OAuth state validation bypass in better-auth before 1.6.2 enables network-based attackers to forge the OAuth callback state parameter and supply attacker-controlled authorization codes, creating authenticated sessions in the victim's browser that are cryptographically bound to the attacker's external identity. Account-linking flows are equally exposed, permitting the attacker's provider account to be persistently linked to an authenticated victim row in the application's user store. Exploitation is constrained to a specific non-default configuration (cookie-backed state storage with PKCE disabled), and no public exploit has been identified at time of analysis.
Out-of-bounds read in Zephyr RTOS DHCPv4 client (versions 1.7.0 through 4.4.x) allows an adjacent-network attacker to crash the DHCP client or leak adjacent pointer contents by sending a crafted DHCP reply with a message-type value greater than 8. The defect is a classic sizeof-vs-ARRAY_SIZE confusion: the bounds guard compares a raw msg_type byte against the byte-size of a pointer array (32 or 64, depending on architecture) rather than its element count of 8, so values 9-31/63 bypass the check and cause a wild-pointer dereference inside a debug log call. Exploitation is gated on a non-default build configuration (CONFIG_NET_DHCPV4_LOG_LEVEL_DBG), substantially reducing the real-world attack surface. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Sensitive WooCommerce order data exposure in the PixelYourSite WordPress plugin (all versions through 11.2.1) allows unauthenticated remote attackers to retrieve full purchase metadata - product names, quantities, per-item prices, order totals, currency, and transaction IDs - for any order by supplying an arbitrary or invalid order key alongside a known order ID. The plugin's getWooPurchaseEventParams function resolves orders solely from the URL path order ID without validating the accompanying key, then emits the complete woo_purchase tracking payload directly into rendered page HTML via the pysOptions JavaScript object across all three supported integrations (Facebook Pixel, Google Analytics, and Google Tag Manager). No public exploit has been identified at time of analysis, but because WooCommerce order IDs are sequential integers by default, mass enumeration of the entire order history requires only a trivial HTTP loop.
Authorization bypass in the Gutena Forms WordPress plugin (all versions through 1.9.0) enables unauthenticated remote attackers to permanently trash or toggle the read/unread status of arbitrary form submission entries across any form on the affected site. The root cause is a fatally weakened nonce check: the nonce action 'gutena_Forms' is broadcast to all anonymous site visitors via wp_localize_script() on any page embedding a Gutena Forms block, rendering the check_ajax_referer() call functionally useless as an authorization control. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE, though the low-complexity, zero-authentication attack vector means any anonymous internet user can exploit this without special tooling against any affected installation.
Divide-by-zero in FreeRDP's rdpecam camera redirection channel allows a malicious or compromised RDP server to crash the connecting client process by sending a StartStreamsRequest PDU with FrameRateDenominator set to zero. All FreeRDP releases up to and including 3.28.0 are affected when camera redirection is enabled; exploitation delivers a reliable client-side denial-of-service (SIGFPE termination) with no code execution potential. No public exploit or CISA KEV listing exists at time of analysis; this is a medium-severity availability issue patched in FreeRDP 3.29.0.
Out-of-bounds read in FreeRDP 3.28.0 and earlier allows a malicious or compromised RDP server to leak client-side memory contents or crash the FreeRDP process by sending a crafted truncated planar-encoded bitmap or surface update. The flaw lives in the RDP6 planar RLE decoder (libfreerdp/codec/planar.c), where attacker-declared raw byte counts of 0-15 bytes following a bounds-checked control byte are consumed without verifying remaining buffer space. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; FreeRDP 3.29.0 contains the confirmed vendor patch.
Time-based blind SQL injection in the Database Collation Fix WordPress plugin (versions ≤ 1.2.10) allows remote attackers to extract sensitive information from the WordPress database via the 'force-collation-algorithm' parameter. Exploitation is gated on a non-default precondition: a trigger.txt file must exist in the plugin directory, a state created only by DesktopServer lifecycle events such as site creation, import, or deploy operations. No public exploit code and no CISA KEV listing have been identified at time of analysis, substantially limiting real-world exposure to sites with an active DesktopServer integration history.
Serial device redirection in FreeRDP before 3.29.0 exposes RDP clients to a server-induced denial of service via a reachable assertion in the serial channel plugin. A malicious or compromised RDP server can send a crafted IRP_MJ_DEVICE_CONTROL request referencing an unsupported IOCTL with a non-zero OutputBufferLength, causing CommDeviceIoControl() to return BytesReturned=0 and firing the WINPR_ASSERT that aborts the client process. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the server-controlled trigger makes this straightforward to weaponize against users connecting to untrusted servers with serial redirection enabled.
