CallBackery versions prior to 0.62.0 for Perl have an insufficient session timeout vulnerability. Session cookies sent via the X-Session-Cookie header are accepted regardless of age, allowing indefinite authentication if the cookie is leaked. The cookieConf() function only enforces a 300-second timeout on cookies sent via the xsc query parameter, not the header. This flaw can lead to unauthorized persistent access if session cookies are exposed through logs, Referer headers, or browser history.
Business-GoCardless versions before 1.01 for Perl contain a vulnerability that allows remote attackers to exhaust memory by sending specially crafted webhook payloads. The flaw arises because legacy webhook payloads are flattened into key-value pairs without limits or throttling before signature verification, causing memory usage proportional to the payload size. This can lead to denial of service via memory exhaustion.
Starlet versions before 0.33 for Perl contain a vulnerability where a remote attacker can send a request with a large Content-Length header, causing the worker process to exhaust memory and exit with an uncatchable error. This leads to a denial of service by forcing worker restarts with minimal requests.
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution.
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because Post Excerpt, Post Custom Field, and Rich-Text-Editor-enabled Paragraph Text fields allow raw HTML submissions via allow_html(), and an entity-encoded payload stored in a data-dialog-confirm attribute evades wp_kses_post() at save time but is decoded into executable markup by the browser when the plugin's admin JavaScript passes the attribute value to insertAdjacentHTML().
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL Injection via the 'pgroup' parameter in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A Contributor-level user can trigger the vulnerable code path by authoring a post containing the [jsMatchPlayerList] shortcode with a malicious pgroup value and previewing it, as WordPress allows shortcode execution during post preview for the post's author.
The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator.
A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.
The msgpack-python C extension has an unbounded memory leak triggered when deserialization rejects a map key under strict_map_key validation. This leak occurs because the decoded map value is not released on error, causing process memory growth and potential denial of service. Additionally, the streaming Unpacker API may suffer from a use-after-free or double decrement issue due to stale parser-stack references. The pure-Python fallback does not exhibit this leak. The issue affects msgpack-python version 1.2.2 and development commits, with a fix available in version 13.8.0_3 of the affected product.
A vulnerability in virtualenv's bash activation script allows an attacker-controlled prompt value to be inserted unescaped into the PS1 environment variable when the bash shell option 'promptvars' is off at activation time. Because 'promptvars' and posix mode can be re-enabled later in the same shell or in child shells, the stored prompt value is expanded and any embedded command substitutions are executed. This regression was introduced in version 21.14.9 and persists through 21.14.12. The issue affects the bash 'bin/activate' script and can lead to command execution as the user activating the environment.
PyJWT versions up to 2.13.0 and current master at commit 7144e4534c34810f4525dc4578a32addd8212cff contain a vulnerability where the HMACAlgorithm.from_jwk method accepts an empty HMAC key from a symmetric oct JWK without rejection. This allows an attacker to forge tokens by using an empty key, bypassing signature verification when the key is resolved from a JWK/JWKS containing an empty 'k' value. The issue arises because the empty-key rejection added in 2.13.0 for string/bytes secrets was not applied to the JWK verification path. The vulnerability requires no authentication but depends on the verifier accepting a JWK with an empty key, which can happen due to misconfiguration or trusting a JWKS with such an entry. A fix is available in PyJWT version 5.43.0.
GitPython's Remote.pull() method improperly handles the positional refspec argument, allowing an attacker to supply a malicious option-like value such as --upload-pack=<command>. This bypasses the unsafe-option guard that only inspects keyword arguments, resulting in arbitrary command execution with the privileges of the calling process. Exploitation requires the remote to use a local-path or SSH transport, as HTTPS ignores the upload-pack option. The vulnerability affects GitPython versions from 1.0.1 up to but not including 1.6.1_1 and is fixed in version 1.6.1_1.
A vulnerability in virtualenv allows attacker-controlled prompt text to be interpreted as executable syntax in the bash activation prompt under older bash compatibility modes (4.2 and lower) and certain POSIX shell scenarios. This occurs when an attacker influences the prompt value passed to virtualenv, and a user activates the environment with the crafted prompt. The issue affects the POSIX activation scripts and certain shells like dash when PS1 is exported, leading to command execution upon prompt display. The vulnerability was introduced in virtualenv 20.0.0b1 and 21.14.7 and fixed in versions 2022.8.7_1 and 2026.10.20.
PyJWT versions up to 2.13.0 and current master before 2.26.0 contain a vulnerability where the HMAC verification accepts an empty key when using octet JWKs. This allows an attacker to forge tokens without knowing any secret if the application verifies tokens using a JWK/JWKS with an empty 'k' value. The issue arises because the empty key rejection implemented for string/bytes keys is not applied to keys loaded from JWKs. The vulnerability is fixed in PyJWT version 2.26.0.