SQL injection in CloudClassroom-PHP Project v1.0 exposes the application to remote, unauthenticated database manipulation via the `viewid` parameter. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero prerequisites - any internet-accessible instance is directly exploitable without credentials. A publicly available proof-of-concept exists on GitHub, though EPSS at 0.31% (23rd percentile) indicates low observed exploitation probability at time of analysis, consistent with the obscure deployment footprint of this niche educational PHP application. No active exploitation is confirmed in CISA KEV.
Stored cross-site scripting in tawk.to Live Chat 1.6.1 allows unauthenticated remote attackers to inject persistent JavaScript payloads via the chat widget, which execute in the browsers of support agents or site administrators who view the tainted transcripts. The CVSS 3.1 Scope:Changed metric confirms the injected script executes in the victim's browser origin, enabling session hijacking or credential theft against the hosting site - not merely the chat platform. A public proof-of-concept is available on GitHub; no CISA KEV listing exists and EPSS sits at 0.43% (35th percentile), indicating low current mass-exploitation but a meaningful attacker-accessible entry point given the lowered skill bar from the POC.
SQL injection in ABC Courier Management System 1.0 allows remote attackers to inject malicious SQL via the reciver_name parameter in /Add_reciver.php. Publicly available exploit code exists, though no active exploitation has been reported and EPSS probability is low (0.07%). The vulnerability can lead to
SQL injection in Church Donation System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the Username parameter in /admin/index.php. A public exploit is available, and the vulnerability is confirmed by vendor disclosure.
Missing authorization in Droip plugin for WordPress (all versions ≤2.2.6) allows authenticated attackers with Subscriber-level privileges to manipulate content and settings via droip_post_apis() AJAX handler. Exploitable actions include arbitrary post deletion/creation, post duplication, settings modification, and user account manipulation. Requires only low-privilege authenticated access (PR:L) for high-impact compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis.
Arbitrary file upload in Themeum Droip WordPress plugin (versions up to 2.5.1) permits authenticated attackers with Subscriber-level privileges or higher to upload malicious files without file type validation in the make_google_font_offline() function, enabling remote code execution on the affected server. CVSS 8.8 severity reflects low privilege requirement (PR:L) and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Salesforce Tableau Server on Windows and Linux allows authenticated attackers with low privileges to conduct Server-Side Request Forgery attacks through the Amazon S3 Connector module, enabling resource location spoofing that could result in unauthorized access to internal systems and data exfiltration. Versions before 2025.1.3, 2024.2.12, and 2023.3.19 are affected. EPSS score of 0.04% (12th percentile) indicates minimal observed exploitation activity, and no public exploit has been identified at time of analysis.
Local privilege-relevant memory-safety flaw in the Linux kernel's NFC NCI UART line-discipline driver (drivers/nfc/nci/uart.c) allows a local attacker to trigger use of a partially-initialized tty->disc_data pointer. The driver assigned tty->disc_data before the NCI device was successfully opened, so if the underlying hardware sent data (or the NCIUARTSETDRIVER ioctl failed) during that window, code paths could operate on a device object that was never fully set up or was torn down on error. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.18%, 8th percentile); the issue was fixed upstream by exposing disc_data only on the success path.
Out-of-bounds read in the Linux kernel virtio-net driver (through 6.16-rc3 and affected stable branches) lets a malicious or buggy virtio backend trigger a read past the allocated buffer inside xdp_linearize_page when XDP is used on the interface. The flaw stems from the driver reading follow-on ring buffers without validating that the reported received length fits within the allocated page, enabling potential information disclosure or a guest crash. There is no public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hard-to-weaponize local kernel memory-safety bug.
Use-after-free in the Linux kernel's TIPC (Transparent Inter-Process Communication) topology server allows a local attacker to corrupt kernel memory by racing network-namespace teardown against TIPC connection handling. The flaw, CWE-416, occurs because tipc_topsrv_stop() dereferences a tipc_conn after dropping the IDR lock while tipc_conn_recv_work() may have concurrently released the object's final reference. It carries a 7.8 (High) CVSS and is fixed upstream; there is no public exploit identified at time of analysis and its EPSS score is very low (0.17%).
Local privilege escalation and memory corruption in the Linux kernel's MediaTek MMC/SD host controller driver (mtk-sd) occurs because msdc_start_data() proceeds with a DMA transfer using stale settings after msdc_prepare_data() fails to map the DMA region. An attacker with local access to a system using MediaTek SD/MMC hardware can trigger an out-of-bounds write (CWE-787) leading to kernel memory corruption with high confidentiality, integrity, and availability impact. This is a code-quality/robustness fix in mainline kernel development (regression affects 6.16 release candidates and backported stable branches); there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.17%, 7th percentile).
