Microsoft SharePoint Server contains a deserialization vulnerability allowing unauthenticated remote code execution over the network, with active exploitation confirmed and patches pending full release.
We need to produce a comprehensive analysis of CVE-2025-7862 based on all provided data, with strict adherence to formatting and content rules. First, let's parse the data: CVE-2025-7862 Description: A vulnerability in TOTOLINK T6 firmware 4.1.5cu.748_B20211015, classified as critical. The function setTelnetCfg in /cgi-bin/cstecgi.cgi of Telnet Service, argument telnet_enabled with input 1 leads to missing authentication. Attack can be launched remotely. Exploit disclosed publicly. CVSS: 5.5 (this is a CVSS 4.0 score, not CVSS 3.1) with vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/... etc. Base score 5.5 seems low despite AV:N/PR:N because impact is Low on all three. So it's a low-impact vulnerability (maybe enable telnet with low impact on confidentiality/integrity/availability? Actually, it's missing authentication so enabling telnet might allow unauthenticated access. CVSS 4.0 has VC:L/VI:L/VA:L, meaning low impact on confidentiality, integrity, availability of the vulnerable component. SC:N/SI:N/SA:N means no impact to subsequent systems. So it's low severity. CWE-287: Improper Authentication Multi-source: - EPSS: 0.18% (low, 39th percentile) — low probability of exploitation being active. - POC/Exploit: Publicly available. - Reported by cna@vuldb.com - CPE: cpe:2.3:o:totolink:t6_firmware:v4.1.5cu.748_b20211015... (firmware, version exactly that) - Tags: Authentication Bypass, T6 Firmware - References: multiple github links with exploit details, youtube video. No official vendor advisory. No KEV mention (so not in KEV). No patch info in the input explicitly. Let's interpret the vulnerability: The setTelnetCfg function in a CGI script takes a parameter telnet_enabled. If sent with value 1 (likely a request without authentication), the Telnet service gets enabled without proper authentication check. So an unauthenticated remote attacker can enable telnet on the device, which might then allow them to access it via telnet without credentials (missing authentication for telnet itself or the configuration action?). The description says "missing authentication" for the action of setting telnet_enabled. So anyone can remotely send a request to enable telnet, which would then expose the device to unauthenticated telnet logins? The impact is that an attacker could enable telnet and then gain access to the device (low integrity, low confidentiality, low availability). CVSS 4.0 indicates low impacts (all L), so maybe it's just enabling a service that is itself unauthenticated, but the overall compromise is not full root? However, low impact for confidentiality, integrity, availability suggests the vulnerability alone doesn't give full access; maybe telnet itself still requires login, but missing authentication on configuration change allows enabling a service that is normally disabled. But then the attacker would have to have telnet credentials? The missing authentication allows an attacker to turn on telnet, which then maybe has default credentials, so the chain could lead to unauthorized access. Still, the base score is low (5.5) in CVSS 4.0 (which is roughly medium). But the vulnerability is classified as critical by reporter. The discrepancy: reporter calls it critical, but CVSS 4.0 base 5.5 is medium-low. The CVSS vector is from vuldb? The submitted vector has PR:N, AV:N, so it's remotely exploitable, but impacts are low. So it's not a critical vulnerability per CVSS, but the ability to enable telnet remotely without auth could be a stepping stone. We need to produce a JSON with all fields. Let's go field by field. product_name: "TOTOLINK T6" (should be 1-3 words). TOTOLINK T6 firmware is the product. So product_name: "TOTOLINK T6". summary: Must not copy description. Write "Missing authentication in TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 allows remote unauthenticated attackers to enable the Telnet service by sending a crafted request to the /cgi-bin/cstecgi.cgi endpoint. While the vulnerability has a low CVSS score (5.5) and low EPSS exploitation probability (0.18%), publicly available proof-of-concept exploit code exists, and the lack of authentication on the configuration function could serve as an entry point for further compromise." We need to mention: active exploitation? KEV=NO, so not actively exploited, but POC exists. So "publicly available exploit code exists". Not "confirmed actively exploited". Use phrase "publicly available exploit code exists". Also note EPSS low. technical_context: Explain underlying tech: TOTOLINK T6 is a wireless router, the firmware version affected runs a CGI script /cgi-bin/cstecgi.cgi handling configuration settings. The specific function setTelnetCfg presumably handles telnet configuration, and the vulnerability is CWE-287 Improper Authentication, meaning