[2025.04 Vulnerability Report] Next.js Middleware Authentication Bypass The vulnerability is an authentication bypass vulnerability in Next.js, which allows an attacker to bypass access control for the API by sending the request by entering the middleware path in the x-middleware-request header or entering it to satisfy the recursive condition. The vulnerabilities were patched in Next.js versions Read more about [2025.04 Vulnerability Report] Next.js Middleware Authentication Bypass[…]

[2025.03 Vulnerability Report] HUNK COMPANION Plugin Remote Code Execution (CVE-2024-9707) This major vulnerability in the Hunk Companion plugin could be the first step in a broader exploit chain. If another plugin with a known vulnerability is activated via this vulnerability, an attacker could achieve remote code execution on the WordPress site. The widespread distribution of Read more about [2025.03 Vulnerability Report] HUNK COMPANION Plugin Remote Code Execution (CVE-2024-9707)[…]

[2025.03 Vulnerability Report] Ivanti vTM Authentication Bypass The vulnerability is an authentication bypass vulnerability in IvantivTM, which allows an attacker to create an arbitrary administrator account by bypassing access control to the loadable wizard.cgi for all sections within the web interface. The vulnerability has been patched in IvantivTM versions 22.2R1, 22.7R2, and others, and AIWAF responds Read more about [2025.03 Vulnerability Report] Ivanti vTM Authentication Bypass[…]

CVE-2024-4547 is a SQL injection vulnerability affecting Delta Electronics DIAEnergie v1.10.1.8610 and earlier. The issue lies in the CEBC.exe component that processes the ‘RecalculateScript’ message, which contains four fields separated by the ‘~’ character. An unauthenticated remote attacker could exploit this vulnerability by manipulating the fourth field to inject malicious SQL statements, which could lead Read more about [2025.02 Vulnerability Report] Delta Electronics DIAEnergie SQL Injection(CVE-2024-4547)[…]

The vulnerability is a pre-authentication RCE vulnerability in Apache OFBiz, which allows an attacker to execute malicious code without an authentication process by exploiting an incorrect authentication process when processing a request for a particular URL. The vulnerability was patched in version 18.12.15 of Apache OFBiz, and AIWAF responds through the 2228: Apache OFBiz Remote Read more about [2025.02 Vulnerability Report] Apache OFbiz Pre-Auth Remote Code Execution[…]

The vulnerability is a pre-authenticated RCE vulnerability in Ivanti’s Connect Secure, Policy Secure, and ZTA Gateway products, which attempts to exploit Buffer Overflow during IF-T/TLS protocol communication. The vulnerability is patched in 22.7R2.5 for Ivanti Connect Secure and Ivanti ZTA Gateway products, and AIWAF is continuously monitoring related vulnerabilities. 1. Overview Ivanti’s Connect Secure, Policy Read more about [2025.01 Vulnerability Report] Ivanti Connect Secure & Policy Secure, ZTA Gateways Vulnerability[…]

The WordPress CleanTalk plugin currently has a serious authentication bypass vulnerability, identified as CVE-2024-10542 and CVE-2024-10781, which allows an unauthenticated attacker to bypass security measures and perform actions that would normally require valid authentication. In particular, an attacker could install and activate arbitrary plugins on a vulnerable site, potentially leading to remote code execution and Read more about [2025.01 Vulnerability Report] WordPress CleanTalk Plugin Authentication Bypass Vulnerability (CVE-2024-10542, CVE-2024-10781)[…]