Out-of-bounds memory access in the Linux kernel's NVIDIA Tegra I2C driver (i2c-tegra) lets a malicious or malfunctioning SMBus peripheral trigger a buffer over-read during an SMBus block read, because the driver trusted the device-supplied message length without validating it. A local attacker able to control an attached I2C/SMBus device, or to drive such a transfer, can leak adjacent kernel memory or crash the system. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not on CISA KEV.
Out-of-bounds read/write in the Linux kernel's lan743x network driver affects systems using Microchip PCI1xxxx (hearthstone) Ethernet controllers, where incorrect OTP (8 Kb) and EEPROM (64 Kb) maximum size definitions allowed access beyond the intended memory bounds during EEPROM/OTP operations. A local user with the ability to invoke the driver's EEPROM/OTP read/write paths could trigger memory corruption, potentially leading to code execution or privilege escalation (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).
Local privilege escalation via use-after-free in the Linux kernel's ROSE (amateur-radio X.25 PLP) networking stack, where rose_rt_device_down() mishandles neighbour-array compaction and leaves dangling rose_neigh pointers. A local attacker able to manipulate ROSE routing/devices can trigger access to freed kernel memory (CWE-416), enabling memory corruption that can lead to full compromise (confidentiality, integrity, and availability all High). No public exploit identified at time of analysis; EPSS is very low at 0.16% (6th percentile) and it is not on CISA KEV.
Local privilege/security-policy bypass in the Linux kernel's secretmem subsystem allows LSM and SELinux access controls to be evaded on secretmem file descriptors because the S_PRIVATE flag was left set after alloc_anon_inode(), causing inode_init_security_anon() checks to be skipped. The affected code paths are the anonymous-inode helpers used by secretmem (memfd_secret) and KVM guest_memfd, present in Linux 6.16 release candidates and a Debian backport. There is no public exploit identified and EPSS is very low (0.16%), so the practical impact is a defense-in-depth regression that lets a local process create secretmem objects that mandatory-access-control policy should have denied.
Local privilege-escalation-class memory corruption in the Linux kernel's IPMI message handler (ipmi_msghandler) affects the ipmi_create_user() code path, where a list iterator that fails to match the requested intf->intf_num is left pointing at an invalid list-head-derived address and then passed to atomic_dec(&intf->nr_users), corrupting kernel memory. Local low-privileged users interacting with the IPMI subsystem can trigger the flaw, and with a CVSS of 7.8 (high) it threatens full confidentiality, integrity, and availability of the host. This is no public exploit identified at time of analysis, and the low EPSS (0.15%) reflects a niche, hardware-dependent subsystem rather than a mass-exploitation target.
Local privilege escalation and denial of service in the Linux kernel's AMD Platform Management Framework (amd-pmf) driver stems from a double-free (CWE-415) triggered when Smart PC setup fails: dev->buf is freed but not nulled, then freed again during amd_pmf_remove(). The fix converts the driver's allocations to device-managed (devm_*) allocations. No public exploit identified at time of analysis, and EPSS probability is low (0.15%), consistent with a hard-to-reach local-only kernel bug affecting AMD systems on kernels around 6.14-6.16-rc.
Local privilege escalation and memory corruption in the Linux kernel's netfs (network filesystem) subsystem affects development builds 6.16-rc1 through 6.16-rc4, where a reference-counting error causes a double put of a netfs request. When a netfs request completes during the pause loop, the reference tied to the IN_PROGRESS flag is dropped, but the subsequent final wait loop erroneously drops it again, leading to a use-after-free/double-free condition (CWE-415). CVSS is 7.8 (High) requiring low-privileged local access; EPSS is low at 0.15% and there is no public exploit identified at time of analysis.
Kernel WARN triggered in the Linux kernel FUSE filesystem allows a local user mounting a DAX-backed FUSE filesystem to hit an unhandled warning in truncate_folio_batch_exceptionals() during inode eviction (fuse_evict_inode) on file close. The FUSE driver was missing the DAX-entry cleanup fix that xfs and ext4 already received (commit 0e2f80afcfa6), so DAX exceptional entries remained on the mapping at truncate time. Only pre-release kernels 6.16-rc1 through 6.16-rc3 are affected; no public exploit identified at time of analysis and EPSS probability is very low (0.15%).