the function does not verify the caller's credentials before changing the telnet_enabled parameter. The CPE confirms the exact firmware version. risk_assessment: Assess real-world risk. CVSS 4.0 vector: AV:N (network), PR:N (no privileges), UI:N, impact low. So severity low. EPSS 0.18% (low chance of exploitation). KEV: NO. POC: publicly available. SSVC: exploitation status: POC public but no active exploitation; automatable? The attack is simple: send a single HTTP request. Technical impact: low (enable telnet). So risk is low overall. However, the missing authentication on configuration change might be used to enable telnet, which then perhaps exposes default credentials, so the full impact could be higher if chained. But directly, CVSS says low. So it's likely a low-severity issue. Contrast with "critical" classification from reporter. So we'll mention discrepancy: reporter classified as critical, but CVSS base score 5.5 (Medium/Low) and low EPSS suggest lower real-world risk. So not a high priority. But still, for TOTOLINK T6 devices, it could be used as a foothold. If there are no compensating controls (like telnet not useful without credentials), the risk might be limited. The CVSS vector indicates low confidentiality, integrity, availability impacts, so maybe the exploit just enables telnet, but the actual telnet service still requires authentication (e.g., default credentials), so the missing authentication on the enable action doesn't directly grant access; rather it enables a service that could then be brute-forced. That's why impacts are low. So the risk is limited. We should note that the available exploit does not grant root, but opens a service. So real risk is low despite public exploit. affected_products: "TOTOLINK T6 firmware version 4.1.5cu.748_B20211015. According to CPE string cpe:2.3:o:totolink:t6_firmware:v4.1.5cu.748_b20211015, only this version is explicitly affected. References include the vendor website (totolink.net) but no vendor advisory confirming affected versions. The GitHub PoC specifically targets this firmware version." remediation: "As of this analysis, no vendor patch has been identified. Administrators should check TOTOLINK's official website for an updated firmware version that addresses CVE-2025-7862. In the interim, consider implementing network-layer access controls to restrict access to the /cgi-bin/cstecgi.cgi endpoint from untrusted IP addresses. Disable remote administration via WAN if feasible. Note that blocking access to the CGI endpoint may also disable other web management functions. Monitoring for unexpected enablement of Telnet via syslog or configuration changes can help detect exploitation." The input references did not include a patch advisory, so we state no patch identified. exploit_scenario: "An attacker on the same network or internet-facing device sends an unauthenticated HTTP request to /cgi-bin/cstecgi.cgi with the parameter telnet_enabled=1. The request bypasses authentication checks, causing the Telnet service to start. With Telnet now enabled and potentially using default credentials, the attacker can then attempt to log in and gain further control. The publicly available PoC demonstrates this simple exploitation." exploitation_conditions: Extract prerequisites: "The vulnerability affects TOTOLINK T6 routers running firmware version 4.1.5cu.748_B20211015 with the web management interface accessible (default configuration). No authentication is required; the attacker only needs to reach the endpoint. The exploitation condition is that the telnet service must be initially disabled (default state) for the enable action to be meaningful. If telnet is already enabled or the endpoint is not reachable from the attacker's network position, the vulnerability cannot be exploited. The attack is remote and requires no user interaction." So the condition is specific: "The TOTOLINK T6 router must run the vulnerable firmware version, have its web management interface exposed (default), and Telnet initially disabled. No authentication is required." That's concrete. attack_chain: "Send unauthenticated HTTP request to enable telnet → The CGI script processes the request without authentication → Telnet service is started and becomes accessible → Attacker connects via Telnet using default credentials or brute-force → Achieve limited impact on confidentiality, integrity, and availability." But the description only mentions enabling telnet, not credentials. So we could have a shorter chain: "Send crafted request to enable Telnet → Bypass authentication → Telnet service starts, enabling subsequent unauthorized access attempts." I'll use: "Access exposed router web interface → Send HTTP request to /cgi-bin/cstecgi.cgi with telnet_enabled=1 → Missing authentication check allows configuration change → Telnet service is enabled → Attacker can now attempt Telnet login with default or brute-forced credentials → Gain low-level access to router." That reflects kill chain phases: Access, Delivery, Exploit, Execution, Impact. 