Critical severity threats

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', which Hutool's Condition parser treats as an operator, then execute commands through Jpom's script features.

WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application that accepts uploads by checking only the final extension lets a remote attacker upload a file such as report.psp.pdf and run its embedded Perl by requesting it.

WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. segments in the request path and only checks that the joined path starts with the document root, which a request for /../private passes. A remote attacker can run the embedded Perl in any .psp file the server can read, such as one uploaded to a directory outside the document root.

The Acadlix LMS plugin for WordPress up to version 1.1.9 contains a path traversal vulnerability in the post_delete_assessment_file_by_id function. This flaw allows authenticated users with subscriber-level access or higher to delete arbitrary files on the server due to insufficient file path validation. The plugin's permission check relies solely on a generic REST nonce exposed publicly, effectively allowing unauthenticated attackers to exploit this issue. Deleting critical files such as wp-config.php can lead to remote code execution. The vulnerability has a high CVSS score of 9.1, indicating critical severity.

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications WordPress plugin up to version 3.10.2 has an arbitrary file upload vulnerability. This flaw allows unauthenticated attackers to upload potentially executable files by bypassing file extension and MIME type validation using a trailing-dot filename. The vulnerability arises from missing server-side file key allowlist and improper sanitization in the handle_upload function. The only access control is a nonce embedded in public forms, which is easily accessible to any visitor. This can lead to remote code execution on affected installations.

The Project Manager – AI Powered plugin for WordPress up to version 4.1.1 contains a critical vulnerability that allows unauthenticated remote code execution. This occurs because the 'id' parameter is unsanitized and used directly in a dynamic PHP function call without validation, bypassing authorization checks. The flaw enables attackers to execute arbitrary code on the server, posing a severe risk to confidentiality, integrity, and availability.

Uncanny Toolkit for LearnDash WordPress plugin versions up to 3.8.2 contains an authentication bypass vulnerability via the email parameter in the uo_login_action() function. This flaw arises from inconsistent parsing of the email input between the plugin's account verification and WordPress's authentication, allowing attackers to bypass account approval and suspension controls. Exploitation requires only network access and knowledge of valid credentials, enabling attackers to obtain a valid session cookie without proper verification.

The WP Booking System - Booking Calendar WordPress plugin versions up to 2.1.0.5 contain a missing authorization vulnerability. This flaw allows authenticated users with Subscriber-level access or higher to delete calendar notes arbitrarily due to a missing capability check in the wpbs_action_ajax_calendar_remove_note() function.

The PDF Invoice for WooCommerce + Drag and Drop Template Builder WordPress plugin up to version 7.1.1 is vulnerable to PHP Object Injection via the 'customer_note' parameter. This vulnerability allows unauthenticated attackers to execute arbitrary code on the server by exploiting insufficient sanitization of the customer_note field during WooCommerce checkout. The attack can be triggered through the public Store API using specific payment methods that generate an invoice and invoke the vulnerable code path.

Popup Builder WordPress plugin versions up to 4.4.5 suffer from an authorization bypass vulnerability. This flaw allows unauthenticated attackers to trash all published popups via a single GET request. The issue arises because the plugin does not properly verify user authorization for this action. Additionally, a secondary flaw in the SGPopup::find() function causes all published popups to be targeted simultaneously when a specific parameter is present.