Local privilege escalation and memory corruption in the Linux kernel's ksmbd in-kernel SMB3 server arises from a use-after-free in the oplock/lease break acknowledgment path, where a failed ksmbd_iov_pin_rsp() response allocation leads to opinfo->state being accessed after free and opinfo_put()/ksmbd_fd_put() being invoked twice. Affected builds include the 6.16 release-candidate series and Debian-packaged stable kernels running ksmbd; an authenticated SMB client interacting with a shared file can trigger the flaw for potential code execution or information disclosure. There is no public exploit identified at time of analysis and EPSS is low (0.15%), but the fix is already merged upstream and shipped via Debian LTS.
Local privilege escalation and host memory corruption in the Linux kernel's LoongArch KVM hypervisor (6.16 release candidates rc1-rc3) arises because the EIOINTC virtual irqchip fails to validate a user-space-supplied 'num_cpu' value against EIOINTC_ROUTE_MAX_VCPUS, allowing an array pointer overflow. A local user with permission to create KVM virtual machines can trigger out-of-bounds access in host kernel memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and the issue was fixed upstream before the 6.16 final release.
Local privilege escalation and denial of service in the Linux kernel's LoongArch KVM hypervisor arises from an array index overflow when handling writes to the EIOINTC_ENABLE register of the emulated extended I/O interrupt controller. Affecting mainline 6.16 release candidates (rc1-rc3) on LoongArch hosts, a low-privileged actor able to program the virtual interrupt controller can write out of the bounds of a kernel array, corrupting memory with high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and EPSS probability is low (0.14%, 4th percentile).
A null pointer dereference vulnerability exists in the AMD display driver within the Linux kernel, where the dce_hwseq structure is accessed without proper null checking in the dce110_blank_stream function. The vulnerability affects Linux kernel versions up to 6.16-rc2 and could allow a local attacker with low privileges to cause a system crash or potentially execute arbitrary code with kernel privileges. With an EPSS score of only 0.02% and no known active exploitation, this represents a low real-world risk despite the high CVSS score.
Out-of-bounds shift in the Linux kernel Squashfs filesystem allows a local attacker to trigger memory corruption by racing a LOOP_SET_BLOCK_SIZE ioctl against a concurrent Squashfs mount on the same loop device, causing sb_min_blocksize() to return 0 and the code in squashfs_fill_super() to compute a shift exponent of 64. The affected subsystem is the kernel Squashfs driver (fs/squashfs/block.c) on Linux and downstream distributions such as Debian 11. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacker to escalate privileges via the /osm/admin/v1/users. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Out-of-bounds access in the Linux kernel's GPIO-based regulator driver (regulator/gpio) allows a local, low-privileged actor to trigger memory corruption on systems where the regulator is configured with more than one GPIO (config::ngpios > 1). The driver under-allocated the drvdata::gpiods array to hold a single gpio_desc pointer instead of ngpios pointers, so subsequent indexing reads beyond the allocation. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV.
Out-of-bounds page table read in the Linux kernel's memory-management rmap subsystem (mm/rmap) allows a local low-privileged user to trigger disclosure of adjacent kernel memory or a crash via the batched unmap path in try_to_unmap_one(). The flaw affects 6.16 release-candidate kernels (6.16-rc1 through rc5) where a large folio's PTE mappings span beyond a single page table, causing folio_unmap_pte_batch scanning to read past the end of a PTE table. Rated CVSS 7.1 (high) with high confidentiality and availability impact; EPSS is very low at 0.16% and there is no public exploit identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's NXP i.MX clock driver (clk-imx) affects 6.16 release candidates rc1 through rc5 running on i.MX95 hardware, where the dispmix_csr_clk_dev_data table uses a hardcoded parent-name count that overruns the parent_names array when num_parents is 4. Triggered automatically during device probe (imx95_bc_probe → __clk_register), it reads eight bytes past a global array, causing memory disclosure into pointer handling and potential kernel instability, as caught by KASAN. There is no public exploit identified at time of analysis and EPSS is negligible (0.15%, 5th percentile), consistent with a hardware- and pre-release-specific defect rather than a broadly exploitable flaw.
Remote root access in Gardyn Home Kit Firmware via SSH private key compromise allows authenticated remote attackers with high privileges to execute arbitrary commands as root on affected devices. The vulnerability stems from improper cryptographic key management (CWE-321) and carries a CVSS score of 6.6; no public exploit code or active exploitation has been independently confirmed at the time of analysis.
