{"resultsPerPage":38,"startIndex":0,"totalResults":38,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-08T11:55:43.294","vulnerabilities":[{"cve":{"id":"CVE-2018-1000025","sourceIdentifier":"cve@mitre.org","published":"2018-02-09T23:29:00.777","lastModified":"2026-06-17T01:32:13.957","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/IdTokenVerifier.php does not verify for token signature that can result in JWT with any email address and user ID could be forged from an actual token, or from thin air. This attack appear to be exploitable via Attacker would only need to know email address of the victim on most cases.. This vulnerability appears to have been fixed in 3.8.1."},{"lang":"es","value":"Jerome Gamez Firebase Admin SDK for PHP, de la versión 3.2.0 a la 3.8.0, contiene una vulnerabilidad de control de acceso incorrecto en src/Firebase/Auth/IdTokenVerifier.php, que no verifica la firma de tokens y que puede resultar en JWT con cualquier dirección de email e ID de usuario que pueda ser falsificado a partir de un token real o de la nada. Parece que el ataque puede ser explotado mediante un atacante que solo necesitaría saber la dirección de correo electrónico de la víctima en muchos casos. Parece ser que la vulnerabilidad se ha solucionado en la versión 3.8.1."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-732"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:firebase_admin_sdk_for_php_project:firebase_admin_sdk_for_php:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.0","versionEndIncluding":"3.8.0","matchCriteriaId":"3C0487F5-E3E0-4A79-8C55-6CCFC5A671A7"}]}]}],"references":[{"url":"https://github.com/kreait/firebase-php/pull/151","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"https://github.com/kreait/firebase-php/releases/tag/3.8.1","source":"cve@mitre.org","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/kreait/firebase-php/pull/151","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/kreait/firebase-php/releases/tag/3.8.1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2018-11505","sourceIdentifier":"cve@mitre.org","published":"2018-05-26T22:29:00.323","lastModified":"2026-06-17T01:36:04.297","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output."},{"lang":"es","value":"La aplicación Werewolf Online 0.8.8 para Android permite que atacantes descubran el token Firebase mediante la lectura de las salidas logcat."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:werewolf_online_project:werewolf_online:0.8.8:*:*:*:*:android:*:*","matchCriteriaId":"B35A8257-8B2E-4C46-B399-93B99AA5E9A0"}]}]}],"references":[{"url":"https://pastebin.com/NtPn3jB8","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44776/","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://pastebin.com/NtPn3jB8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44776/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"]}]}},{"cve":{"id":"CVE-2018-13850","sourceIdentifier":"cve@mitre.org","published":"2018-07-10T18:29:00.717","lastModified":"2026-06-17T01:40:16.210","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The \"Firebase Cloud Messaging (FCM) + Advance Admin Panel\" component supporting Firebase Push Notification on iOS (through 2017-10-26) allows SQL injection via the /advance_push/public/login username parameter."},{"lang":"es","value":"El componente \"Firebase Cloud Messaging (FCM) + Advance Admin Panel\" que soporta Firebase Push Notification en iOS (hasta el 26/10/2017) permite la inyección SQL mediante el parámetro username en /advance_push/public/login."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:icanstudioz:firebase_push_notification_on_ios_\\/_fcm_\\+_advance_admin_panel:*:*:*:*:*:*:*:*","versionEndIncluding":"2017-10-26","matchCriteriaId":"F2F27155-C6C6-4DDE-9C97-8ABFF3ACB825"}]}]}],"references":[{"url":"https://cxsecurity.com/issue/WLB-2018070096","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://cxsecurity.com/issue/WLB-2018070096","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2021-46743","sourceIdentifier":"cve@mitre.org","published":"2022-03-29T07:15:07.017","lastModified":"2026-06-17T04:15:25.123","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself."},{"lang":"es","value":"En Firebase PHP-JWT versiones anteriores a 6.0.0, se presenta un problema de confusión de algoritmos (por ejemplo, RS256 / HS256) por medio del encabezado kid (también se conoce como Key ID), cuando son cargados varios tipos de claves en un llavero. Esto permite a un atacante falsificar tokens que son comprobados bajo la clave incorrecta. NOTA: esto proporciona una forma directa de usar la biblioteca PHP-JWT de forma no segura, pero podría no considerarse una vulnerabilidad en la propia biblioteca"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","baseScore":5.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-843"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:firebase_php-jwt:*:*:*:*:*:*:*:*","versionEndExcluding":"6.0.0","matchCriteriaId":"53E1DE57-9D25-4B98-83B6-C35BDD065D88"}]}]}],"references":[{"url":"https://github.com/firebase/php-jwt/issues/351","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/firebase/php-jwt/issues/351","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2023-3202","sourceIdentifier":"security@wordfence.com","published":"2023-07-12T05:15:10.623","lastModified":"2026-06-17T06:13:34.197","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function. This makes it possible for unauthenticated attackers to update the firebase server key to push notification when order status changed via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"inspireui","product":"MStore API – Create Native Android & iOS Apps On The Cloud","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.9.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-22T19:15:37.518476Z","id":"CVE-2023-3202","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:*","versionEndIncluding":"3.9.6","matchCriteriaId":"D181286E-99D3-48F5-A6A6-CE69143FBA0A"}]}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L232","source":"security@wordfence.com","tags":["Patch"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail=","source":"security@wordfence.com","tags":["Patch"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b3612e-3c91-469b-98ef-fdb03b0ee9d9?source=cve","source":"security@wordfence.com","tags":["Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/trunk/mstore-api.php#L232","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2925048%40mstore-api&new=2925048%40mstore-api&sfp_email=&sfph_mail=","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d2b3612e-3c91-469b-98ef-fdb03b0ee9d9?source=cve","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2024-31215","sourceIdentifier":"security-advisories@github.com","published":"2024-04-04T16:15:09.787","lastModified":"2026-06-17T07:27:59.933","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile.\nA SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When a malicious app is uploaded to Static analyzer, it is possible to make internal requests. This vulnerability has been patched in version 3.9.8.