Design Scuole Wordpress Theme
Monthly
Authorization bypass flaws in the 'Design Scuole Italia' WordPress theme (design-scuole-wordpress-theme, versions up to and including 2.17.3) let an unauthenticated remote attacker reach content and data that should require a logged-in, authorized user. The faulty routines are the dsi_pdf_generator and dsi_csv_generator functions, and an unauthenticated RSS feed at /circolare/feed/ gives an additional, easily scriptable path to the same restricted 'Circolare' records and registered-user information. With a CVSS 4.0 base score of 8.7, no privileges or user interaction required, and high confidentiality impact, this is a straightforward data-exposure bug in a theme deployed mainly on Italian school websites; no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated path traversal in the Design Scuole Italia WordPress theme allows any remote attacker to read arbitrary files that are readable by the web server process, including wp-config.php and its database credentials. The flaw (CWE-22) lives in the reserved_file_check() function of the theme's functions.php and carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H). The issue was reported by ENISA and flagged by Italy's ACN; no public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV.
The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).
A reflected cross-site scripting (XSS) flaw in the Italian government school WordPress theme "Design Scuole Italia" lets an unauthenticated attacker run arbitrary JavaScript in a victim's browser by luring them to a crafted URL whose archive parameter is echoed unsanitized by filters-scheda-didattica.php. All versions from 1.0 through 2.18.2 are reported affected by ENISA/EUVD. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but any site running the theme is exposed to session theft, credential phishing and drive-by redirects against visitors and logged-in administrators alike.
Authorization bypass flaws in the 'Design Scuole Italia' WordPress theme (design-scuole-wordpress-theme, versions up to and including 2.17.3) let an unauthenticated remote attacker reach content and data that should require a logged-in, authorized user. The faulty routines are the dsi_pdf_generator and dsi_csv_generator functions, and an unauthenticated RSS feed at /circolare/feed/ gives an additional, easily scriptable path to the same restricted 'Circolare' records and registered-user information. With a CVSS 4.0 base score of 8.7, no privileges or user interaction required, and high confidentiality impact, this is a straightforward data-exposure bug in a theme deployed mainly on Italian school websites; no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated path traversal in the Design Scuole Italia WordPress theme allows any remote attacker to read arbitrary files that are readable by the web server process, including wp-config.php and its database credentials. The flaw (CWE-22) lives in the reserved_file_check() function of the theme's functions.php and carries a CVSS 4.0 base score of 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H). The issue was reported by ENISA and flagged by Italy's ACN; no public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV.
The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).
A reflected cross-site scripting (XSS) flaw in the Italian government school WordPress theme "Design Scuole Italia" lets an unauthenticated attacker run arbitrary JavaScript in a victim's browser by luring them to a crafted URL whose archive parameter is echoed unsanitized by filters-scheda-didattica.php. All versions from 1.0 through 2.18.2 are reported affected by ENISA/EUVD. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but any site running the theme is exposed to session theft, credential phishing and drive-by redirects against visitors and logged-in administrators alike.