CVE-2026-78192 is a vulnerability in WebDyne versions from 2.022 up to but not including 3.022 that allows unauthenticated remote attackers to read application source code via the default index page's source viewer. This exposure includes Perl source files and embedded credentials within __PERL__ blocks of .psp pages. The issue arises because WebDyne's wrapper scripts enable the built-in index page by default, which returns files specified by the source parameter in HTMX requests.
WebDyne versions from 2.031 up to but not including 3.022 contain a vulnerability where files with .psp anywhere in their name are executed as Perl pages due to a regular expression lacking an end anchor. This allows an attacker to upload files with names like report.psp.pdf and have them executed as Perl scripts by requesting the file, bypassing simple extension checks.
WebDyne versions from 2.014 up to but not including 3.022 contain a cross-site scripting (XSS) vulnerability. This occurs because certain form tags (textfield, password_field, filefield) reflect request parameters into their value attributes without proper escaping. The default escaping control (WEBDYNE_CGI_AUTOESCAPE) is off, and from version 2.022 the entity encoding method was replaced with a no-op, rendering escaping ineffective. An attacker can inject malicious scripts via crafted links using these tags.
CVE-2026-78189 is a path traversal vulnerability in WebDyne Perl versions from 3.007 up to but not including 3.022. It allows remote attackers to execute .psp files outside the document root by exploiting the PSGI API route fallback mechanism. The vulnerability arises because the PSGI handler does not properly sanitize path segments containing '..', enabling access to files outside the intended directory.
WebDyne versions from 2.014 up to but not including 3.022 for Perl set session cookies without the Secure, HttpOnly, and SameSite attributes. This allows browsers to send session IDs over plain HTTP and with cross-site requests, exposing them to theft by network attackers or malicious scripts. The vulnerability is fixed in version 3.022.
The doctreelstm package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The multi-convert package on PyPI contains malicious code in specific versions of its dependency 'is-it-ai'. Version 0.1.4 of the dependency includes a trigger that fingerprints the environment and contacts a remote server to download and execute a remote executable. Other versions serve as cover to hide the malicious activity. This campaign is identified as having clear malicious intent, including downloading and executing remote code.
The md-to-slides package on PyPI contains malicious code hidden in a specific dependency (is-it-ai) in version 0.1.1. This malicious code fingerprints the environment and contacts a remote server to download and execute a remote executable if instructed. Other versions appear to be decoys to conceal the malicious version. This campaign is clearly malicious and targets users by embedding harmful actions within a library dependency.
The skills-analyzer package on PyPI contains malicious code in its dependency is-it-ai version 0.1.1. This malicious code fingerprints the environment and contacts a remote server, which may respond with a URL to download and execute further malicious payloads. Other versions of the package exist to obscure the presence of the malicious version. The campaign is identified as a targeted attack with clear malicious intent, including downloading and executing remote executables.
The is-it-ai package on PyPI contains malicious code in specific versions (0.1.0, 0.1.1, 0.1.3) that, when triggered, fingerprints the environment and contacts a remote server. If the server responds with a URL, the package downloads and executes a remote executable. This behavior is part of a targeted attack campaign involving intentional inclusion of malicious code in a dependency, designed to hide malicious actions behind legitimate package versions.
The Web 2.0 Directory plugin for WordPress up to version 2.10.12 is vulnerable to a time-based SQL Injection via the 'w2dc_level_filter' parameter. This vulnerability arises from insufficient escaping and improper handling of user input in an integer context, allowing unauthenticated attackers to inject SQL queries that can extract sensitive database information. The vulnerability exploits the lack of protection against time-based payloads such as SLEEP-based conditionals.
The BuddyBoss Platform plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.6.0. This flaw arises from insufficient input sanitization and output escaping of the Group Name field. Authenticated users with subscriber-level access or higher can exploit this vulnerability to inject arbitrary scripts that execute when other users view the affected pages. Exploitation requires the "Enable social group creation by all members" setting to be enabled, which is the default configuration. If group creation is restricted to administrators, exploitation is not possible.
The NextGEN Gallery plugin for WordPress versions up to and including 4.4.1 contains a remote code execution vulnerability via the render_image function. This flaw arises from unrestricted mass assignment of user-supplied meta_data keys to the image model, combined with missing realpath containment and a bypassable signature check on the public image delivery route. Authenticated attackers with custom-level access or higher who own at least one NextGEN gallery can exploit this to execute code on the server. Notably, the condition to own a gallery can be met by any Subscriber previously granted the 'NextGEN Manage gallery' capability, which persists indefinitely even after revocation.
The Debug Log Manager plugin for WordPress up to version 2.5.2 is vulnerable to stored cross-site scripting (XSS) via the 'message' and 'pageUrl' parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires that debug logging with JavaScript error logging is enabled and that the attacker can obtain a publicly emitted nonce to bypass endpoint checks.
A file overwrite vulnerability exists in Epiphany browser when installing WebExtension packages from .xpi files. The vulnerability arises because the installer accepts TAR archives disguised as .xpi files, which can contain hard-link entries. This allows an attacker to overwrite existing user-writable files without warning when the user installs or opens a crafted malicious .xpi file. The issue affects Epiphany versions 47.0 and later and has been fixed by restricting support to ZIP format only.
The Germanized for WooCommerce plugin for WordPress versions up to 4.1.4 contains a vulnerability that allows authenticated users with Subscriber-level access or higher to access private customer data. This occurs due to improper handling of activation tokens when the "Disable login for unactivated customers" setting is set to No, which is a non-default configuration. Attackers can change their account email to a victim's billing email and redeem an original activation token to link guest orders to their account, exposing sensitive billing information. Exploitation requires public customer registration, double opt-in enabled, and token redemption within one day.