\n"},{"lang":"es","value":"Mobile Security Framework (MobSF) es una plataforma de investigación de seguridad para aplicaciones móviles en Android, iOS y Windows Mobile. Una vulnerabilidad SSRF en la lógica de verificación de la base de datos de Firebase. El atacante puede hacer que el servidor establezca una conexión con servicios exclusivamente internos dentro de la infraestructura de la organización. Cuando se carga una aplicación maliciosa en el analizador estático, es posible realizar solicitudes internas. Esta vulnerabilidad ha sido parcheada en la versión 3.9.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"MobSF","product":"Mobile-Security-Framework-MobSF","versions":[{"version":"<= 3.9.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-04-09T16:01:30.374998Z","id":"CVE-2024-31215","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:opensecurity:mobile_security_framework:*:*:*:*:*:*:*:*","versionEndExcluding":"3.9.8","matchCriteriaId":"66D2235C-C828-4EEB-8D92-B0F1CDF83F24"}]}]}],"references":[{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/43bb71d115d78c03faa82d75445dd908e9b32716","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2373","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wpff-wm84-x5cx","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2024-4128","sourceIdentifier":"cve-coordination@google.com","published":"2024-05-02T14:15:10.753","lastModified":"2026-06-17T08:01:11.563","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed calls to localhost (ie Chrome before v94), the website could exfiltrate emulator data. We recommend upgrading past version 13.6.0 or commit  068a2b08dc308c7ab4b569617f5fc8821237e3a0 https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0 \n"},{"lang":"es","value":"Esta vulnerabilidad era un posible ataque CSRF. Cuando se ejecuta el conjunto de emuladores de Firebase, hay un endpoint de exportación que se utiliza normalmente para exportar datos de emuladores en ejecución. Si un usuario estaba ejecutando el emulador y navegaba a un sitio web malicioso con el exploit en un navegador que permitía llamadas al host local (es decir, Chrome antes de v94), el sitio web podría filtrar datos del emulador. Recomendamos actualizar la versión anterior 13.6.0 o confirmar 068a2b08dc308c7ab4b569617f5fc8821237e3a0 https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0"}],"affected":[{"source":"cve-coordination@google.com","affectedData":[{"vendor":"Firebase","product":"firebase-tools","defaultStatus":"unaffected","packageName":"firebase-tools","repo":"https://github.com/firebase/firebase-tools","versions":[{"version":"0","lessThanOrEqual":"13.6.0","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"firebase_admin_sdk_for_php_project","product":"firebase_admin_sdk_for_php","defaultStatus":"unknown","cpes":["cpe:2.3:a:firebase_admin_sdk_for_php_project:firebase_admin_sdk_for_php:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve-coordination@google.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","baseScore":2.6,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-05-02T15:14:46.780262Z","id":"CVE-2024-4128","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:firebase_command_line_interface:*:*:*:*:*:*:*:*","versionEndExcluding":"13.6.0","matchCriteriaId":"98E7E6C1-44A7-430A-BB56-51BD2FB9497E"}]}]}],"references":[{"url":"https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0","source":"cve-coordination@google.com","tags":["Patch"]},{"url":"https://github.com/firebase/firebase-tools/pull/6944","source":"cve-coordination@google.com","tags":["Patch"]},{"url":"https://github.com/firebase/firebase-tools/commit/068a2b08dc308c7ab4b569617f5fc8821237e3a0","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/firebase/firebase-tools/pull/6944","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]}]}},{"cve":{"id":"CVE-2024-7628","sourceIdentifier":"security@wordfence.com","published":"2024-08-15T03:15:05.310","lastModified":"2026-06-17T08:20:34.643","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verify_id_token' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to an @flutter.io email address or phone number. This also requires firebase to be configured on the website and the user to have set up firebase for their account."},{"lang":"es","value":"El complemento MStore API – Create Native Android &amp; iOS Apps On The Cloud para WordPress es vulnerable a la omisión de autenticación en versiones hasta la 4.15.2 incluida. Esto se debe al uso de comparación flexible en la función 'verify_id_token'. Esto hace posible que atacantes no autenticados inicien sesión como cualquier usuario existente en el sitio, como un administrador, si tienen acceso a una dirección de correo electrónico o número de teléfono @flutter.io. Esto también requiere que Firebase esté configurado en el sitio web y que el usuario haya configurado Firebase para su cuenta."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"inspireui","product":"MStore API – Create Native Android & iOS Apps On The Cloud","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.15.2","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"inspireui","product":"mstore_api_create_native_android_and_ios_apps_on_the_cloud","defaultStatus":"unknown","cpes":["cpe:2.3:a:inspireui:mstore_api_create_native_android_and_ios_apps_on_the_cloud:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThanOrEqual":"4.15.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-08-15T13:12:04.577418Z","id":"CVE-2024-7628","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:*","versionEndExcluding":"4.15.3","matchCriteriaId":"BF69A65A-5613-440C-A619-E18498492045"}]}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/helpers/firebase-phone-auth-helper.php?rev=3110793#L31","source":"security@wordfence.com","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/helpers/firebase-phone-auth-helper.php?rev=3110793#L35","source":"security@wordfence.com","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/helpers/firebase-phone-auth-helper.php?rev=3110793#L5","source":"security@wordfence.com","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3134553%40mstore-api&new=3134553%40mstore-api&sfp_email=&sfph_mail=","source":"security@wordfence.com","tags":["Patch"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d174f856-d94a-42ed-b547-67699e175cd8?source=cve","source":"security@wordfence.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2024-45489","sourceIdentifier":"cve@mitre.org","published":"2024-09-20T17:15:15.060","lastModified":"2026-06-17T07:54:18.360","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Arc before 2024-08-26 allows remote code execution in JavaScript boosts. Boosts that run JavaScript cannot be shared by default; however (because of misconfigured Firebase ACLs), it is possible to create or update a boost using another user's ID. This installs the boost in the victim's browser and runs arbitrary Javascript on that browser in a privileged context. NOTE: this is a no-action cloud vulnerability with zero affected users."},{"lang":"es","value":"Arc anterior al 26/08/2024 permite la ejecución remota de código en boosts de JavaScript. Los boosts que ejecutan JavaScript no se pueden compartir de forma predeterminada; sin embargo (debido a listas de control de acceso de Firebase mal configuradas), es posible crear o actualizar un boost usando el ID de otro usuario. Esto instala el boost en el navegador de la víctima y ejecuta Javascript arbitrario en ese navegador en un contexto privilegiado. NOTA: esta es una vulnerabilidad en la nube que no requiere acción y no afecta a ningún usuario."