Server-Side Request Forgery in Apwide Golive 10.2.0 for Jira allows an attacker to abuse the plugin's test webhook function to induce the server to issue HTTP requests to arbitrary internal or external hosts. The vulnerability carries a scope-changed CVSS vector (S:C), meaning requests escape the plugin's trust boundary and can reach internal network resources invisible to the attacker. With an EPSS of 0.29% (20th percentile) and no active exploitation confirmed in CISA KEV, real-world risk is currently low, but the SSRF primitive could enable internal service enumeration or SSRF-chained attacks against cloud metadata endpoints on Jira-hosting infrastructure.
HTTP denial-of-service in Kron Technologies Kron PAM (all versions before 3.7) allows a low-privileged authenticated remote attacker to exhaust server resources through unthrottled HTTP request processing. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms the attack is network-reachable at low complexity, requiring only a valid user account, with full availability impact and no scope change. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog; EPSS sits at 0.28% (52nd percentile), indicating low-to-moderate real-world exploitation probability at time of analysis.
Stored Cross-Site Scripting in Kron Technologies Kron PAM (versions before 3.7) allows a highly privileged authenticated attacker to inject persistent malicious scripts into the application that execute in the browsers of other users who view the affected content. Despite the high privilege required to plant the payload, the impact is rated High on both confidentiality and integrity - a realistic concern in Privileged Access Management platforms where session hijacking or credential harvesting against super-administrators carries severe downstream risk. No public exploit code or active exploitation has been identified at time of analysis; EPSS is low at 0.18% (40th percentile).
Path traversal in ChanCMS up to version 3.1.2 allows authenticated remote attackers to read or modify arbitrary files via the delfile function in app/extend/utils.js, with publicly available exploit code disclosed. CVSS score of 2.1 reflects low impact (integrity and availability limited to low confidentiality) and requirement for authenticated access, though the vulnerability affects a core file deletion utility. Vendor-released patch available in version 3.1.3.
SQL injection in PHPGurukul BP Monitoring Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the fromdate/todate parameters in /bwdates-report-result.php. The vulnerability requires user authentication (PR:L) but carries low confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L). Publicly available exploit code exists, though real-world exploitation remains limited by authentication requirements and modest technical impact.
Server-side request forgery in ChanCMS up to version 3.1.2 allows authenticated remote attackers to manipulate the targetUrl argument in the getArticle function (app/modules/api/service/gather.js), enabling them to make arbitrary HTTP requests from the affected server. Publicly available exploit code exists, but the CVSS score of 2.1 reflects limited confidentiality, integrity, and availability impact despite network accessibility; exploitation is restricted to authenticated users with low privileges.
SQL injection in Deer WMS 2 up to version 3.3 allows authenticated remote attackers to execute arbitrary SQL queries via the params[dataScope] parameter in the /system/role/list endpoint. The vulnerability has a critically low CVSS score of 2.1 due to limited scope and integrity impact, but exploitation is confirmed possible with publicly available proof-of-concept code. Real-world risk is minimal given the requirement for prior authentication and constrained data access impact.
SQL injection in Deer WMS 2 up to version 3.3 allows authenticated remote attackers to execute arbitrary SQL queries via the params[dataScope] parameter in the /system/dept/list endpoint. Despite a critical classification in the initial report, the CVSS 4.0 vector assigns a 2.1 score reflecting low impact across confidentiality, integrity, and availability. Publicly available exploit code exists; however, EPSS scoring at 0.07% (22nd percentile) suggests minimal real-world exploitation likelihood compared to the authorization requirement and limited information disclosure scope.
SQL injection in Deer WMS 2 versions up to 3.3 allows authenticated remote attackers to execute arbitrary SQL queries via the params[dataScope] parameter in the /system/role/export endpoint, leading to limited information disclosure. The vulnerability carries a CVSS score of 2.1 despite being classified critical in the original report, reflecting the CVSS v4.0 assessment of low confidentiality, integrity, and availability impact combined with required authentication. Publicly available exploit code exists, but real-world exploitation risk remains minimal due to the low EPSS score (0.07%, 22nd percentile) and authentication requirement.
SQL injection in Deer WMS 2 up to version 3.3 allows authenticated remote attackers to manipulate the dataScope parameter in the /system/user/list endpoint, leading to arbitrary SQL query execution with limited information disclosure impact. The CVSS v4.0 score of 2.1 reflects low severity due to required authentication and constrained impact (confidentiality, integrity, and availability all rated low), though publicly available exploit code exists and the vulnerability has been disclosed.
