OS command injection in TOTOLINK A3002R firmware 1.1.1-B20200824.0128 allows authenticated remote attackers to execute arbitrary commands via the wlanif argument in formWlSiteSurvey. Public exploit code exists, and EPSS score of 3.75% (88th percentile) indicates moderate exploitation likelihood.
Unrestricted file upload in ruoyi-ai 2.0.0 allows remote authenticated attackers to upload arbitrary files via the speechToTextTranscriptionsV2/upload endpoint. Public exploit code exists, and a patch is available in version 2.0.1. EPSS score is low (0.15%), indicating limited exploitation likelihood.
Path traversal vulnerability in diyhi bbs 6.8 allows remote authenticated attackers to read or write arbitrary files via the dirName parameter in the ForumManageAction API. Public exploit code is available, but no active exploitation has been reported.
Cross-site request forgery in SourceCodester Gym Management System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated admin. A publicly available exploit exists, but no active exploitation has been confirmed. The EPSS score is low (0.08%), indicating low exploitation likelihood.
Cross-site scripting (XSS) in code-projects School Fees Payment System 1.0 allows remote attackers to inject arbitrary web script via the 'transcation_remark' parameter in /fees.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.06%), indicating low exploitation likelihood.
SQL injection in code-projects Online Shopping Store 1.0 allows remote authenticated attackers to manipulate database queries via the cat_id, brand_id, keyword, proId, or pid parameters in /action.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.14%), indicating limited exploitation likelihood.
Cross-site scripting (XSS) in CodeAstro Patient Record Management System 1.0 allows an authenticated high-privilege user to inject arbitrary JavaScript via the Patient Name/Name argument on the Generate New Report Page. Publicly available exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.09%), indicating low exploitation likelihood.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the School Name parameter on the System Settings page. A public exploit exists, but the vulnerability requires high privileges and user interaction, limiting real-world impact.
Cross-site scripting (XSS) in SourceCodester Student Result Management System 1.0 allows an authenticated admin to inject arbitrary JavaScript via the Manage Students module. A public exploit exists, but exploitation requires high privileges and user interaction, limiting real-world risk.
Heap-based buffer overflow in Nokogiri's gumbo HTML5 parser allows local attackers to cause a denial of service via crafted HTML with long duplicate attributes. The vulnerability affects versions 1.18.0 through 1.18.7 and is fixed in commit ada4708e5a67114402cd3feb70a4e1d1d7cf773a, though no official release includes the patch. Public exploit code exists, but active exploitation is not confirmed (not in CISA KEV). EPSS score is low (0.02%), indicating low exploitation likelihood.
Heap-based buffer overflow in Nokogiri's gumbo HTML5 parser allows local attackers to cause a denial of service via crafted HTML with long duplicate attributes. The vulnerability exists in the hashmap implementation within gumbo-parser/src/hashmap.c, affecting versions 1.18.0 through 1.18.7. A public exploit exists, but the maintainer states the vulnerable code was never in an official release, and the real existence is doubted. EPSS score is low (0.02%), and no active exploitation has been confirmed.
Cross-site request forgery in CodeAstro Expense Management System 1.0 allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability is triggered via a crafted request, requiring user interaction. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).