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"the_browser_company","product":"arc","defaultStatus":"unknown","cpes":["cpe:2.3:a:the_browser_company:arc:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThan":"2024-08-26","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-09-20T17:21:03.827296Z","id":"CVE-2024-45489","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://arc.net/blog/CVE-2024-45489-incident-response","source":"cve@mitre.org"},{"url":"https://kibty.town/blog/arc/","source":"cve@mitre.org"},{"url":"https://news.ycombinator.com/item?id=41597250","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2024-9861","sourceIdentifier":"security@wordfence.com","published":"2024-10-17T02:15:03.493","lastModified":"2026-06-17T08:25:24.093","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the phone number associated with that user."},{"lang":"es","value":"El complemento Miniorange OTP Verification con Firebase para WordPress es vulnerable a la omisión de autenticación en versiones hasta la 3.6.0 incluida. Esto se debe a la falta de validación en el token que se proporciona durante el inicio de sesión con OTP a través del complemento. Esto permite que atacantes no autenticados inicien sesión como cualquier usuario existente en el sitio, como un administrador, si conocen el número de teléfono asociado con ese usuario."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"cyberlord92","product":"Miniorange OTP Verification with Firebase","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-17T19:54:08.043290Z","id":"CVE-2024-9861","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:miniorange:otp_verification_with_firebase:*:*:*:*:*:wordpress:*:*","versionEndExcluding":"3.6.1","matchCriteriaId":"428D1527-97E4-436A-B8D8-90EFDDEE4F6A"}]}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/tags/3.6.0/handler/forms/class-loginform.php#L144","source":"security@wordfence.com","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/tags/3.6.0/handler/forms/class-loginform.php#L190","source":"security@wordfence.com","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/changeset/3169869/miniorange-firebase-sms-otp-verification#file3","source":"security@wordfence.com","tags":["Patch"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/04045ec3-dd8e-4ac5-bd73-eef6205ecc62?source=cve","source":"security@wordfence.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2024-9862","sourceIdentifier":"security@wordfence.com","published":"2024-10-17T02:15:03.767","lastModified":"2026-06-17T08:25:24.200","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts."},{"lang":"es","value":"El complemento Miniorange OTP Verification con Firebase para WordPress es vulnerable a cambios arbitrarios de contraseñas de usuario en versiones hasta la 3.6.0 incluida. Esto se debe a que el complemento proporciona acceso controlado por el usuario a los objetos, lo que permite que un usuario omita la autorización y acceda a los recursos del sistema, y no se verifica la contraseña actual del usuario. Esto hace posible que atacantes no autenticados cambien las contraseñas de los usuarios y potencialmente se apropien de las cuentas de administrador."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"cyberlord92","product":"Miniorange OTP Verification with Firebase","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.6.0","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"miniorange","product":"otp_verification","defaultStatus":"unaffected","cpes":["cpe:2.3:a:miniorange:otp_verification:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThanOrEqual":"3.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-17T16:15:43.649001Z","id":"CVE-2024-9862","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:miniorange:otp_verification_with_firebase:*:*:*:*:*:wordpress:*:*","versionEndExcluding":"3.6.1","matchCriteriaId":"428D1527-97E4-436A-B8D8-90EFDDEE4F6A"}]}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/tags/3.6.0/handler/forms/class-loginform.php#L236","source":"security@wordfence.com","tags":["Product"]},{"url":"https://plugins.trac.wordpress.org/changeset/3169869/miniorange-firebase-sms-otp-verification#file3","source":"security@wordfence.com","tags":["Patch"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9c3df12d-e526-4a23-89d3-bfdcea9f7b2d?source=cve","source":"security@wordfence.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2024-9863","sourceIdentifier":"security@wordfence.com","published":"2024-10-17T02:15:04.030","lastModified":"2026-06-17T08:25:24.313","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'default_user_role' option. This makes it possible for unauthenticated attackers to register an administrator user even if the registration form is disabled."},{"lang":"es","value":"El complemento UserPro para WordPress es vulnerable a la escalada de privilegios en versiones hasta la 3.6.0 incluida debido al valor predeterminado inseguro \"administrador\" para la opción \"default_user_role\". Esto hace posible que atacantes no autenticados registren a un usuario administrador incluso si el formulario de registro está deshabilitado."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"cyberlord92","product":"Miniorange OTP Verification with Firebase","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.6.0","versionType":"semver","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"miniorange","product":"otp_verification","defaultStatus":"unaffected","cpes":["cpe:2.3:a:miniorange:otp_verification:*:*:*:*:*:*:*:*"],"versions":[{"version":"0","lessThanOrEqual":"3.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-17T15:23:48.056528Z","id":"CVE-2024-9863","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/tags/3.6.0/handler/forms/class-registrationform.php#L194","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3169869/miniorange-firebase-sms-otp-verification#file4","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f04eab14-dd86-4145-b5eb-20d064bc8417?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2024-11023","sourceIdentifier":"cve-coordination@google.com","published":"2024-11-18T11:15:05.507","lastModified":"2026-06-17T06:56:54.263","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Firebase JavaScript SDK utilizes a \"FIREBASE_DEFAULTS\" cookie to store configuration data, including an \"_authTokenSyncURL\" field used for session synchronization.  If this cookie field is preset via an attacker by any other method, the attacker can manipulate the \"_authTokenSyncURL\" to point to their own server and it would allow an actor to capture user session data transmitted by the SDK. We recommend upgrading Firebase JS SDK at least to 10.9.0."},{"lang":"es","value":"Firebase JavaScript SDK utiliza una cookie \"FIREBASE_DEFAULTS\" para almacenar datos de configuración, incluido un campo \"_authTokenSyncURL\" utilizado para la sincronización de sesiones. Si un atacante configura este campo de cookie por cualquier otro método, el atacante puede manipular \"_authTokenSyncURL\" para que apunte a su propio servidor y permitiría a un actor capturar datos de sesión de usuario transmitidos por el SDK. Recomendamos actualizar Firebase JS SDK al menos a la versión 10.9.0."