6 steps maybe. I'll do: "Access reachable router web management → Deliver crafted HTTP POST/GET with telnet_enabled=1 → Exploit missing authentication to process request → Execute enabling of Telnet daemon → Establish Telnet connection to router → Impact: low confidentiality/integrity/availability via Telnet access." confident_notes: "Exploit confirmed publicly via GitHub and YouTube video. No vendor advisory or patch exists, and CVE entry assigned by VulDB (cna@vuldb.com). No confirmation of active exploitation in the wild (CISA KEV not listed). The CVSS 4.0 vector is provided by the reporter; low impact scores align with the limited nature of the bug. EPSS probability suggests minimal exploitation activity." We'll say: "Exploit code publicly available and confirmed by external PoC references. The CVE was issued by VulDB, not the vendor, and no patch has been released. No independent confirmation of active exploitation; EPSS score of 0.18% indicates low exploitation probability." prevalence: TOTOLINK routers are not as widespread as major brands, but T6 is a specific model. Likely medium? I'd say "low" because it's a specific consumer router model from a lesser-known brand, not widely deployed in enterprise. The product is a home router, so maybe medium if it's popular in some markets. But we can't be sure. I'll use "low" with justification. prevalence: "low" prevalence_basis: "specific consumer router model with limited market share" assessed_cvss_vector: Need to create our own CVSS 3.1 base metric for this. Since the CVSS 4.0 vector suggests AV:N/AC:L/PR:N/UI:N, but impact is limited to low, we will produce a CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. That gives a base score of 4.3 (close to CVSS 4.0 5.5). But CVSS 3.1 with C:L/I:L/A:L yields 5.0? Let's calculate: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L => base score 5.0? Actually, CVSS 3.1 calculator: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L -> 5.0 (Medium). But our CVSS 4.0 base was 5.5, so I'll just produce the 3.1 vector with proper reasoning. However, we
Authentication bypass in MetaCRM up to 6.4.2 allows unauthenticated remote attackers to gain unauthorized access via the /debug.jsp endpoint. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed (no CISA KEV listing). The vulnerability carries a medium base score (CVSS 5.5) and a low exploitation probability (EPSS 0.12%).
SQL injection in code-projects Church Donation System 1.0 enables unauthenticated remote attackers to read or modify database content through the Username parameter in search.php. A public exploit is available, but no evidence of active exploitation exists and the EPSS probability is extremely low.
SQL injection in code-projects Church Donation System 1.0 allows remote attackers to manipulate database queries via the Username parameter in /members/login_admin.php. Public exploit code is available, but no active exploitation has been confirmed. The CVSS 4.0 score is 5.5 (medium), and EPSS exploitation probability is very low (0.07%), indicating limited real-world risk despite the publicly available exploit.
SQL injection in code-projects Church Donation System 1.0 allows unauthenticated remote attackers to manipulate the new_password parameter in /members/update_password_admin.php, enabling arbitrary SQL execution that can modify admin passwords or extract data. A public exploit is available, though EPSS (0.07%) suggests low exploitation probability in the wild.
Command injection in Eluktronics Control Center 5.23.51.41 allows local authenticated users to execute arbitrary PowerShell commands with elevated privileges through the AiStoneService component. The vulnerability has public exploit code available (CVSS E:P) and affects a PC hardware control software, enabling local privilege escalation. Vendor was notified but did not respond, leaving the vulnerability unpatched. EPSS data not available, but the local-only attack vector (AV:L) and authentication requirement (PR:L) limit widespread exploitation risk despite the critical CVSS 7.1 score.
Remote code execution in Metasoft MetaCRM through 6.4.2 allows authenticated remote attackers to execute arbitrary code via unsafe deserialization of the 'p' parameter in the AnalyzeParam function of download.jsp. Publicly available exploit code exists; CVSS 2.1 score reflects required authentication (PR:L) and limited technical impact scope, but exploitation probability is marked as probable (E:P). Vendor did not respond to early disclosure notification.
Unrestricted file upload in Metasoft MetaCRM up to version 6.4.2 via the mobileupload.jsp endpoint allows authenticated remote attackers to upload arbitrary files with limited integrity and confidentiality impact. The vulnerability has been publicly disclosed with exploit code available on GitHub. Despite early vendor contact, Metasoft has not provided a patch or acknowledgment, leaving deployments unpatched.
