Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfiguration (allow_origins='*' with credentials) and a SameSite=None refresh token cookie. An attacker controlling a malicious webpage can steal authentication tokens and gain full access, including built-in code execution, leading to complete system compromise. This vulnerability is confirmed actively exploited (CISA KEV), with publicly available exploit code and a high EPSS score (17.62%), indicating widespread attack likelihood.
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed into the request header multimap via read_headers() in httplib.h (headers.emplace), then the server later appends its own internal metadata using the same header names in Server::process_request without erasing duplicates. Because Request::get_header_value returns the first entry for a header key (id == 0) and the client-supplied headers are parsed before server-inserted headers, downstream code that uses these header names may inadvertently use attacker-controlled values. Affected files/locations: cpp-httplib/httplib.h (read_headers, Server::process_request, Request::get_header_value, get_header_value_u64) and cpp-httplib/docker/main.cc (get_client_ip, nginx_access_logger, nginx_error_logger). Attack surface: attacker-controlled HTTP headers in incoming requests flow into the Request.headers multimap and into logging code that reads forwarded headers, enabling IP spoofing, log poisoning, and authorization bypass via header shadowing. This vulnerability is fixed in 0.27.0.
A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint.
ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server user. Attackers can upload PHP executable files via the Quick File Uploader page, resulting in remote code execution on the server.
Remote authentication bypass in Advantech WISE-DeviceOn Server allows unauthenticated attackers to forge JSON Web Tokens using a static HMAC secret, gaining full administrative control and the ability to execute arbitrary code on managed agents. With a CVSS score of 10.0, the vulnerability enables impersonation of any account, including the root super admin, if the attacker can guess a valid email address. No active exploitation has been reported at time of analysis, but the nature of the flaw makes exploitation trivial.
Authentication bypass in the User Verification plugin for WordPress (versions ≤2.0.39) allows unauthenticated attackers to log in as any user with a verified email address, including administrators, by submitting an empty OTP value. The flawed OTP comparison function fails to check if an OTP was actually generated, enabling complete account takeover. No active exploitation or public exploit is known, but the low-complexity network attack makes it a critical priority for affected sites.
We need to produce a JSON object with the specified fields, synthesizing all provided intelligence. Let's carefully process each piece. - CVE ID: CVE-2025-13313 - Description: CRM Memberships plugin for WordPress, privilege escalation via password reset, missing auth checks on ntzcrm_changepassword AJAX action, unauthenticated attackers can reset any user's password if they can obtain/enumerate target email. Also ntzcrm_get_users endpoint allows unauthenticated enumeration of subscriber emails. Versions up to 2.5 affected. CVSS 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-862 Missing Authorization. - EPSS: 0.29%, percentile 52%. - KEV: Not mentioned, so assume false. - Patch: In References, there is a changeset link: https://plugins.trac.wordpress.org/changeset/3464130/ — likely the fix. But no version number provided. The EUVD says affected versions "CRM Memberships * ≤2.5". So inferred that patched version would be above 2.5, maybe 2.5.1? Not stated explicitly. We'll note upstream fix available, patched version not independently confirmed. - Tags: Privilege Escalation, Authentication Bypass, WordPress - Reported by: security@wordfence.com (Wordfence) - CPE? Not explicitly provided, but EUVD gives affected product: CRM Memberships plugin for WordPress. We'll state product name as "CRM Memberships" (the plugin name). Product name field: "CRM Memberships" (since it's a WordPress plugin, we can say "CRM Memberships" — but it might be better to say "CRM Memberships plugin for WordPress"? The rule: 1-3 words ONLY. So "CRM Memberships" is fine. Or "CRM Memberships WordPress plugin"? That's 4 words. The rule: "product_name: '1-3 words ONLY. The specific product or service name affected.' So I'll go with "CRM Memberships". I'll add context in summary. Now, synthesize data: - summary: 2-3 sentences. Start with impact verb and product: "Privilege escalation in CRM Memberships WordPress plugin allows unauthenticated attackers to gain administrative access by resetting any user's password." Summarize: missing authorization on ntzcrm_changepassword AJAX action, requires knowing email, which can be enumerated via ntzcrm_get_users