}],"affected":[{"source":"cve-coordination@google.com","affectedData":[{"vendor":"Firebase","product":"JavaScript SDK","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.9.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@google.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-11-18T14:59:27.617688Z","id":"CVE-2024-11023","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:google:firebase_javascript_sdk:*:*:*:*:*:*:*:*","versionEndExcluding":"10.9.0","matchCriteriaId":"A9E24545-4BAD-40C2-A540-12FE9FF0CAF4"}]}]}],"references":[{"url":"https://firebase.google.com/support/release-notes/js#version_1090_-_march_14_2024","source":"cve-coordination@google.com","tags":["Release Notes"]},{"url":"https://github.com/firebase/firebase-js-sdk/pull/8056","source":"cve-coordination@google.com","tags":["Issue Tracking","Patch"]}]}},{"cve":{"id":"CVE-2024-11785","sourceIdentifier":"security@wordfence.com","published":"2024-12-12T06:15:22.137","lastModified":"2026-06-17T06:58:27.150","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Integrate Firebase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'firebase_show' shortcode in all versions up to, and including, 0.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."},{"lang":"es","value":" El complemento Integrate Firebase para WordPress es vulnerable a Cross-Site Scripting almacenado a través del código abreviado \"firebase_show\" del complemento en todas las versiones hasta la 0.9.3 incluida , debido a una desinfección de entrada y a un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto permite que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en páginas que se ejecutarán cada vez que un usuario acceda a una página inyectada."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"hanthuy","product":"Integrate Firebase","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"0.9.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-12-12T15:21:40.418876Z","id":"CVE-2024-11785","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3202693%40integrate-firebase&new=3202693%40integrate-firebase&sfp_email=&sfph_mail=","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9788e450-4e79-43ce-ae78-466eef458c29?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2024-54294","sourceIdentifier":"audit@patchstack.com","published":"2024-12-13T15:15:33.420","lastModified":"2026-06-17T08:10:04.833","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Appgenix Infotech Firebase OTP Authentication authentication-via-otp-using-firebase allows Authentication Bypass.This issue affects Firebase OTP Authentication: from n/a through <= 1.0.1."},{"lang":"es","value":"Vulnerabilidad de omisión de autenticación mediante una ruta o canal alternativo en appgenixinfotech Firebase OTP Authentication permite la omisión de autenticación. Este problema afecta a la autenticación OTP de Firebase: desde n/a hasta 1.0.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Appgenix Infotech","product":"Firebase OTP Authentication","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"authentication-via-otp-using-firebase","versions":[{"version":"0","lessThanOrEqual":"1.0.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-12-13T15:40:45.578846Z","id":"CVE-2024-54294","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/authentication-via-otp-using-firebase/vulnerability/wordpress-firebase-otp-authentication-plugin-1-0-1-account-takeover-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2025-5924","sourceIdentifier":"security@wordfence.com","published":"2025-07-04T03:15:21.240","lastModified":"2026-06-17T09:49:02.623","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the wfpn_brodcast_notification_message() function. This makes it possible for unauthenticated attackers to send broadcast notifications via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."},{"lang":"es","value":"El complemento WP Firebase Push Notification para WordPress es vulnerable a  Cross-Site Request Forgery en todas las versiones hasta la 1.2.0 incluida. Esto se debe a la falta o a una validación incorrecta de nonce en la función wfpn_brodcast_notification_message(). Esto permite que atacantes no autenticados envíen notificaciones de difusión mediante una solicitud falsificada, siempre que puedan engañar al administrador del sitio para que realice una acción como hacer clic en un enlace."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"skywaveinfo","product":"WP Firebase Push Notification","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-07-07T14:38:38.842687Z","id":"CVE-2025-5924","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:skywavesolutions:wp_firebase_push_notification:*:*:*:*:*:wordpress:*:*","versionEndIncluding":"1.2.0","matchCriteriaId":"21A2B489-BF22-4335-AF88-50F671AEC235"}]}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wp-push-notification-firebase/trunk/wp_push_notification_firebase.php#L67","source":"security@wordfence.com","tags":["Product"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/996e0432-e795-4c01-8182-603a47f4f341?source=cve","source":"security@wordfence.com","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2025-8342","sourceIdentifier":"security@wordfence.com","published":"2025-08-15T03:15:36.877","lastModified":"2026-06-17T10:06:47.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WooCommerce OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass due to insufficient empty value checking in the lwp_ajax_register function in all versions up to, and including, 1.8.47. This makes it possible for unauthenticated attackers to bypass OTP verification and gain administrative access to any user account with a configured phone number by exploiting improper Firebase API error handling when the Firebase API key is not configured."},{"lang":"es","value":"El complemento WooCommerce OTP Login With Phone Number, OTP Verification para WordPress es vulnerable a la omisión de la autenticación debido a una comprobación insuficiente de valores vacíos en la función lwp_ajax_register en todas las versiones hasta la 1.8.47 incluida. Esto permite a atacantes no autenticados omitir la verificación OTP y obtener acceso administrativo a cualquier cuenta de usuario con un número de teléfono configurado, aprovechando la gestión incorrecta de errores de la API de Firebase cuando la clave de la API de Firebase no está configurada."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"glboy","product":"OTP Login With Phone Number, OTP Verification","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.8.47","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-08-15T12:44:21.660059Z","id":"CVE-2025-8342","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.47/login-with-phonenumber.php#L4358","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.47/login-with-phonenumber.php#L4373","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338150%40login-with-phone-number&new=3338150%40login-with-phone-number&sfp_email=&sfph_mail=","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6e74582f-8e94-4cba-a3eb-0a823a5235ad?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2025-55306","sourceIdentifier":"security-advisories@github.com","published":"2025-08-19T19:15:37.067","lastModified":"2026-06-17T09:41:37.320","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GenX_FX is an advance IA trading platform that will focus on forex trading. A vulnerability was identified in the GenX FX backend where API keys and authentication tokens may be exposed if environment variables are misconfigured. Unauthorized users could gain access to cloud resources (Google Cloud, Firebase, GitHub, etc.)