
Rejected reason: Not used. No vendor patch available.