Bouncy Castle for Java versions before 1.86 contain a vulnerability in the high-level OpenPGP API where it incorrectly accepts data signatures made by signing subkeys lacking the required embedded Primary Key Binding signature. This causes misattribution of genuine signatures to attacker-controlled certificates, potentially misleading verifiers about the signature's origin. The issue arises because the subkey inherits signing capability improperly when the Subkey Binding signature omits a Key Flags subpacket, violating RFC 9580 requirements. The low-level API is unaffected. This vulnerability does not allow private key recovery or signature forgery but enables attackers to bind a victim's public subkey to their own primary key, causing signature misattribution.
Bouncy Castle for Java versions before 1.86 contain a vulnerability in the BLS12_381BasicScheme.keyValidate method and related classes that accept public keys constructed on non-canonical elliptic curves with a forged cofactor. This flaw allows an attacker to create a phantom signer in aggregate signature verification by passing a public key that is not a valid G1 point but is accepted due to insufficient curve validation. The issue only arises if an application explicitly constructs ECPoints on non-standard curves; the standard compressed-point decoder is unaffected.
Bouncy Castle for Java versions before 1.86 and certain LTS and FIPS versions contain a vulnerability in the PKIXCertPathReviewer classes where X.509 name constraints were not applied to the end-entity (leaf) certificate. This caused the validation to incorrectly accept certificate chains whose leaf certificates violated name constraints imposed by their issuing CA. The issue affects both the modern and legacy PKIXCertPathReviewer implementations and was fixed by ensuring all certificates in the path, including the leaf, are checked according to RFC 5280 requirements.
Bouncy Castle for Java versions before 1.86 and certain LTS and FIPS versions contain a vulnerability in the streaming CMS AuthenticatedData parser. The parser incorrectly accepts messages where the digestAlgorithm and authAttrs fields disagree about the presence of authenticated attributes, allowing an attacker to insert unauthenticated attributes into a message. This could lead to applications acting on attacker-chosen attribute values, although the content itself remains protected by the MAC.
Bouncy Castle for Java versions before 1.86 contains a vulnerability in the validation of MLS (RFC 9420) external commit proposal lists. The flaw allows an external joiner to remove any member from the group and take over their slot in the ratchet tree by exploiting improper validation of Remove proposals. This occurs because the validation did not ensure that the removed leaf was related to the joiner, and the credential check was missing except in a limited test harness. The issue is fixed by requiring the removed leaf's credential to match the joiner's new leaf credential on both sending and receiving sides.
Bouncy Castle for Java versions before 1.86 contain a vulnerability in the Messaging Layer Security (MLS) implementation where an X.509 credential is not properly bound to a LeafNode's signature key. This allows an attacker to present another party's certificate as their credential while signing with an unrelated key, potentially impersonating that party. The vulnerability affects deployments that accept external commits without independent credential admission checks. The issue is fixed by requiring the end-entity certificate's public key to match the signature key as per RFC 9420 section 5.3. Deployments using only basic credentials are not affected.
Bouncy Castle for Java versions before 1.86 have a flaw in the opt-in key-size validation for CMS key-transport recipients when using RFC 9709 content-encryption key derivation (id-alg-cek-hkdf-sha256). The validation check fails due to an incorrect comparison between a byte array and an ASN1ObjectIdentifier, causing the key size check to be skipped. This allows acceptance of EnvelopedData or AuthEnvelopedData messages with mismatched key sizes despite validation being enabled. The issue also affects Bouncy Castle for Java FIPS versions before bcpkix-fips 2.0.13 and 2.1.13. Non-HKDF messages and recipients without validation enabled are not affected.
A use-after-free vulnerability exists in the sqlite3-ruby gem when defining aggregate functions with two or more arguments evaluated over TEXT or BLOB columns. This can cause the Ruby objects holding arguments to be freed prematurely during garbage collection, leading to incorrect objects being passed to the aggregate's step method or a process crash. The vulnerability affects Mailcatcher versions from 0.8.1 up to but not including 0.11.0. The maintainers rate this as medium severity with a CVSS 4.0 score of 6.3. The issue is fixed in sqlite3 gem version 2.9.6 or later.
A path traversal vulnerability exists in Linux Mint Xreader versions 4.6.0 through 4.6.5 in the EPUB File Handler component. This flaw allows remote attackers to manipulate file paths via the setup_document_content_list/g_strdup_printf function in the backend/epub/epub-document.c file. The vulnerability is addressed by upgrading to version 4.6.6. Notably, EPUB support was removed from Xreader and reimplemented in a separate project called Xepub.
The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a Beaver Builder page containing the Sidebar module populated with a widget that displays attacker-controllable text, such as the core Recent Comments widget, with comment moderation disabled or the attacker's comment approved.
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The nonce required to pass the only gate is emitted to unauthenticated visitors via the public review form, and submitted shortcode payloads are auto-published without admin approval by default, meaning exploitation requires no account and no privileged interaction.
The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, clone, and delete email notification flows, including overwriting the default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate address, or destroying reservation notification flows entirely. The vulnerable endpoints are active by default on every WPCafe installation without any configuration requirement, as the Email_Automation_Service_Provider::is_enable() method unconditionally returns true and the plugin ships with five pre-configured default email flows upon activation.
The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This exploit is only possible on installations where an administrator has saved a role-based deny-list Access Privilege configuration that does not explicitly block the internal 'access-privilege' module, as this condition allows the authorization filter to implicitly permit Subscriber-level users to invoke the vulnerable handler.
The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.
The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to, and including, 8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: an unauthenticated attacker submits a crafted referrer URL to the wmcTrack tracking endpoint, which persists the raw unescaped value into the wp_logVisit table, and the injection is triggered when an administrator next views the Traffic Sources dashboard.
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. The bypass relies on WordPress's own strip_shortcodes() function unwrapping the [[tag]] double-bracket escape to a bare [tag] that survives wp_insert_post storage and fires when the publicly queryable xs_review post type is rendered through the_content.
The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires at least one File-type custom field to be published on the confirmation page shortcode, as this field is not created by default during plugin installation.
The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a separately installed plugin, such as Contact Form 7, that passes unauthenticated user-controlled input into mail fields whose content PHPMailer will include in its failure error message.