Edge heap overflow, a 9.8 SQLi with full PoC, and a PowerShell privesc

The Object Sync for Salesforce WordPress plugin has an unauthenticated SQL injection bug in its REST API push route. No login, no nonce, no capability check: anyone on the internet can send a crafted request to `/wp-json/object-sync-for-salesforce/push/` and pull password hashes and other sensitive data straight out of your WordPress database. The only prerequisite is knowing a valid post ID (and `1` works). CVSS 7.5, time-based blind injection confirmed.

Affected estate

WordPress site owners and hosts running the Object Sync for Salesforce plugin

How to check

Check wp-admin > Plugins for 'Object Sync for Salesforce' or run `wp plugin list` via WP-CLI. Also check if the REST route `/wp-json/object-sync-for-salesforce/push/` responds.

Included because

unauthenticated; internet-facing; SQL injection; no auth required; common CMS plugin

Action

Update the plugin to the patched release. If no fix is available, deactivate and delete the plugin. Review database logs for unusual queries against the push endpoint.

Why it matters

Unauthenticated attackers can dump your entire WordPress database, including user credentials and private content, with no login required.

Metacat, the data repository platform used in the DataONE network, has a critical unauthenticated SQL injection in its `/cn/v1/object` and `/cn/v2/object` REST endpoints. The `nodeId` parameter goes straight into a PostgreSQL query with zero sanitization, and error messages reflect query results back to the caller. That means attackers can read, insert, update, and delete anything in the database without logging in. Full proof-of-concept exploits exist. CVSS 9.8.

Affected estate

Teams running Metacat versions 2.0.0 through 3.4.0, especially DataONE member node operators

How to check

Check your Metacat version in the admin console or deployment config. Verify whether the `/cn/v1/object` endpoint responds to unauthenticated requests.

Included because

unauthenticated; internet-facing; CVSS 9.8; full PoC available; data exfiltration and modification

Action

Upgrade to Metacat 3.4.1. If immediate upgrade isn't possible, remove the servlet and servlet-mapping entries for CNRestServlet v1 and v2 from your Tomcat web.xml and restart Tomcat.

Why it matters

Full database compromise: attackers can exfiltrate user identities, ORCID IDs, IP addresses, access controls, and access logs, and can also modify or delete catalog data.

Source

Metacat GitHub Advisory

AllData (alldatacenter/alldata) up to version 0.6.8 has a remote deserialization bug in its Hessian2 serializer, reachable through the xxl-rpc listener. An attacker can send a malicious serialized object over the network to get code execution. A public exploit exists, and the project maintainers closed the report as 'not planned,' meaning no fix is coming. CVSS 7.3.

Affected estate

Anyone running AllData (alldatacenter) version 0.6.8 or earlier with the xxl-rpc listener exposed

How to check

Check your AllData version in the deployment config. Verify whether the xxl-rpc listener port is open and reachable from untrusted networks.

Included because

remote code execution; public exploit; vendor will not patch; network-accessible

Action

Firewall off the xxl-rpc listener from untrusted networks. Evaluate removing AllData or forking the project to add input validation, since the vendor has declined to patch.

Why it matters

Public exploit, remote deserialization to code execution, and the vendor has explicitly refused to fix it. You're on your own.

A heap-based buffer overflow in Microsoft Edge (Chromium-based) lets an unauthenticated attacker run code over the network. In practice, this likely means a malicious or compromised webpage can trigger code execution in the browser process. No user interaction beyond visiting a page is explicitly required. CVSS 8.3, not yet exploited in the wild.

Affected estate

Anyone running Microsoft Edge on Windows, macOS, or Linux

How to check

Open edge://settings/help to see the current version, or query Edge versions across your fleet via Intune, SCCM, or your endpoint management tool.

Included because

unauthenticated; network-exploitable; CVSS 8.3; widely deployed browser

Action

Push the latest Edge update via Microsoft Update, Intune, or WSUS. Verify browsers have restarted to pick up the new version.

Why it matters

A heap overflow reachable from a webpage can give an attacker code execution on every endpoint in your fleet that browses the wrong site.

Source

Microsoft Security Advisory