#windows

Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit all arguments following their input by including a line feed character (`'\n'`) in the payload. This bug has been patched in [v1.5.8] which you can upgrade to now. No further changes are required. Alternatively, line feed characters (`'\n'`) can be stripped out manually or the user input can be made the last argument (this only limits the impact).

PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.

Backdoor.Win32.Destrukor.20 malware suffers from an unauthenticated remote command execution vulnerability.

CuteEditor For PHP version 6.6 suffers from a directory traversal vulnerability.

WordPress Duplicator plugin versions 1.4.6 and below suffer from a backup disclosure vulnerability.

WordPress Duplicator plugin versions 1.4.7 and below suffer from an information disclosure vulnerability.

CodeIgniter CMS version 4.2.0 suffers from a remote SQL injection vulnerability.

Easy Chat Server version 3.1 remote stack buffer overflow exploit.

Wavlink WN530HG4 suffers from a password disclosure vulnerability.

Wavlink WN533A8 suffers from a password disclosure vulnerability.