."},{"lang":"es","value":"GenX_FX es una plataforma avanzada de trading con inteligencia artificial (IA) enfocada en el trading de forex. Se identificó una vulnerabilidad en el backend de GenX FX que podría exponer las claves API y los tokens de autenticación si las variables de entorno están mal configuradas. Usuarios no autorizados podrían acceder a recursos en la nube (Google Cloud, Firebase, GitHub, etc.)."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Mouy-leng","product":"GenX_FX","versions":[{"version":"<= 1.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-08-19T20:49:35.867951Z","id":"CVE-2025-55306","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://github.com/Mouy-leng/GenX_FX/security/advisories/GHSA-2xjq-pvwj-mvm6","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2025-7665","sourceIdentifier":"security@wordfence.com","published":"2025-09-19T13:15:43.973","lastModified":"2026-06-17T10:05:26.303","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the 'handle_mofirebase_form_options' function in versions 3.1.0 to 3.6.2. This makes it possible for unauthenticated attackers to update the default role to Administrator. Premium features must be enabled in order to exploit the vulnerability."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"cyberlord92","product":"Miniorange OTP Verification with Firebase","defaultStatus":"unaffected","versions":[{"version":"3.1.0","lessThanOrEqual":"3.6.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-09-19T13:04:59.600598Z","id":"CVE-2025-7665","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/miniorange-firebase-sms-otp-verification/trunk/handler/forms/class-registrationform.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a9a02910-5674-4266-ab6e-7926bf6adecc?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-32138","sourceIdentifier":"security-advisories@github.com","published":"2026-03-12T19:16:16.427","lastModified":"2026-06-17T10:35:12.260","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"NEXULEAN is a cybersecurity portfolio & service platform for an Ethical Hacker, AI Enthusiast, and Penetration Tester. Prior to 2.0.0, a security vulnerability was identified where Firebase and Web3Forms API keys were exposed. An attacker could use these keys to interact with backend services without authentication, potentially leading to unauthorized access to application resources and user data. This vulnerability is fixed in 2.0.0."},{"lang":"es","value":"NEXULEAN es una plataforma de cartera y servicios de ciberseguridad para un Hacker Ético, Entusiasta de la IA y Probador de Penetración. Antes de la versión 2.0.0, se identificó una vulnerabilidad de seguridad donde las claves API de Firebase y Web3Forms estaban expuestas. Un atacante podría usar estas claves para interactuar con los servicios de backend sin autenticación, lo que podría llevar a un acceso no autorizado a los recursos de la aplicación y a los datos del usuario. Esta vulnerabilidad está corregida en la versión 2.0.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Stalin-143","product":"website","versions":[{"version":"< 2.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-12T20:38:48.823995Z","id":"CVE-2026-32138","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://github.com/Stalin-143/website/releases/tag/v2.0.0","source":"security-advisories@github.com"},{"url":"https://github.com/Stalin-143/website/security/advisories/GHSA-r7cr-5wcx-x9wm","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-33221","sourceIdentifier":"security-advisories@github.com","published":"2026-03-20T23:16:46.163","lastModified":"2026-06-17T10:37:08.897","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.12.0, the storage service's file upload handler trusts the client-provided Content-Type header without performing server-side MIME type detection. This allows an attacker to upload files with an arbitrary MIME type, bypassing any MIME-type-based restrictions configured on storage buckets. This issue has been patched in version 0.12.0."},{"lang":"es","value":"Nhost es una alternativa de código abierto a Firebase con GraphQL. Antes de la versión 0.12.0, el gestor de carga de archivos del servicio de almacenamiento confía en el encabezado Content-Type proporcionado por el cliente sin realizar detección de tipo MIME en el servidor. Esto permite a un atacante subir archivos con un tipo MIME arbitrario, eludiendo cualquier restricción basada en el tipo MIME configurada en los buckets de almacenamiento. Este problema ha sido parcheado en la versión 0.12.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nhost","product":"nhost","versions":[{"version":"< 0.12.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-25T13:44:34.920197Z","id":"CVE-2026-33221","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-343"},{"lang":"en","value":"CWE-345"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nhost:storage:*:*:*:*:*:*:*:*","versionEndExcluding":"0.12.0","matchCriteriaId":"C146B1FF-DDA4-4DE7-9141-96B79B621EF1"}]}]}],"references":[{"url":"https://github.com/nhost/nhost/commit/c4bd53f042d7f568e567e18e2665af81660fce85","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/nhost/nhost/pull/4018","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/nhost/nhost/releases/tag/storage%400.12.0","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/nhost/nhost/security/advisories/GHSA-g9f6-9775-hffm","source":"security-advisories@github.com","tags":["Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-34200","sourceIdentifier":"security-advisories@github.com","published":"2026-03-31T15:16:17.670","lastModified":"2026-07-24T21:10:00.143","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to issue cross-origin requests to the MCP server and invoke privileged tools using the developer's locally configured credentials. This vulnerability requires two explicit, non-default configuration steps to be exploitable. The default nhost mcp start configuration is not affected. This issue has been patched in version 1.41.0."},{"lang":"es","value":"Nhost es una alternativa de código abierto a Firebase con GraphQL. Antes de la versión 1.41.0, el servidor MCP de Nhost CLI, cuando se configura explícitamente para escuchar en un puerto de red, no aplica autenticación de entrada y no impone CORS estricto. Esto permite que un sitio web malicioso visitado en la misma máquina emita solicitudes de origen cruzado al servidor MCP e invoque herramientas privilegiadas utilizando las credenciales configuradas localmente por el desarrollador. Esta vulnerabilidad requiere dos pasos de configuración explícitos y no predeterminados para ser explotable. La configuración predeterminada de inicio de nhost mcp no se ve afectada. Este problema ha sido parcheado en la versión 1.41.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nhost","product":"nhost","versions":[{"version":"< 1.41.