endpoint. EPSS 0.29% (low probability, but percentile 52% is average), no KEV, so not actively exploited widely. No POC mentioned? Not explicitly, but Wordfence might have a proof of concept? It says "Reported by Wordfence" and "Tags: Privilege Escalation, Authentication Bypass", but no explicit "POC available". So I'll assume no public exploit identified, but the vulnerability is described in detail, so someone could craft exploit. Since no KEV, I'll say "no public exploit identified" but given the simplicity, it's likely easy to exploit. However, I'll stick to available data. There's no POC flag, so "no public exploit identified at time of analysis". But Wordfence advisory might contain details. I'll just note that EPSS is low (0.29%) indicating low likelihood of exploitation despite high CVSS. Summary: "Privilege escalation in the CRM Memberships plugin for WordPress allows unauthenticated attackers to reset any user's password and seize account access. Exploitation requires a target's email address, obtainable via a separate unauthenticated user enumeration endpoint. The vulnerability affects all plugin versions up to 2.5 and carries a CVSS score of 9.8." - technical_context: Explain the underlying technology. CWE-862 Missing Authorization. The plugin exposes AJAX actions ntzcrm_changepassword and ntzcrm_get_users without proper capability checks. WordPress plugins often register AJAX hooks for both authenticated and unauthenticated users; here they likely used wp_ajax_nopriv_* without authorization. The plugin handles password reset via that endpoint, and missing checks allow any request to change a user's password. CPE not provided, but we can mention it's a WordPress plugin, identified by slug "crm-memberships". Include references to source code files. - risk_assessment: Compare CVSS (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with EPSS 0.29% (low probability). Not in KEV, so no known active exploitation. SSVC: exploitation status "none", automatable yes (since network vector, low complexity, no user interaction), technical impact total. So it's a high-priority risk for organizations using that plugin, because easy to exploit if plugin installed and email can be guessed. But EPSS suggests low real-world exploitation attempts. However, given the enumeration endpoint, it's likely to be exploited in targeted attacks. So risk assessment: "The CVSS 9.8 indicates critical severity with network attack vector, low complexity, no privileges or user interaction required. However, EPSS predicts only a 0.29% probability of exploitation in the next 30 days, placing it in the 52nd percentile, suggesting relatively low active exploitation likelihood. No active exploitation has been confirmed via CISA KEV. Given the ease of exploitation and the presence of a companion user enumeration endpoint, this vulnerability poses a serious risk to any unpatched WordPress site using the plugin, especially if email addresses of privileged users can be guessed or collected." No missing/conflicting data. - affected_products: "CRM Memberships plugin for WordPress versions up to and including 2.5. The plugin is available from the WordPress plugin repository (slug: crm-memberships). Wordfence advisory confirms affected versions ≤2.5." Provide reference link to Wordfence threat intel page. - remediation: "Update the CRM Memberships plugin to a patched version. The vendor has released a fix in SVN changeset 3464130, but the exact version number is not specified in available references. Administrators should upgrade to a version beyond 2.5 as soon as it becomes available. As a temporary workaround, disable the plugin entirely or use a Web Application Firewall rule to block unauthorized access to the wp-admin/admin-ajax.php endpoint with action parameters ntzcrm_changepassword and ntzcrm_get_users. Note that blocking these endpoints entirely may break plugin functionality." But we need to be careful: the changeset link points to the commit, so there is a fix committed. Wordfence advisory likely has a version patch? I'll check that link. The reference https://www.wordfence.com/threat-intel/vulnerabilities/id/e2837399-c44f-494e-bdc6-f9c6e4e2dc11?source=cve might indicate the fixed version. I can't access it, but from the data, it says affected up to 2.5. So possibly fixed in 2.5.1. I'll say: "The vendor has released a patched version, likely 2.5.1 or higher, via WordPress plugin repository. Immediate update is required." Then suggest workaround. I'll mention exact changeset. - exploit_scenario: "An attacker sends an unauthenticated AJAX request to wp-admin/admin-ajax.php with action=ntzcrm_get_users to enumerate subscriber emails, then uses a known or guessed Admin email to send another request with action=ntzcrm_changepassword, user_email=target, and new_password, resetting the password and gaining full access to the account." No POC mentioned, but scenario is clear. - exploitation_conditions: "The attacker must know or be able to guess a valid email address of a target user (which can be obtained via the ntzcrm_get_users endpoint if that endpoint is accessible). No authentication is required. The plugin must be active and vulnerable version ≤2.5 installed. The wp-admin/admin-ajax.php must be reachable (default for WordPress)." So condition: "Requires the targeted user's email address. The companion unauthenticated user enumeration endpoint facilitates this, but if that endpoint is blocked or disabled, attacker must obtain email through other means." So conditions: email address knowledge, plugin enabled, network access to AJAX endpoint. I'll phrase: "Exploitation requires the attacker to have or obtain the target user's email address, which is facilitated by the plugin's own unauthenticated user enumeration endpoint. No special configuration beyond default WordPress deployment is needed." - attack_chain: "Send request to ntzcrm_get_users endpoint → Enumerate subscriber email addresses → Identify admin user email → Send password reset request to ntzcrm_changepassword with target email and new password → Password changed → Log in as target user → Escalate privileges to administrator." But check phases: Recon (enumerate) → Delivery (send AJAX request) → Exploit (missing auth) → Impact (access). 7 steps: Recon → Delivery → Exploit → Install (maybe not) → C2 → Execute → Impact. Simpler: 5-step: Access → Delivery → Exploit → Execution → Impact. I'll do: "Access WordPress admin-ajax endpoint → Send enumeration request to ntzcrm_get_users → Extract admin email from response → Send password reset request to ntzcrm_changepassword with admin email and new password → Gain administrative access via login." That's 5 steps. - confidence_notes: "Vulnerability details confirmed by Wordfence advisory and NVD CVE record. Patch existence confirmed by SVN changeset 3464130, but fixed version number not independently verified. No known active exploitation (not in KEV). EPSS score is low but assessment may underestimate threat due to simplicity of exploit." Good. - prevalence: The CRM Memberships plugin: how popular? It's a WordPress plugin. I can check its install base: I'm not sure, but "CRM Memberships" is not a top plugin. It might have a few thousand active installs. I'd estimate low to medium. Since it's a niche membership plugin, I'll say "low". But I'll see: WordPress plugin directory can have installs; but without that data, I'll go with "low" because it's not a commonly used plugin like WooCommerce, Yoast, etc. So prevalence: low. Basis: "niche WordPress membership plugin with limited install base". If unknown, but I'll infer low from typical membership plugins. I'll output "low", basis: "specialized WordPress plugin with limited deployment footprint". - prevalence_basis: "niche WordPress membership plugin, not widely distributed" - assessed_cvss_vector: I'll produce my own CVSS 3.1 vector. The description says unauthenticated, via network, no user interaction, scope unchanged, impacts confidentiality, integrity, availability all high. So AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exactly same as provided. That's appropriate. So vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H". Rationale: "Unauthenticated network attack with no user interaction, complete compromise of user accounts." I'll check if any nuance: attacker can reset any password, leading to full account takeover, so C/H, I/H, A/H sensible. - assessed_cvss40_vector: CVSS 4.0 base. We need to map. Attack Vector: Network (AV:N), Attack Complexity: Low (AC:L), Attack Requirements: None (AT:N), Privileges Required: None (PR:N), User Interaction: None (UI:N). Scope? In CVSS 4.0, we have VC/VI/VA (vulnerable system impact) and SC/SI/SA (subsequent system impact). This is a web application, so vulnerable system is the WordPress instance. Attacker gains account access, leading to high impact on confidentiality, integrity, availability of that system. So VC:H/VI:H/VA:H. No subsequent system impact, so SC:N/SI:N/SA:N. So CVSS 4.0 vector: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N". That seems correct. Now, the final output. Ensure all fields are strings. I'll craft each paragraph. Note: The description says "privilege escalation via password reset" and "unauthenticated attackers to reset arbitrary user passwords and gain unauthorized access to user accounts". So that's clear. No KEV. EPSS 0.29%. I'll incorporate. Technical context: CWE-862 Missing Authorization. The plugin likely registers AJAX hooks using WordPress's wp_ajax_ and wp_ajax_nopriv_ actions. The ntzcrm_changepassword action is registered for both authenticated and unauthenticated users but lacks a capability check or nonce verification, allowing anyone to trigger password change. The companion ntzcrm_get_users endpoint similarly lacks authentication,
TUUI is a desktop MCP client designed as a tool unitary utility integration.