Fiber

Description A fiber is a unit of execution that must be manually scheduled by the application rather than rely on the priority-based scheduling mechanism built into Windows. Fibers are often called lightweight threads. For more detailed information about what are and how fibers work consult the...

CVE-2025-52357

CVE-2025-52357 : Security Advisory: XSS in FD602GW-DX-R410 Router Admin Console Proof of Concept and Security Advisory for Reflected XSS vulnerability in the FD602GW-DX-R410 fiber router’s admin console firmware V2.2.14. Includes details, impact, and mitigation guidance. Overview A Cross-Site...

WordPress Fiber Admin plugin 3.1.0-4.0.0 - Unauthenticated RCE vulnerability

Unauthenticated RCE vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Fiber Admin versions 3.1.0-4.0.0...

CVE-2026-121492

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering...

CVE-2026-121491

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race...

CVE-2026-121492 Fiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_update

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering...

EUVD-2026-118944

The Fiber Admin WordPress plugin before 4.0.1 does not have authorisation checks in some of its AJAX actions, allowing unauthenticated users to change the order of arbitrary posts, including drafts, private posts and navigation menu items, as well as the order of taxonomy terms when term ordering...

WordPress Fiber Admin plugin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification vulnerability

Unauthenticated Arbitrary Post and Term Order Modification vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Fiber Admin versions 4.0.1...

CVE-2026-121492

The Fiber Admin WordPress plugin in versions prior to 4.0.1 is vulnerable to an authorization bypass. The plugin fails to perform proper authorization checks on specific AJAX actions, specifically fiad_cpo_update and fiad_cpo_tax_update . This flaw allows unauthenticated users to modify the order...

CVE-2026-121491

The Fiber Admin WordPress plugin (versions 3.1.0-4.0.0 ) is vulnerable to Remote Code Execution (RCE) due to a failure to validate or escape a request header before writing it into a regenerated PHP file. This occurs on an unprotected admin hook. An unauthenticated attacker can achieve execution ...

EUVD-2026-118943

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race...

CVE-2026-121491 Fiber Admin 3.1.0 - 4.0.0 - Unauthenticated RCE via Host Header

The Fiber Admin WordPress plugin before 4.0.1 does not validate or escape a request header before writing it into a PHP file it regenerates on an unprotected admin hook, allowing unauthenticated attackers to execute arbitrary code when its custom database error page is enabled and they win a race...

PT-2026-139184

Name of the Vulnerable Software and Affected Versions Fiber Admin versions 3.1.0 through 4.0.0 Description An issue exists where a request header is not validated or escaped before being written into a regenerated PHP file on an unprotected admin hook. This allows unauthenticated attackers to...

CVE-2026-119285

A flaw was found in Fiber. When configured with wildcard subdomains and credentials enabled, the Cross-Origin Resource Sharing CORS middleware improperly validates domain origins by checking only the host suffix without enforcing a proper domain boundary. A remote attacker can exploit this issue ...

GHSA-M3QR-FVP4-78XJ Arc has unauthenticated application log disclosure via `/api/v1/logs`

Summary Arc exposes GET /api/v1/logs without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check. Details A...

CVE-2026-119285

Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An application configured with a wildcard-subdoma...

Fiber: CORS Wildcard Origins Matched Without A Dot Boundary, Allowing Credentialed Cross-origin Reads

Summary In v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as "https://.example.com" by suffix only, without a dot boundary and without comparing the scheme. Any origin whose host ends with the base domain, for example "https://evil-example.com" or "http://notexample.com",...

Linux Distros Unpatched Vulnerability : CVE-2026-119285

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in...

EUVD-2026-113402

Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads...

GHSA-G5JQ-QMQR-QRWF Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads

Summary In v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as https://.example.com by suffix only, without a dot boundary and without comparing the scheme. Any origin whose host ends with the base domain, for example https://evil-example.com or http://notexample.com, was...