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-31T14:30:33.127356Z","id":"CVE-2026-34200","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-942"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nhost:cli:*:*:*:*:*:*:*:*","versionEndExcluding":"1.41.0","matchCriteriaId":"6449E6F2-0FEB-4CB5-AE5B-B22FDB55BA81"}]}]}],"references":[{"url":"https://github.com/nhost/nhost/commit/15eae9285f9dce63e184b9bb24616474ffa5ccc9","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/nhost/nhost/pull/4060","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/nhost/nhost/security/advisories/GHSA-6c5x-3h35-vvw2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-34969","sourceIdentifier":"security-advisories@github.com","published":"2026-04-06T16:16:38.457","lastModified":"2026-10-23T23:10:00.157","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers, and proxy/CDN logs. Note that the refresh token is one-time use and all of these leak vectors are on owned infrastructure or services integrated by the application developer. This vulnerability is fixed in 0.48.0."},{"lang":"es","value":"pendiente..."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nhost","product":"nhost","versions":[{"version":"< 0.48.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-04-07T15:47:19.923890Z","id":"CVE-2026-34969","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-598"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nhost:nhost\\/auth:*:*:*:*:*:*:*:*","versionEndExcluding":"0.48.0","matchCriteriaId":"CC94EDA1-AB33-40FB-8D3C-FF131A157A14"}]}]}],"references":[{"url":"https://github.com/nhost/nhost/security/advisories/GHSA-g2qj-prgh-4g9r","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/nhost/nhost/security/advisories/GHSA-g2qj-prgh-4g9r","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-41574","sourceIdentifier":"security-advisories@github.com","published":"2026-05-08T15:16:40.580","lastModified":"2026-06-17T10:46:52.323","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been verified by the OAuth provider. Nhost's controller trusts a profile.EmailVerified boolean that is set by each provider adapter. The vulnerability is that several provider adapters do not correctly populate this field they either silently drop a verified field the provider API actually returns (Discord), or they fall back to accepting unconfirmed emails and marking them as verified (Bitbucket). Two Microsoft providers (AzureAD, EntraID) derive the email from non-ownership-proving fields like the user principal name, then mark it verified. The result is that an attacker can present an email they don't own to Nhost, have the OAuth identity merged into the victim's account, and receive a full authenticated session. This issue has been patched in version 0.49.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nhost","product":"nhost","versions":[{"version":"< 0.49.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-08T23:25:18.797613Z","id":"CVE-2026-41574","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nhost:nhost\\/auth:*:*:*:*:*:*:*:*","versionEndExcluding":"0.49.1","matchCriteriaId":"95C9D7EE-0469-4ACF-AECD-9C2C383217A9"}]}]}],"references":[{"url":"https://github.com/nhost/nhost/commit/ec8dab3f2cf46e1131ddaf893d56c37aa00380b2","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/nhost/nhost/pull/4162","source":"security-advisories@github.com","tags":["Exploit","Patch"]},{"url":"https://github.com/nhost/nhost/releases/tag/auth%400.49.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/nhost/nhost/security/advisories/GHSA-6g38-8j4p-j3pr","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-8787","sourceIdentifier":"security@wordfence.com","published":"2026-05-27T07:16:15.060","lastModified":"2026-06-17T11:04:28.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the `firebase_auth()` function authenticating the request as the WordPress user whose email is supplied in the `user_email` POST parameter without verifying ownership of that email (no Firebase ID token signature/issuer/audience verification). This makes it possible for authenticated attackers, with Subscriber-level access and above, to log in as an arbitrary existing user — including an Administrator — by submitting that user's email address to the `acb_firebase_auth` AJAX action, resulting in full account takeover."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"devsabbirahmed","product":"Firebase Support & Chat Management","defaultStatus":"unaffected","versions":[{"version":"<= 3.1.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-27T10:21:58.865661Z","id":"CVE-2026-8787","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/admin-chat-box/tags/3.1.1/inc/ACB_AjaxHandler.php#L237","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/admin-chat-box/tags/3.1.1/inc/ACB_AjaxHandler.php#L338","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/admin-chat-box/trunk/inc/ACB_AjaxHandler.php#L237","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/admin-chat-box/trunk/inc/ACB_AjaxHandler.php#L338","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/90783d75-a255-4133-ac7b-32e0a70c8c69?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-3655","sourceIdentifier":"security@wordfence.com","published":"2026-05-29T08:16:18.920","lastModified":"2026-07-21T12:10:00.090","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60. This is due to the Firebase verification flow in the `lwp_ajax_register` AJAX handler not binding the Firebase session to the phone number supplied in the request. The `idehweb_lwp_activate_through_firebase()` function validates that a Firebase OTP session is legitimate, but the `phoneNumber` returned by Firebase is never compared against the victim's stored phone number. This makes it possible for unauthenticated attackers to authenticate as any user who has a phone number stored in user meta, including administrators, by verifying their own Firebase session and supplying the victim's phone number in the same request."},{"lang":"es","value":"El plugin OTP Login With Phone Number, OTP Verification para WordPress es vulnerable a omisión de autenticación en las versiones 1.8.50 a 1.8.60. Esto se debe a que el flujo de verificación de Firebase en el gestor AJAX 'lwp_ajax_register' no vincula la sesión de Firebase al número de teléfono proporcionado en la solicitud. La función 'idehweb_lwp_activate_through_firebase()' valida que una sesión OTP de Firebase es legítima, pero el 'phoneNumber' devuelto por Firebase nunca se compara con el número de teléfono almacenado de la víctima. Esto hace posible que atacantes no autenticados se autentiquen como cualquier usuario que tenga un número de teléfono almacenado en los metadatos del usuario, incluidos los administradores, al verificar su propia sesión de Firebase y proporcionar el número de teléfono de la víctima en la misma solicitud."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"glboy","product":"OTP Login With Phone Number, OTP Verification","defaultStatus":"unaffected","versions":[{"version":"1.8.50","lessThanOrEqual":"1.8.60","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-29T10:01:30.010604Z","id":"CVE-2026-3655","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.60/inc/ajax-handlers.php#L1167","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.60/inc/ajax-handlers.php#L649","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/login-with-phone-number/tags/1.8.60/inc/ajax-handlers.php#L659","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/login-with-phone-number/trunk/inc/ajax-handlers.php#L649","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3479314/login-with-phone-number/trunk/inc/ajax-handlers.php?old=3455810&old_path=login-with-phone-number%2Ftrunk%2Finc%2Fajax-handlers.