Path traversal in FreeRDP's RDPDR drive redirection channel (all versions before 3.29.0) enables a malicious RDP server to read, write, delete, and enumerate files on the client host outside the configured shared root directory. The server exploits absent boundary validation to supply non-rooted paths that escape to prefix-sibling directories - directories sharing a parent with the shared root but outside it. No public exploit code or CISA KEV listing has been identified; the vendor has released a fix in version 3.29.0.
Unauthenticated sensitive information disclosure in the WooCommerce PayPal Payments WordPress plugin (all versions through 3.3.2) allows remote attackers to harvest full customer billing PII from recently placed orders. The vulnerability is a two-stage IDOR chain: the `enqueue_paypal_insights_script_on_order_received()` function exposes order keys without validating the caller's identity, and those keys can then be replayed against the WooCommerce Store API - which grants a 10-minute post-order grace period - to retrieve names, email addresses, phone numbers, and street addresses. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the network-reachable, zero-authentication attack path and PII sensitivity elevate practical risk above the CVSS 5.3 numeric score.
Cross-tenant insecure direct object reference in OpenRemote versions up to and including 1.26.2 allows an authenticated attacker to bypass realm access controls in the AlarmResourceImpl.setAssetLinks endpoint, disclosing victim tenant asset names and persisting unauthorized cross-realm alarm-asset links. The flaw stems from a structurally incomplete authorization check that validates only the first realm returned by non-deterministic HashSet iteration rather than all realms submitted in the request, making the attack probabilistically repeatable until successful. No public exploit has been identified at time of analysis; the issue was fixed in version 1.27.0 per the vendor security advisory.
Audience-binding failure in @better-auth/oauth-provider (npm) allows authenticated OAuth clients to obtain JWT access tokens targeting resource servers never covered by the original authorization grant. Versions 1.4.8 through 1.7.0-beta.3 accept the RFC 8707 resource parameter exclusively at the token endpoint without recording it on the authorization code or the refresh-token row, meaning the authorized resource set is never enforced at redemption time. No public exploit has been identified at time of analysis, but the flaw directly undermines multi-audience OAuth deployments where resource servers enforce authorization based on the JWT aud claim.
Reflected XSS in better-auth's /api/auth/error endpoint enables arbitrary JavaScript execution in a victim's browser when a user visits an attacker-crafted URL containing a malicious 'error' query parameter that is reflected as unsanitized HTML. All npm releases of better-auth from version 0.0.2 up to (but not including) 1.1.16 are affected, spanning virtually the entire release history of the library. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the attack surface is inherently internet-accessible and requires only social engineering to trigger.
Stale session persistence in better-auth allows deleted users to maintain authenticated access for up to seven days after account removal. Affected are deployments of better-auth versions 0.3.4 through 1.6.10 running with secondaryStorage (Redis, KV, or similar external cache) and the default storeSessionInDatabase=false setting, where user deletion flows through the admin, anonymous, or SCIM plugins. Because deleteSessions is never called before deleteUser in these code paths, the session payload remains live in the cache until TTL expiry, meaning a terminated employee or compromised account that has been administratively deleted can continue making authenticated requests. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting in JupyterLab's Extension Manager allows an attacker who publishes a malicious PyPI package to execute arbitrary JavaScript in the JupyterLab browser origin. The frontend in widget.tsx renders PyPI package metadata URLs as raw anchor hrefs without protocol validation, so a `javascript:` URL placed in `[project.urls]` metadata fires the moment a victim clicks the extension name. Affects all JupyterLab releases before 4.5.9; no confirmed active exploitation (not in CISA KEV) but the attack barrier is low - only a PyPI account is required to stage the payload.
Stored XSS in better-auth's deprecated oidc-provider and mcp plugins allows an attacker to register an OAuth client with a javascript: redirect_uri, which the authorization server stores and later returns unchanged in the consent response. If the deployment's consent page is a client-side component that assigns the returned redirectURI to window.location.href or equivalent, the attacker's JavaScript executes in the authorization-server origin - exposing the victim's session tokens and enabling account takeover. No public exploit or CISA KEV listing has been identified; the CVSS 4.0 score of 5.1 reflects required user interaction and limited subsequent-system impact, though deployments with unauthenticated dynamic client registration face elevated real-world risk.
