CVE-2025-38019

A session fixation vulnerability in HTTP management authentication in Apache Qpid Broker-J (through 10.1.0) allows remote attackers to gain unauthorized access to an authenticated management session by reusing a session identifier retained across successful authentication.

The Bookly plugin for WordPress (up to and including 28.2) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar', and 'bookly_rollback_order' AJAX actions. The 'bookly_get_form_id' handler stores an attacker-controlled 'order_id' into a new booking session, which 'bookly_render_complete' then trusts to return the order's secret token without verifying session ownership. This allows unauthenticated attackers to enumerate order IDs, disclose other customers' order tokens, retrieve calendar/appointment information, and permanently delete arbitrary non-completed bookings.

The Customer Reviews for WooCommerce plugin for WordPress (up to and including 5.120.0) is vulnerable to authorization bypass due to improper verification of user permissions. This allows unauthenticated attackers to permanently delete arbitrary attachments from the Media Library (including administrator-owned product images, logos, and documents) by injecting their IDs into a review that is later trashed and purged. Exploitation requires a public review-form link (a 13-hex formId) that exposes the nonce needed to reach the handler without any WordPress account or session.

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress (up to and including 4.8.6) is vulnerable to privilege escalation due to missing permission enforcement on the publicly accessible REST route `POST /wp-json/wawp/v1/signup/<op>` and the absence of a key allowlist in the `finish_registration_logic` function. The attacker-controlled `wawp_custom_fields` parameter is copied directly into `update_user_meta()`, allowing sensitive meta keys such as `wp_capabilities` and `wp_user_level` to be set. This enables unauthenticated attackers to register an account with the administrator role and gain full administrative access. When OTP verification is enabled, the OTP session token is returned in plaintext in the HTTP response, and the `handle_magic_link_request()` handler marks it as verified on any unauthenticated GET request containing it without checking the OTP code, making the OTP step trivially bypassable.

A vulnerability in Lemonldap::NG::Portal (Perl) allows unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party. The function skips the secret comparison for a public Relying Party and returns the authentication method deduced from the request, so a request with a public client_id and an arbitrary or empty secret passes the endpoint's authentication check. An attacker can confirm the token is active and read its metadata, including scope, audience, expiry, and sub.

The Perl module IO::Socket::SSL::SelfCertificate version 1.00 contains malware that executes Python code from an obfuscated URL. The generate_certificate function runs a Python script saved as a certificate file. The malicious file is located at lib/Crypt/SelfCertificate/sample/cert.pem.

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation.

Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code.

ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to extract instance data beyond what was intended, resulting in privilege escalation.

An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.