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7fc410f2-5f2b-4eea-a0fb-fe58f988f95f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-12715","sourceIdentifier":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","published":"2026-07-17T16:17:13.047","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests.\n\n\nThis vulnerability was patched on 15 April 2026, and no customer action is needed."},{"lang":"es","value":"Ausencia de autorización en versiones de Google Cloud Firebase Studio anteriores al 15-04-2026 en Google Cloud Platform permite a un atacante descargar el código fuente desplegado de otros usuarios y acceder a datos sensibles a través de solicitudes de firma de URL de GCS no autorizadas.\n\nEsta vulnerabilidad fue parcheada el 15 de abril de 2026, y no se requiere ninguna acción por parte del cliente."}],"affected":[{"source":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","affectedData":[{"vendor":"Google Cloud","product":"Firebase Studio","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026-04-15","versionType":"date","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"CLEAR"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-17T15:28:39.995725Z","id":"CVE-2026-12715","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://docs.cloud.google.com/support/bulletins#gcp-2026-043","source":"f45cbf4e-4146-4068-b7e1-655ffc2c548c"}]}},{"cve":{"id":"CVE-2026-47671","sourceIdentifier":"security-advisories@github.com","published":"2026-07-21T20:17:01.473","lastModified":"2026-10-24T19:10:00.127","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden `nhost configserver` used by `nhost dev` exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment, any process that can reach the developer's localhost service, including a web page loaded from an arbitrary origin, can query the configserver for local Nhost configuration and secrets and can mutate the local `.secrets` file. This impacts developers using `nhost dev`: project admin secrets, JWT signing keys, webhook secrets, Grafana credentials, and custom environment variables can be read, and attacker-controlled secrets can be written to the local development project. Version 1.46.0 of Nhost CLI contains a fix."},{"lang":"es","value":"Nhost es una alternativa de código abierto a Firebase con GraphQL. En versiones de Nhost CLI anteriores a la 1.46.0, el ’nhost configserver’ oculto utilizado por ’nhost dev’ expone la API GraphQL de Mimir con directivas de autorización ficticias y CORS permisivo. Cuando un desarrollador está ejecutando el entorno de desarrollo local, cualquier proceso que pueda alcanzar el servicio localhost del desarrollador, incluida una página web cargada desde un origen arbitrario, puede consultar el configserver para obtener la configuración y los secretos locales de Nhost y puede mutar el archivo local ’.secrets’. Esto afecta a los desarrolladores que utilizan ’nhost dev’: los secretos de administrador del proyecto, las claves de firma JWT, los secretos de webhook, las credenciales de Grafana y las variables de entorno personalizadas pueden ser leídos, y los secretos controlados por el atacante pueden ser escritos en el proyecto de desarrollo local. La versión 1.46.0 de Nhost CLI contiene una solución."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"nhost","product":"cli","versions":[{"version":"< 1.46.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-22T15:44:01.232311Z","id":"CVE-2026-47671","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nhost:cli:*:*:*:*:*:*:*:*","versionEndExcluding":"1.46.0","matchCriteriaId":"395456A9-A2D2-4801-B30E-14FB83515AFE"}]}]}],"references":[{"url":"https://github.com/nhost/nhost/commit/e407511627d2c2c1137a70e9ca1ca31095d23479","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/nhost/nhost/pull/4302","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/nhost/nhost/releases/tag/cli@1.46.0","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-47364","sourceIdentifier":"support@hackerone.com","published":"2026-08-07T18:17:17.217","lastModified":"2026-10-23T20:10:00.160","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.\r\n\r\nImpact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems."},{"lang":"es","value":"En versiones de la aplicación de Android de Datadog anteriores a la v545-5.9.2, la aplicación etiqueta los datos de Crashlytics con el UUID de Datadog del usuario, sin una opción de exclusión visible para el usuario.\n\nImpacto: El UUID de usuario de Datadog y los datos de fallos son visibles dentro de Firebase Crashlytics. Este UUID no es identificativo fuera de los propios sistemas de Datadog."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"Datadog","product":"Android App","defaultStatus":"unaffected","versions":[{"version":"5.9.2","lessThan":"5.9.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-07T18:34:32.439927Z","id":"CVE-2026-47364","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://cwe.mitre.org/data/definitions/200.html","source":"support@hackerone.com"},{"url":"https://firebase.google.com/docs/crashlytics/customize-crash-reports?platform=android#enable-opt-in-reporting","source":"support@hackerone.com"},{"url":"https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-72857","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-13T22:17:25.040","lastModified":"2026-08-31T20:33:07.713","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Budibase","product":"budibase","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.40.0","versionType":"semver","status":"affected"},{"version":"3.40.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-14T16:12:17.510980Z","id":"CVE-2026-72857","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-6mpp-gfg5-x2vv","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/budibase-before-credential-exposure-via-string-fields","source":"disclosure@vulncheck.com"},{"url":"https://github.com/Budibase/budibase/security/advisories/GHSA-6mpp-gfg5-x2vv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-69183","sourceIdentifier":"security-advisories@github.com","published":"2026-08-20T17:19:34.387","lastModified":"2026-10-18T20:10:00.110","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated attacker can rotate either header to create a new bucket for each request, bypassing rootRateLimiter, badAuthRateLimiter, getKey(), and the getKeyWithUid() fallback used by public endpoints. This permits repeated POST /users/forgotPasswordEmail and verificationEmail requests, mail bombing registered users, consuming Firebase or SMTP quota, evading brute-force protection, and enabling resource exhaustion. Exploitability of cf-connecting-ip depends on deployment topology, but x-forwarded-for and direct-to-origin paths remain affected when those values are not overwritten by a trusted proxy. No fixed version is available as of this review."