Unrestricted file upload in Metasoft MetaCRM up to version 6.4.2 allows authenticated remote attackers to upload arbitrary files via the File parameter in sendfile.jsp, potentially enabling remote code execution or data exfiltration. The vulnerability has publicly available exploit code and affects systems with basic user authentication; however, the CVSS score of 2.1 reflects limited confidentiality, integrity, and availability impact in the base score, though exploitability is marked as probable (E:P).
Unrestricted file upload in Metasoft MetaCRM up to version 6.4.2 allows authenticated remote attackers to upload arbitrary files via the File parameter in /business/common/sms/sendsms.jsp, potentially leading to remote code execution or data compromise. The vulnerability has a low CVSS score (2.1) due to authentication requirements and limited confidentiality impact, but publicly available exploit code exists and the vendor has not responded to early disclosure.
Unrestricted file upload in Metasoft MetaCRM up to version 6.4.2 allows authenticated remote attackers to upload arbitrary files via the /common/jsp/upload2.jsp endpoint, potentially enabling remote code execution or data exfiltration. The vulnerability requires valid user credentials (PR:L) but involves minimal technical complexity (AC:L). Public exploit code is available and the vendor has not responded to early disclosure notifications.
Cross-site scripting (XSS) in WikiDocs up to version 1.0.78 allows remote attackers to inject malicious scripts via the path parameter in template.inc.php, requiring user interaction to trigger. The vulnerability has publicly available exploit code and carries a low CVSS score (2.1) due to its reliance on user interaction and limited impact scope, though the EPSS score of 0.10% suggests minimal real-world exploitation likelihood despite public disclosure.
Reflected cross-site scripting in Huashengdun WebSSH up to version 1.6.2 allows remote attackers to inject malicious scripts via the hostname or port parameters on the login page, requiring user interaction to trigger. The vulnerability has a low CVSS score of 2.1 due to user interaction requirement and limited impact (integrity only), but publicly available exploit code exists and the vendor has not responded to disclosure attempts.
SQL injection in itsourcecode Insurance Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the recipt_no parameter in /insertPayment.php, resulting in limited confidentiality and integrity impact. The vulnerability requires valid user credentials (PR:L) and carries a low CVSS score of 2.1 despite being classified critical by the discoverer. Exploit code is publicly available and has been disclosed, though no active widespread exploitation has been reported.
SQL injection in itsourcecode Insurance Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the nominee_id parameter in /insertNominee.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists, though EPSS scoring (0.09th percentile) suggests minimal real-world exploitation likelihood despite the critical classification and public disclosure.
SQL injection in Onyx Chat Interface allows authenticated remote attackers to manipulate database queries via the generate_simple_sql function in the KB search component. Versions up to 0.29.1 are affected. While the CVSS score is low (2.1) due to limited impact scope and authentication requirement, public exploit code exists and the vendor has not responded to early disclosure, increasing real-world risk for users who cannot rapidly patch.
SQL injection in TDuckCloud tduck-platform 5.1 allows authenticated remote attackers to manipulate the formKey parameter in the UserFormDataMapper function, enabling unauthorized database queries with limited confidentiality and integrity impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
SQL injection in Metasoft MetaCRM up to version 6.4.2 allows authenticated remote attackers to execute arbitrary SQL commands via the workerid parameter in mcc_login.jsp, with publicly available exploit code disclosed after vendor non-response. Despite a CVSS score of 2.1, the vulnerability requires prior authentication (PR:L) and offers only limited confidentiality/integrity impact (VC:L/VI:L), making real-world exploitation risk significantly lower than the critical severity designation suggests.
Unrestricted file upload in JeeSite up to version 5.12.0 allows authenticated remote attackers to upload arbitrary files via the FileUploadController, potentially leading to remote code execution or data exfiltration. The vulnerability has a publicly disclosed proof-of-concept and is classified as critical despite a low CVSS 4.0 score of 2.1, indicating that the CVSS vector (requiring authenticated access and limited scope of impact) does not fully reflect the practical severity of unrestricted file upload capabilities in a web application context.
RuoYi versions up to 4.8.1 allow authenticated users to upload files without restriction via the CommonController.uploadFile function, enabling arbitrary file upload. The vulnerability requires valid credentials (PR:L per CVSS vector) but permits remote exploitation with low complexity. Public exploit code exists; however, EPSS score of 0.05% (15th percentile) suggests minimal real-world exploitation despite public disclosure, indicating the threat is constrained by authentication requirements or other practical barriers.
