PT-2025-7034

Name of the Vulnerable Software and Affected Versions: Wow-Company WP Coder versions 3.6 and earlier Description: A Cross-Site Request Forgery CSRF issue allows Cross-Site Scripting XSS. This means an attacker can trick a user into performing unintended actions on a web application, potentially...

WordPress plugin WP Coder has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

CVE-2024-27918

Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication could allow an attacker to bypass the CODEROIDCEMAILDOMAIN verification and create an account with an email not in the...

WordPress WP Coder Plugin <= 3.6 - CSRF to Cross Site Scripting (XSS) vulnerability

CSRF to Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin WP Coder versions = 3.6...

CVE-2024-12402 Themes Coder – Create Android & iOS Apps For Your Woocommerce Site <= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalation

The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.4. This is due to the plugin not properly validating a user's identity prior to updating their password...

CVE-2024-12402 Themes Coder – Create Android & iOS Apps For Your Woocommerce Site <= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalation

The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.4. This is due to the plugin not properly validating a user's identity prior to updating their password...

CVE-2024-12402

CVE-2024-12402 impacts the Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress. The root cause is insecure direct object reference: the plugin does not properly validate a user’s identity before password updates in update_user_profile(), enabling unauthenticate...

CVE-2024-12402: Authentication Bypass Using an Alternate Path or Channel

The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.4. This is due to the plugin not properly validating a user's identity prior to updating their password...

PT-2025-1831

Name of the Vulnerable Software and Affected Versions The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress versions up to, and including, 1.3.4 Description The issue is related to privilege escalation via account takeover due to the plugin not properly...

WordPress Plugins, Themes, Coder security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Themes Coder plugin <= 1.3.4 - Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalation vulnerability

Insecure Direct Object Reference to Password Change/Account Takeover/Privilege Escalation vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Themes Coder versions = 1.3.4...

graphicsmagick:coder_HEIF_fuzzer: Heap-buffer-overflow in derive_collocated_motion_vectors

Detailed Report: https://oss-fuzz.com/testcase?key=4731099328086016 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderHEIFfuzzer Job Type: libfuzzerasangraphicsmagick Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x51b00000df32 Crash State:...

PT-2024-10659 · Google · Android +1

Name of the Vulnerable Software and Affected Versions: No specific software or version is mentioned as affected, so the information is not sufficient to determine the exact vulnerable software and versions. Description: The issue is related to a possible out of bounds write in the get binary...

Google Pixel security vulnerabilities

Google Pixel is a smartphone from Google, an American company. A security vulnerability exists in Google Pixel, which stems from a lack of bounds checking in getbinary in vendor/mediatek/proprietary/hardware/connectivity/gps/gpshal/src/datacoder.c, where out-of-bounds writes may exist...

DEBIAN-CVE-2024-11612

7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of 7-Zip. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on th...

Open Redirect

github.com/coder/coder is vulnerable to Open Redirect. The vulnerability is due to lack of proper input validation on the Coder login page, allows attackers to manipulate the URL and redirect users to malicious websites...

GHSA-WCX9-CCPJ-HX3C Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect')

Summary An issue on Coder's login page allows attackers to craft a Coder URL that when clicked by a logged in user could redirect them to a website the attacker controls, e.g. https://google.com. Details On the login page, Coder checks for the presence of a redirect query parameter. On successful...

PT-2026-116450

Name of the Vulnerable Software and Affected Versions Coder versions 2.3.1 through 2.14.3 Coder versions 2.15.x through 2.15.2 Coder version 2.16.0 Description The login page contains an open redirect issue due to improper sanitization of the redirect query parameter. This allows attackers to...

graphicsmagick:coder_BIGTIFF_fuzzer: Use-of-uninitialized-value in crc32_arch_optimized

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=5299232566214656 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderBIGTIFFfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-valu...

graphicsmagick:coder_DCM_fuzzer: Use-of-uninitialized-value in ReadJPEGImage

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed Report: https://oss-fuzz.com/testcase?key=4704540631826432 Project: graphicsmagick Fuzzing Engine: libFuzzer Fuzz Target: coderDCMfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type: Use-of-uninitialized-value...