},{"lang":"es","value":"Monkeytype es una prueba de escritura minimalista y personalizable. En la versión 26.26.0 y anteriores, el generador de claves de límite de tasa del backend en backend/src/middlewares/rate-limit.ts utiliza los encabezados cf-connecting-ip y x-forwarded-for controlados por el cliente antes del valor req.ip derivado de trust-proxy. Un atacante no autenticado puede rotar cualquiera de los encabezados para crear un nuevo 'bucket' para cada solicitud, eludiendo rootRateLimiter, badAuthRateLimiter, getKey() y el mecanismo de reserva getKeyWithUid() utilizado por los puntos finales públicos. Esto permite solicitudes repetidas de POST /users/forgotPasswordEmail y verificationEmail, el bombardeo de correo electrónico a usuarios registrados, el consumo de cuota de Firebase o SMTP, la evasión de la protección contra fuerza bruta y la habilitación del agotamiento de recursos. La explotabilidad de cf-connecting-ip depende de la topología de despliegue, pero x-forwarded-for y las rutas directas al origen permanecen afectadas cuando esos valores no son sobrescritos por un proxy de confianza. Ninguna versión corregida está disponible a partir de esta revisión."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"monkeytypegame","product":"monkeytype","versions":[{"version":"<= 26.26.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-20T17:13:41.268782Z","id":"CVE-2026-69183","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-290"},{"lang":"en","value":"CWE-307"},{"lang":"en","value":"CWE-644"}]}],"references":[{"url":"https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-c878-p3jh-mmjf","source":"security-advisories@github.com"},{"url":"https://github.com/monkeytypegame/monkeytype/security/advisories/GHSA-c878-p3jh-mmjf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-76793","sourceIdentifier":"contact@wpscan.com","published":"2026-08-22T06:16:16.900","lastModified":"2026-10-12T16:10:00.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators."},{"lang":"es","value":"El plugin de WordPress Firebase Authentication anterior a 1.7.1 no requiere que la dirección de correo electrónico en un token de autenticación sea verificada antes de emparejarla con una cuenta de WordPress y emitir una sesión, lo que permite a atacantes no autenticados iniciar sesión como cualquier usuario, incluidos los administradores."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Firebase Authentication","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.7.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-23T15:26:20.515870Z","id":"CVE-2026-76793","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0414ef2b-0d97-41c7-9146-f31ace8b66b2/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-15985","sourceIdentifier":"security@wordfence.com","published":"2026-08-26T12:16:20.940","lastModified":"2026-08-26T16:19:05.917","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"RadiusTheme","product":"Classified Listing - Mobile Number Verification","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.6.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-26T12:29:55.335941Z","id":"CVE-2026-15985","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-289"}]}],"references":[{"url":"https://www.radiustheme.com/downloads/classified-listing-mobile-no-verification/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01ac87f7-3f09-42cd-a344-05b8bd6b730d?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-13447","sourceIdentifier":"security@wordfence.com","published":"2026-09-05T06:17:09.403","lastModified":"2026-09-08T13:12:58.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which decodes and validates Firebase ID token claims (alg, kid, aud, iss) but never calls openssl_verify() or any equivalent to validate the JWT signature against Google's actual public key certificates. This makes it possible for unauthenticated attackers to forge a Firebase Phone Auth JWT signed with a self-generated RSA key pair and impersonate any phone number, resulting in unauthorized access to existing WordPress accounts or creation of new arbitrary accounts."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"inspireui","product":"MStore API – Create Native Android & iOS Apps On The Cloud","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"4.20.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-07T11:08:56.472544Z","id":"CVE-2026-13447","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/flutter-user.php#L829","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/flutter-user.php#L940","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.18.4/controllers/helpers/firebase-phone-auth-helper.php#L5","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L829","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L940","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/helpers/firebase-phone-auth-helper.php#L5","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4a1127af-74f6-4748-9aee-5a8c6c2766a4?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-85268","sourceIdentifier":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","published":"2026-10-30T11:17:33.750","lastModified":"2026-10-30T19:37:07.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID."}],"affected":[{"source":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","affectedData":[{"vendor":"Google Cloud","product":"Identity Platform and Firebase Authentication","defaultStatus":"unaffected","platforms":["iOS"],"versions":[{"version":"0","lessThan":"2026-08-14","versionType":"date","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"AMBER"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T16:48:10.216800Z","id":"CVE-2026-85268","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f45cbf4e-4146-4068-b7e1-655ffc2c548c","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://firebase.google.com/support/releases#auth-helper-fix","source":"f45cbf4e-4146-4068-b7e1-655ffc2c548c"}]}},{"cve":{"id":"CVE-2026-54383","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-11-04T23:17:48.360","lastModified":"2026-11-05T15:15:04.833","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["exclusively-hosted-service"]}],"descriptions":[{"lang":"en","value":"VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using overlapping alphanumeric search terms to harvest identifiers, emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Shenzhen Shine Industrial Co., Ltd.","product":"VitaFit","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2026-10-30","versionType":"date","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/je-lv/vitafit-security-research","source":"disclosure@vulncheck.com"},{"url":"https://play.google.com/store/apps/details?id=com.vt.vitafit","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/vitafit-cloud-api-excessive-data-exposure-via-relation-search-endpoint","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-111492","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-11-05T22:17:43.887","lastModified":"2026-11-05T22:36:02.320","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"TPC Software","product":"Matchpoint","defaultStatus":"unaffected","versions":[{"version":"Versions prior to latest one","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-111495","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-11-05T22:17:44.353","lastModified":"2026-11-05T22:36:02.320","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"TPC Software","product":"Matchpoint","defaultStatus":"unaffected","versions":[{"version":"Versions prior to latest one","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint","source":"cve-coordination@incibe.es"}]}}]}