Zip Slip path traversal in the Kirki WordPress plugin (all versions through 6.0.13) enables authenticated attackers with custom-level access or above to write arbitrary files anywhere on the server, leading to remote code execution. The root cause is the plugin's app installation and update workflows - install_app, update_app, and get_kirki_template_from_zip - which fetch a user-supplied external ZIP URL via an unsanitized app src parameter and extract its contents without validating entry names for path-traversal sequences. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the write-to-RCE escalation path is mechanically straightforward once the authentication bar is cleared.
SQL injection in the WPvivid Backup & Migration WordPress plugin (versions ≤0.9.131) allows authenticated Administrators to extract arbitrary data from the WordPress database via a crafted export_data parameter. The flaw exists because JSON object keys supplied by the attacker pass through sanitize_text_field() and stripslashes() but are never integer-cast, allowing them to be stored and later interpolated unsanitized into a WHERE ID IN (...) SQL clause without wpdb->prepare() or esc_sql(). No public exploit or active exploitation has been identified; the Administrator privilege requirement substantially constrains real-world impact.
SQL injection in the Icegram Mailer WordPress plugin (versions up to and including 1.0.12) enables authenticated WordPress administrators to extract arbitrary data from the underlying database by manipulating the 'fields' parameter submitted to the email log view. The vulnerable code path in Icegram_Mailer_Logs_Table::get_logs() concatenates user-supplied array elements verbatim into a SQL SELECT clause via PHP implode() with no whitelist, escaping, or prepared-statement binding. No active exploitation has been confirmed (not listed in CISA KEV), no public POC is referenced, and a code-level fix is visible in the plugin's SVN repository at changeset 3627122, though the exact patched release version is not independently confirmed from available data.
SQL injection in the GSheetConnector CF7 Google Sheets Connector WordPress plugin (all versions through 5.2.1) enables authenticated administrators to exfiltrate arbitrary database contents via the unsanitized 's' search parameter. The root cause is a flawed sanitization chain: wp_unslash() removes magic-quote escaping while sanitize_text_field() fails to neutralize SQL metacharacters, leaving single quotes intact before direct query interpolation. No public exploit or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references confirming the vulnerable code paths in class-gs-cf7db-formEntryList.php and gs-cf7db.php.
Blind SQL injection in the Pinpoint Booking System - Version 2 WordPress plugin (all versions through 2.9.9.6.9) allows authenticated administrators to extract arbitrary data from the underlying WordPress database via the unsanitized 'field' parameter. The vulnerability resides in the backend calendar class (class-backend-calendar.php) and is reachable by any user holding administrator-level access; the required nonce is trivially obtainable from any plugin admin page loaded under manage_options, eliminating any meaningful anti-CSRF barrier once admin credentials are possessed. No public exploit code or active exploitation has been identified at time of analysis.
Authorization bypass in the RealHomes Memberships WordPress plugin (inspiry-memberships, all versions through 3.0.9) allows any authenticated subscriber to self-assign premium membership tiers without completing a PayPal transaction. The plugin's PayPal payment handler fails to verify user authorization before processing membership upgrades, enabling subscribers to generate falsified active payment receipts and unlock restricted property listing allowances. No public exploit has been identified at time of analysis, and the CVSS score of 4.3 (PR:L) reflects that exploitation is limited to authenticated users.
Jeg Kit for Elementor exposes sensitive site configuration data to any authenticated WordPress user with Contributor-level access or above through an unguarded inline JavaScript object injected on the post editor page. The `enqueue_scripts()` method outputs a `JkitDashboardOption` object containing installed plugin names, versions, file paths, active statuses, WordPress and PHP versions, site URLs, server capabilities, and - critically - potentially a Mailchimp API key stored in `jkit_user_data`. No public exploit or CISA KEV listing exists at time of analysis, but the low authentication barrier (Contributor) and the API credential exposure risk elevate real-world impact above the Medium CVSS score alone suggests.
Cross-site request forgery in the Theme Editor WordPress plugin (all versions ≤ 3.1) enables modification of child theme CSS styles by exploiting absent nonce validation on the ms_update AJAX action. An unauthenticated network attacker who social-engineers a logged-in WordPress administrator into loading a crafted page can silently overwrite child theme CSS without any direct interaction with the WordPress backend. No public exploit code or active exploitation has been identified at time of analysis; the mandatory administrator interaction (UI:R in CVSS) is the primary friction limiting opportunistic mass exploitation.