Threat Intelligence Database

A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experiment.py of the component LoRA Loading. This manipulation of the argument base_model_name_or_path causes inclusion of functionality from untrusted control sphere. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.

BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.

A stored Cross-Site Scripting (XSS) vulnerability exists in the WPVR WordPress plugin versions from 8.5.49 up to but not including 9.0.3. The plugin fails to properly sanitize and escape certain tour hotspot content before storing and displaying it on the front end. This flaw allows users with Contributor role or higher to inject malicious scripts that execute in the browsers of users viewing the affected tours.

GeoDirectory WordPress plugin versions before 2.8.194 have an improper access control vulnerability that allows unauthenticated attackers to modify guest-submitted listings when guest posting is enabled. Attackers can edit, unpublish, attach images to, or reassign any listing submitted by logged-out users without verifying ownership.

GeoDirectory WordPress plugin versions before 2.8.194 contain a code injection vulnerability due to improper escaping of administrator-defined text when generating PHP files. This flaw allows high privilege users, such as subsite administrators on multisite networks who normally cannot execute code, to achieve Remote Code Execution (RCE) that can be triggered by any unauthenticated visitor.

GeoDirectory WordPress plugin versions before 2.8.194 contain a stored Cross-Site Scripting (XSS) vulnerability. This occurs because some map shortcode attributes are not properly sanitized or escaped before being output within a style attribute. Users with Contributor role or higher can exploit this to inject malicious scripts that execute in the context of any user viewing the affected content.

GeoDirectory WordPress plugin versions before 2.8.194 contain an information exposure vulnerability. The plugin's unauthenticated AJAX handler does not verify status, ownership, or password when loading listings, allowing unauthenticated users to access non-public listings such as draft, pending, and private entries by specifying their IDs.

GeoDirectory WordPress plugin versions before 2.8.194 contain a path traversal vulnerability that allows users with Subscriber-level access or higher to read and delete files outside the web root. This occurs because the plugin does not properly validate user-supplied image URLs used as local file paths when saving front-end listings. The vulnerability is limited to files with allowed media extensions. Exploitation results in the disclosed file being publicly accessible and the original file being deleted.

GeoDirectory WordPress plugin versions before 2.8.194 have an information exposure vulnerability. The plugin does not verify status or ownership when rendering a listing's map-popup via certain REST routes. This allows unauthenticated users to access title, permalink, and card fields of non-public listings including draft, pending, private, and trashed entries.

GeoDirectory WordPress plugin versions before 2.8.194 contain an authorization bypass vulnerability. This flaw allows users with Subscriber-level access or higher to modify image metadata such as title, caption, moderation status, and featured flag for images attached to listings owned by other users. The issue arises because the plugin does not verify that the referenced attachment belongs to the listing being saved.