Cross-site request forgery in the WordPress plugin Import external attachments (≤1.5.12) allows an unauthenticated attacker to trick an administrator into performing unintended actions, such as modifying settings or triggering imports, by enticing them to click a malicious link while logged in. The vulnerability has low integrity impact and requires user interaction, with no confidentiality or availability impact. No active exploitation or public exploit code has been identified, and with the affected plugin’s niche deployment, the real-world risk is minimal.
Cross-Site Request Forgery in the Hide Admin Bar From Front End WordPress plugin (≤1.0.0) allows unauthenticated attackers to trick site administrators into performing unintended actions, such as modifying plugin settings that control admin bar visibility. No active exploitation or public exploit code is known, and the EPSS exploitation probability is very low (0.02%).
Cross-site request forgery (CSRF) in the ONet Regenerate Thumbnails plugin for WordPress allows remote attackers to trick administrators into triggering unauthorized thumbnail regeneration. Affected versions include n/a through 1.5. The vulnerability has a CVSS 4.3 score, requires user interaction, and there is no evidence of active exploitation or public exploit code.
A Cross-Site Request Forgery vulnerability in the WP YouTube Live WordPress plugin up to version 1.10.0 allows unauthenticated attackers to trick an authenticated administrator into unknowingly performing actions, such as modifying plugin configuration. This can lead to limited integrity impact with no confidentiality or availability loss. No active exploitation or public exploit code has been observed, and the EPSS probability of exploitation is very low (0.02%).
Cyrlitera WordPress plugin versions through 1.2.0 contain a cross-site request forgery (CSRF) vulnerability allowing remote attackers to craft requests that, when submitted by an authenticated administrator, can modify plugin settings. There is no evidence of active exploitation, and EPSS predicts a very low exploitation probability (0.02%).
Cross-site request forgery in PDF Invoice Builder plugin versions up to 1.2.148 enables remote unauthenticated attackers to trick authenticated administrators into performing actions that modify invoice data, leading to limited integrity impact (CVSS 4.3). No exploit code or active exploitation is publicly reported; the EPSS exploitation probability is extremely low at 0.02%.
Unauthorized modification of cookie consent settings in the Cookiebot WordPress plugin up to version 4.5.8 allows unauthenticated attackers to perform Cross-Site Request Forgery (CSRF) attacks. An attacker can trick a logged-in administrator into clicking a malicious link, leading to changes in cookie consent configuration. No active exploitation (CISA KEV) or public exploit code has been identified, and EPSS indicates very low exploitation probability (0.02%).
Cross-Site Request Forgery in the Burst Statistics WordPress plugin (≤2.0.6) could allow an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings, by submitting a crafted request. Exploitation requires user interaction and no public exploit code or active exploitation is known. The very low EPSS score (0.02%) further indicates minimal real-world risk.
The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attackers to trigger a calendar sync via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
Lychee is a free, open-source photo-management tool. Prior to version 6.6.13, a critical Server-Side Request Forgery (SSRF) vulnerability exists in the `/api/v2/Photo::fromUrl` endpoint. This flaw lets an attacker instruct the application’s backend to make HTTP requests to any URL they choose. Consequently, internal network resources-such as localhost services or cloud-provider metadata endpoints-become reachable. The endpoint takes a URL from the user and calls it server-side via fopen() without any safeguards. There is no IP address validation, nor are there any allow-list, timeout, or size restrictions. Because of this, attackers can point the application at internal targets. Using this flaw, an attacker can perform internal port scans or retrieve sensitive cloud metadata. Version 6.6.13 contains a patch for the issue.
A privilege escalation vulnerability (CVSS 2.9) that allows a bypass of build isolation. Remediation should follow standard vulnerability management procedures.
Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.
Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.
Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.
Path traversal in gooaclok819 sublinkX's AddTemp function allows authenticated remote attackers to read or write arbitrary files on the server. All versions up to 1.8 are affected, with publicly disclosed exploit code available. The vulnerability is fixed in version 1.9.
CVE-2025-6765 is a security vulnerability (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
SQL injection in the findAllHosByCondition method of sfturing hosp_order allows a remote authenticated attacker to manipulate the hospitalName parameter to execute arbitrary SQL commands. The vulnerability affects the project up to commit 627f426331da8086ce8fff2017d65b1ddef384f8 and has publicly available exploit code, but it requires low-privilege authentication and has a low CVSS 4.0 score of 2.1 due to limited impact. No versioned patch exists because the project uses continuous delivery, but the issue is tracked in the GitHub repository.
SQL injection in the findDoctorByCondition function of sfturing hosp_order allows authenticated remote attackers to execute arbitrary SQL commands via the hospitalName parameter. Exploit code is publicly available, though no active exploitation has been confirmed (CISA KEV not listed, EPSS score of 0.04% indicates low exploitation probability).
SQL injection in bicycleSharingServer 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the selectAdminByNameLike function in AdminController.java, potentially exposing or altering database contents. An exploit is publicly available, though no active exploitation has been confirmed.
SQL injection in bicycleSharingServer's AdminController.java allows remote authenticated low-privilege users to manipulate the Title parameter, potentially leading to limited data exposure or modification. Public exploit code exists (GitHub issue) but no active exploitation reported and EPSS score is low (0.04%), indicating low real-world exploitation likelihood.
SQL injection in huija bicycleSharingServer via the userDao.selectUserByUserNameLike function allows low-privileged remote attackers to execute arbitrary SQL commands. The exploit has been publicly disclosed, and while no active exploitation is confirmed, the vulnerability is present in the rolling-release codebase up to at least commit 7b8a3ba48ad618604abd4797d2e7cf3b5ac7625a. An attacker could extract or modify sensitive data, potentially compromising user accounts or the underlying database.
Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.
Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code.
Rejected reason: Not used. No vendor patch available.
Rejected reason: Not used. No vendor patch available.
Rejected reason: Not used. No vendor patch available.
Rejected reason: Not used. No vendor patch available.
Rejected reason: Not used. No vendor patch available.
Rejected reason: Not used. No vendor patch available.
Rejected reason: Not used. No vendor patch available.
Rejected reason: Not used. No vendor patch available.
Rejected reason: Not used. No vendor patch available.
Rejected reason: Not used. No vendor patch available.