Untrusted search path vulnerability in the installation functionality in ActivePython 3.2.2.3, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Information Disclosure
Microsoft
Activepython
NVD
Exploit-DB
CVSS 3.1
7.3
EPSS
0.4%
install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
PHP
Privilege Escalation
RCE
Webcalendar
NVD
CVSS 2.0
7.5
EPSS
1.3%