Improper restriction of rendered UI layers in RuoYi up to version 4.8.1 allows authenticated remote attackers to manipulate image source handling, leading to unauthorized UI layer visibility or modification. The CVSS score of 2.1 reflects limited integrity impact requiring authenticated access, but the low EPSS score (0.05%, 15th percentile) suggests this vulnerability has minimal real-world exploitation probability despite publicly available exploit code.
RuoYi up to version 4.8.1 uses hardcoded default credentials in the Druid database configuration file (application-druid.yml), allowing authenticated remote attackers to gain low-impact information disclosure. The vulnerability requires prior authentication (PR:L per CVSS 4.0) and has been publicly disclosed with exploit details available, though EPSS scoring (0.05%) and the low CVSS impact (VC:L only) suggest limited real-world exploitation risk despite the proof-of-concept availability.
Unrestricted file upload in Codecanyon iDentSoft 2.0 Account Setting Page allows high-privileged remote attackers to upload arbitrary files via the photo parameter in /clinica/profile/updateSetting, potentially enabling code execution or system compromise. CVSS score of 2.0 reflects the requirement for high-privilege authentication, but publicly available exploit code exists and the vulnerability has been disclosed. This is primarily a privilege-escalation concern affecting administrators rather than a default-configuration flaw.
Stored cross-site scripting (XSS) in JeeSite's xssFilter function allows authenticated users to inject malicious scripts via the text parameter in EncodeUtils.java, affecting versions up to 5.12.0. The vulnerability requires user interaction to trigger payload execution and has publicly available exploit code. With EPSS score of 0.07% and CVSS 2.0, exploitation likelihood is low despite public disclosure, but remediation is straightforward via vendor patch.
Stored cross-site scripting (XSS) vulnerability in Portabilis i-Educar 2.9.0 and 2.10.0 allows authenticated users to inject malicious scripts via the novo_titulo and novo_descricao parameters in the Agenda Module (/intranet/agenda.php), which are then executed in the browsers of other users viewing the affected content. The vulnerability requires user interaction (victim must view the crafted agenda entry) and authenticated access, resulting in a low-severity impact with an EPSS exploitation probability of 0.06% percentile 19. Public exploit code is available, though vendor did not respond to early disclosure notification.
Stored cross-site scripting (XSS) in RuoYi up to version 4.8.1 allows authenticated users to inject malicious scripts via the SysNoticeController.addSave function, compromising integrity of system notices. The vulnerability requires user interaction and authenticated access but has a publicly available proof-of-concept. With an EPSS score of 0.05%, exploitation remains unlikely in practice despite the public disclosure.
Stored cross-site scripting in PHPGurukul Apartment Visitors Management System 1.0 allows authenticated users to inject malicious scripts via the adminname parameter in /admin-profile.php, affecting other administrators who view the modified profile. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting its severity despite remote network accessibility. Publicly available exploit code exists, though real-world exploitation depends on social engineering authenticated users to click malicious links or administrative interaction.
Stored cross-site scripting (XSS) in Portabilis i-Diario 1.5.0 allows authenticated users to inject malicious scripts via the Justificativa parameter in the /justificativas-de-falta endpoint, which are then executed in the browsers of other users viewing the page. The vulnerability requires user interaction (clicking a malicious link) and authenticated access, limiting its severity despite public exploit availability. EPSS exploitation probability is very low at 0.05 percentile, and the vendor has not responded to disclosure.
Stored cross-site scripting (XSS) in Portabilis i-Diario 1.5.0 allows authenticated users to inject malicious scripts via the filter[by_description] parameter in the /conteudos endpoint, which are then reflected to other users. The vulnerability requires user interaction (UI:P) to trigger but has low confidentiality impact and publicly available exploit code; however, the extremely low EPSS score (0.05%) and vendor non-responsiveness suggest limited real-world exploitation despite disclosed POC.
Cross-site scripting (XSS) in Portabilis i-Diario 1.5.0 allows authenticated users to inject malicious scripts via the Anexo parameter in the justificativas-de-falta endpoint, impacting other users who view the affected content. The vulnerability requires user interaction and authenticated access, with an EPSS score of 0.05% indicating low real-world exploitation likelihood despite public exploit availability. The vendor has not responded to disclosure communications.
Stored cross-site scripting in Portabilis i-Educar up to version 2.10 allows authenticated remote attackers to inject malicious scripts via the Motivo/descricao parameter in the Calendar Module (/intranet/educar_calendario_dia_motivo_cad.php), requiring user interaction to execute. Public exploit code is available and the vendor has not responded to disclosure attempts despite early notification.