SQL injection in Deer WMS 2 up to version 3.3 allows authenticated remote attackers to execute arbitrary SQL queries via the dataScope parameter in the /system/user/export endpoint, potentially compromising data confidentiality. The vulnerability has a low CVSS score (2.1) due to authentication requirements and limited scope, but publicly available exploit code exists and the attack surface is network-accessible.
SQL injection in Deer WMS 2 up to version 3.3 allows authenticated remote attackers to manipulate the dataScope parameter in the /system/role/authUser/allocatedList endpoint, leading to limited information disclosure. The vulnerability requires valid user credentials and carries a low CVSS base score of 2.1 despite critical severity rating, with publicly available exploit code disclosed via Gitee issue tracker. EPSS exploitation probability is extremely low at 0.07%, indicating this is unlikely to be a widespread attack vector despite public POC availability.
SQL injection in Deer WMS 2 up to version 3.3 allows authenticated remote attackers to execute arbitrary SQL queries via the params[dataScope] argument in the /system/role/authUser/unallocatedList endpoint. The vulnerability requires valid user credentials but has low overall impact (CVSS 2.1) and affects only data confidentiality and integrity with no system availability impact. Publicly available exploit code exists, though EPSS score (0.07%, 22nd percentile) indicates exploitation remains uncommon in practice despite public disclosure.
SQL injection in code-projects Public Chat Room 1.0 via the ID parameter in send_message.php allows authenticated remote attackers to execute arbitrary SQL queries, despite a low CVSS 4.0 score of 2.1. The vulnerability requires prior authentication (PR:L) and offers only limited confidentiality impact (VC:L/VI:L/VA:L), but publicly available exploit code exists and the attack vector is network-accessible with low complexity, making it suitable for low-friction post-compromise lateral movement or information disclosure within authenticated environments.
SQL injection in code-projects Food Review System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the occasion parameter in /admin/approve_reservation.php, resulting in limited data confidentiality and integrity impact. Despite a critical classification in the source database, the CVSS 4.0 score of 2.1 reflects the requirement for authenticated access (PR:L) and limited technical impact scope. Publicly available exploit code exists and the vulnerability has been publicly disclosed.
SQL injection in itsourcecode Insurance Management System 1.0 allows authenticated remote attackers to manipulate the agent_id parameter in /updateAgent.php, enabling unauthorized database queries with limited confidentiality and integrity impact. Despite critical classification in metadata, the CVSS 4.0 vector shows low severity (2.1 score) due to requirement for prior authentication and restricted scope. Public exploit code is available, though EPSS score of 0.06% (20th percentile) suggests minimal real-world exploitation likelihood.
SQL injection in PHPGurukul User Registration & Login and User Management System 3.3 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/lastthirtyays-reg-users.php. Exploitation requires valid user credentials but no user interaction. Publicly available exploit code exists, though CVSS 2.1 and EPSS 0.06% suggest low real-world exploitation risk despite the critical classification.
SQL injection in PHPGurukul User Registration & Login and User Management System 3.3 allows authenticated remote attackers to manipulate the ID parameter in /admin/lastsevendays-reg-users.php, leading to database query compromise with limited confidentiality and integrity impact. Public exploit code exists, though EPSS scoring (0.06%, 19th percentile) indicates exploitation remains unlikely in practice despite the low attack complexity and low privilege requirement.
SQL injection in PHPGurukul Login and User Management System 3.3 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/yesterday-reg-users.php. The vulnerability has a publicly available exploit but poses limited real-world risk due to authentication requirements and low CVSS impact scores (2.1/10). Exploitation is marked probable (E:P in CVSS4.0) but the EPSS score of 0.06% suggests minimal actual exploitation despite public disclosure.
Open redirect vulnerability in KoaJS Koa up to version 3.0.0 allows authenticated remote attackers to manipulate the Referrer HTTP header via the back() function in lib/response.js, enabling redirect to arbitrary external URLs with user interaction. The vulnerability has publicly available exploit code and affects the HTTP Header Handler component; EPSS exploitation probability is very low at 0.08% despite public POC availability, suggesting this is primarily a client-side social engineering vector rather than a widely exploitable server-side flaw.
Cross-site scripting (XSS) in Church Donation System 1.0 allows authenticated remote attackers to inject arbitrary JavaScript via the fname parameter in /admin/edit_members.php, requiring user interaction to execute. The vulnerability has a publicly disclosed exploit and EPSS score of 0.05% (16th percentile), indicating low real-world exploitation probability despite public availability of proof-of-concept code.