---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (b7fbaf60d3813c0d52e335186747dfa13e16fa57ccee7d2d8eae98ff934c65f1)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (201d976bc7bd3e345703c69d8c33643b16d9dabef46f89f6597431099bbd7a03)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (ac16744db76e49aa639e24e1f93f1c19d4749be627e3a7ae9bed81542d420602)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (d04df189f365cdb769c70106df30ccb3a1a54af26f171fd1b5bf2043fb3052ba)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: ghsa-malware (3f6babb78a1cf14c8a826db08ef23dcd1b915450e5e0fcf904d44e9b83bd0add)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
CVE-2026-112256 is a critical vulnerability in OpenText Advanced Authentication Server that allows acceptance of extraneous untrusted data alongside trusted data. This flaw leads to accessing functionality not properly constrained by access control lists (ACLs), potentially enabling unauthorized actions. The vulnerability affects versions from 6.4.0.0 through 6.4.3.8, 6.5.0.0 through 6.5.0.10, and 6.6.0.0 through 6.6.1.0. Fixed versions are 6.4.3.9, 6.5.0.11, and 6.6.2.0. The CVSS 4.0 score is 9.2, indicating a critical severity level.
A path traversal vulnerability exists in the MasterStudy LMS plugin for WordPress versions before 3.7.50. Authenticated users with Subscriber-level privileges can exploit this flaw by supplying directory traversal sequences in a specific AJAX parameter, allowing them to import arbitrary WXR XML files. This enables attackers to publish posts with attacker-controlled content under their identity without proper capability checks or nonce verification.
A missing authorization vulnerability exists in Cozmoslabs Profile Builder up to version 4.0.5. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of data. The vulnerability does not impact confidentiality or availability but can affect data integrity.
The MasterStudy LMS plugin for WordPress versions before 3.7.50 has a missing authorization vulnerability. This flaw allows any authenticated user, including those with minimal privileges such as Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without proper capability or nonce validation. Exploitation can lead to an uncaught PHP fatal error that may disclose the absolute filesystem path of the plugin if PHP error display is enabled.
A Missing Authorization vulnerability (CWE-862) exists in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons up to version 3.4.2. This flaw allows unauthorized access due to incorrectly configured access control security levels. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact with low confidentiality impact and no integrity or availability impact.
A missing authorization vulnerability exists in the WP User Frontend plugin by weDevs, affecting versions up to 4.3.13. This flaw allows attackers with limited privileges to exploit incorrectly configured access control levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3. No patch or official fix information is currently provided.
A missing authorization vulnerability exists in myCred up to version 4.0.2, allowing exploitation of incorrectly configured access control security levels. This flaw could enable unauthorized access to certain functions or data within the affected software.
A missing authorization vulnerability exists in the miniOrange Page Restriction WordPress plugin up to version 1.6.1. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS score of 5.3, indicating a medium severity level.
A missing authorization vulnerability exists in the WP User Frontend plugin by weDevs, affecting versions up to 4.3.13. This flaw allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a CVSS score of 5.3, indicating a medium severity impact primarily on integrity without affecting confidentiality or availability.
A Missing Authorization vulnerability exists in StylemixThemes MasterStudy LMS up to version 3.7.55. This flaw involves incorrectly configured access control security levels, potentially allowing unauthorized access to certain functionality or data. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploits or patches are currently documented.
A missing authorization vulnerability exists in Kit Kit (formerly ConvertKit) up to version 3.4.7. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain resources or functions. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.
A DOM-Based Cross-site Scripting (XSS) vulnerability exists in David Lingren's Media Library Assistant up to version 3.42. This vulnerability involves improper neutralization of input during web page generation, which can lead to execution of malicious scripts in the context of the affected web application.
An authorization bypass vulnerability exists in EventPrime EventPrime eventprime-event-calendar-management, allowing privilege abuse via a user-controlled key. This affects versions up to 4.3.6.0. The vulnerability has a medium severity with a CVSS score of 5.4.
A stored cross-site scripting (XSS) vulnerability exists in Crocoblock JetElements For Elementor up to version 2.9.2.6. This flaw involves improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can impact confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity.
A Cross-Site Request Forgery (CSRF) vulnerability exists in WPFunnels up to version 3.13.5. This vulnerability allows an attacker to induce a user to perform unwanted actions on a web application in which they are authenticated. The CVSS score is 4.3, indicating a medium severity level with low complexity and no privileges required for exploitation.