Search: 7.3.1.1

The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.

Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue affects Examples for Developers versions: from 0.0.0 to 4.0.7.

A stored cross-site scripting (XSS) vulnerability exists in the Drupal CSV Field module affecting versions from 0.0.0 up to but not including 2.0.10, and from 3.0.0 up to but not including 3.0.7. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts.

CVE-2026-114530 is an incorrect authorization vulnerability in the Drupal Dopup module that allows forceful browsing. This affects Dopup versions from 0.0.0 up to but not including 1.0.7. The issue has been fixed in version 1.0.7.

CVE-2026-114539 is an authentication bypass vulnerability in Drupal DocCheck Basic versions 7.x. It allows bypassing authentication by exploiting an alternate path or channel. This vulnerability affects all versions from 7.0.0 up to but not including 8.0.0. No CVSS score or public exploit code is currently available, and no known exploits are reported in the wild.

A Cross-site Scripting (XSS) vulnerability exists in the Drupal Stage File Proxy module. This flaw allows improper neutralization of input during web page generation, potentially enabling XSS attacks. The vulnerability affects Stage File Proxy versions from 0.0.0 up to but not including 3.1.7, and from 4.0.0 up to but not including 4.0.1. Fixed versions are 3.1.7 and 4.0.1.

ImageMagick versions before 7.1.2-34 contain a stack overflow vulnerability in the TIFF decoder that can be triggered when the DNG decoder is disabled. An attacker can supply a crafted image file to cause a stack overflow, resulting in application crash and denial of service.

ImageMagick versions prior to 7.1.2-34 contain a heap-based buffer overflow vulnerability in the -morph processing feature. This flaw allows crafted images to cause writes beyond the bounds of a heap buffer, potentially crashing the application when processed with the -morph option.

Multiple security issues affecting the ImageMagick package version 7.1.2.34-3.1 on openSUSE Tumbleweed GA media have been fixed. These vulnerabilities are addressed in this specific package release by the SUSE Product Security Team. No detailed technical information or CVSS score is provided.

The ReadWriteLock and AsyncReadWriteLock classes in mlx-lm versions 0.30.7 through 0.32.0 resolve lock file paths following symlinks and pass them to sqlite3.connect() without preventing symlink traversal. This allows a local attacker with write access to the lock directory to cause the victim process to create or lock files at attacker-chosen locations, potentially breaking mutual exclusion and corrupting protected resources.

The msgpack-python C extension has a memory leak vulnerability triggered when deserialization rejects a map key under strict_map_key validation. This leak causes unbounded memory growth and potential denial of service when processing attacker-controlled MessagePack data. Additionally, the streaming Unpacker API may suffer from use-after-free or double free errors due to stale parser-stack references. The issue affects version 1.2.2 and development commits, with a fix available in version 2.46.7. The pure-Python fallback does not exhibit this leak. Exploitation does not impact confidentiality or integrity but can cause denial of service via resource exhaustion.

GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method where an attacker-controlled branch name can be used to inject arbitrary file read commands. This occurs because the branch name positional argument is not properly sanitized before being passed to the underlying git checkout command, allowing an attacker to read sensitive files such as /etc/passwd. The issue arises from an incomplete fix of previous advisories, where only keyword arguments were guarded but not positional arguments. The vulnerability has a CVSS 3.1 score of 7.5 (High).

Authlib versions up to 1.7.2 accept an empty HMAC key for JWS/JWT signature verification using HS256, HS384, and HS512 algorithms. This allows an attacker to forge tokens with arbitrary claims that pass signature verification if the application verifies tokens with an empty key. The vulnerability arises because empty keys produce deterministic, publicly reproducible HMAC digests, and no check rejects zero-length keys in the affected versions.

Authlib versions from 0.13 through 1.7.2 contain a vulnerability in the is_secure_transport() function, which incorrectly treats certain HTTP URLs with a userinfo component as secure loopback addresses. This allows an attacker to bypass the TLS enforcement by crafting URLs like http://localhost:80@evil.example/cb, which are accepted as secure despite being cleartext HTTP to an external host. The flaw affects OAuth 2.0 / OIDC endpoint and redirect URI validation, potentially allowing cleartext non-loopback URLs to be accepted where TLS is required. The severity is low, and a fix is available in version 1.50.0.