Stored cross-site scripting in Portabilis i-Educar 2.9.0 allows authenticated remote attackers to inject malicious scripts via the nm_tipo parameter in the Turma Module administrative interface. The vulnerability requires user interaction and affects the integrity of application data. Publicly available exploit code exists, and the vendor has not responded to disclosure.
Stored cross-site scripting (XSS) in Portabilis i-Educar 2.9.0 allows authenticated users to inject malicious scripts via the 'Deficiência ou Transtorno' parameter in the Disabilities Module (/intranet/educar_deficiencia_lst.php), affecting other users who view the injected content. The vulnerability requires user interaction (victim must view the page) and authenticated access, limiting its severity to reflected/stored XSS with user-level privileges. Public exploit code exists, but active exploitation has not been confirmed in CISA KEV, and the vendor has not responded to disclosure.
Weak password recovery in Mercusys MW301R 1.0.2 Build 190726 allows high-privileged authenticated attackers to manipulate the code argument in the web interface to disclose or modify password recovery mechanisms, with publicly available exploit code. The vendor has not responded to early disclosure notification. EPSS exploitation probability is 0.04% (13th percentile), indicating minimal real-world exploitation likelihood despite public POC availability.
IDnow App for Android up to version 9.6.0 improperly exports application components via AndroidManifest.xml misconfiguration, allowing local attackers with user-level privileges to access sensitive functionality or information disclosure. The vulnerability is classified as low severity (CVSS 1.9) with publicly available exploit code, but the vendor has not responded to disclosure and no patch has been released. While exploitation requires local device access and legitimate app installation, the improper component export could enable privilege escalation or data theft when combined with other vulnerabilities.
InstantBits Web Video Cast on Android versions up to 5.12.4 improperly exports application components via AndroidManifest.xml configuration, allowing local attackers with user privileges to access sensitive functionality without authentication. The vulnerability has a CVSS score of 1.9 with low confidentiality impact and no integrity or availability impact, but is rated problematic due to the disclosure of exploitation techniques and vendor non-responsiveness. This is a local, low-severity information disclosure issue affecting only users with direct device access.
Foresight News App for Android versions up to 2.6.4 improperly exports application components via AndroidManifest.xml, allowing local attackers with limited privileges to access sensitive information. The CVSS 1.9 score reflects low actual impact (information disclosure only, no integrity or availability loss), though the vulnerability is publicly exploitable. EPSS percentile of 13% indicates minimal real-world exploitation likelihood despite public POC availability, suggesting this is a low-priority issue for most deployments.
Dunamu StockPlus Android app versions up to 7.62.10 improperly export application components via AndroidManifest.xml configuration, allowing local attackers with low privileges to access sensitive functionality. The vulnerability requires local device access and affects the com.dunamu.stockplus component, resulting in limited information disclosure. Publicly available exploit code exists, and the vendor did not respond to early disclosure notification.
CallApp Caller ID App versions up to 2.0.4 on Android improperly export application components via AndroidManifest.xml misconfiguration, allowing local authenticated attackers to access sensitive functionality with limited information disclosure impact. The vulnerability has been publicly disclosed with exploit code available, though the CVSS score of 1.9 and EPSS of 0.03% indicate minimal real-world exploitation risk despite public POC availability.
SQL injection in pmTicket project management software allows remote attackers to manipulate database queries via the user_id parameter in the getUserLanguage function. All known versions are affected due to the project's rolling release model; the vendor has not responded to the disclosure.
Improper brute-force protection in the Mercusys MW301R router allows local network attackers to conduct excessive authentication attempts against the login component without rate limiting. The vulnerability affects firmware version 1.0.2 Build 190726 Rel.59423n and permits attackers to bypass authentication attempt restrictions, though actual credential compromise requires additional attack complexity. Public exploit code exists, but the vendor has not responded to disclosure and provided no patch.
Eluktronics Control Center 5.23.51.41 permits local authenticated users to bypass data authenticity verification in the REG File Handler component, resulting in potential information disclosure. The vulnerability requires local access and authenticated privileges but carries minimal real-world impact given the CVSS 1.9 score and EPSS exploitation probability of 0.01% (third percentile). Public exploit code has been disclosed, though vendor has not responded to disclosure notifications.