Arbitrary file read and write in Flowise versions prior to 3.0.8 allows an authenticated attacker with access to the flow builder to read or overwrite any file the Flowise process can reach, including secrets such as /root/.flowise/encryption.key and database.sqlite in Docker deployments, or /etc/shadow and SSH private keys on bare-metal installs. The issue is rated 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-22) and publicly available exploit code exists, so the barrier is mainly the need for a valid account and the ability to add the vulnerable file tools to a flow; command execution is achievable through arbitrary file write to sensitive paths rather than being guaranteed by the traversal alone. No CISA KEV listing or confirmed in-the-wild exploitation has been reported, but default deployments that permit open self-registration are effectively wide open to this chain.
Stack-based buffer overflow in Tenda CH22 firmware (up to version 1.0.0.1) allows unauthenticated remote attackers to potentially execute arbitrary code by sending a crafted HTTP request to the /goform/AdvSetWrlsafeset endpoint with a malicious mit_ssid_index parameter. Publicly available exploit code exists, and the EPSS score is 6.71% (94th percentile), indicating elevated risk for exposed devices. Exploitation requires network access to the router's management interface, which is typically LAN-facing; Internet-based attacks depend on remote management being enabled or an attacker already on the local network.
Unauthenticated file upload in the melis-cms-slider module of Melis Technology's Melis Platform lets remote attackers push a dangerous file through the 'mcsdetail_img' parameter of a POST request to /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm and, if that file is written into a web-accessible, script-executable directory, obtain remote code execution with the web server's privileges. Both the published CVSS v4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H, SC/SI/SA:N) and the independent CVSS v3.1 assessment agree on network reachability, low attack complexity, no required privileges and no user interaction; because the affected route sits inside the CMS back-office, however, some deployments may in practice still require a valid authenticated session, a point that should be confirmed with the vendor or coordinator. Publicly available exploit code exists (a GitHub proof-of-concept) and EPSS is 2.66% (roughly the 85th percentile), but the CVE does not appear in CISA KEV, so active exploitation is not confirmed by the available intelligence.
Unauthenticated SQL injection in the melis-cms module of Melis Platform lets remote attackers execute arbitrary SQL through the 'idPage' parameter of the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint, enabling full read, creation, update, and deletion of database contents. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, requires no authentication and no user interaction against any reachable Melis instance; publicly available exploit code exists (a dedicated GitHub proof-of-concept), and the vendor/coordinator advisory is published by INCIBE. EPSS is 0.41% (33rd percentile), indicating limited observed exploitation activity, and the flaw is not listed in CISA KEV, so it is not confirmed as actively exploited. Overall risk is high for exposed deployments because database confidentiality, integrity, and availability are all fully compromised, though the practical exposure is bounded by the product's small install base and by whether the administrative endpoint is reachable from untrusted networks.
Unauthenticated attackers can create a fully privileged administrator account on Melis Platform by sending a request to the melis-core endpoint /melis/MelisCore/ToolUser/addNewUser, because that controller action performs no authorization check (CWE-862 Missing Authorization). The issue affects network-reachable Melis Platform instances running an unpatched melis-core module; no credentials, special feature flags, or user interaction are required (CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, assessed 9.8; vendor/NVD scoring raises it to 9.3 under CVSS v4.0). Publicly available exploit code exists (a GitHub PoC), so weaponization is trivial, although EPSS currently rates near-term exploitation likelihood low at 0.33% (24th percentile) and there is no KEV entry confirming active exploitation. Successful exploitation yields complete compromise of the platform's confidentiality, integrity, and availability through the attacker-controlled admin account.
Memory corruption in Tenda CH22 firmware 1.0.0.1 allows unauthenticated remote attackers to compromise the device via a crafted request to the /goform/SafeEmailFilter endpoint. Public exploit code exists, but no active exploitation has been confirmed (not in CISA KEV). The CVSS 4.0 base score is 8.9, reflecting high impact to confidentiality, integrity, and availability; EPSS is 0.86% (low likelihood).
Command injection on Windows in the Deno JavaScript/TypeScript runtime (versions prior to 2.5.3 and 2.2.15) allows attacker-supplied arguments to be interpreted as shell commands when a program spawns a .bat or .cmd file as a child process. The weakness is unauthenticated from a network vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) and scores 8.1, but exploitation is conditional: it requires a Windows host, a Deno program that launches a batch file via Deno.Command or node:child_process, attacker-controlled data flowing into that process's arguments, and the 'run' permission having been granted. Publicly available exploit code exists, including a proof of concept in the GitHub security advisory that spawns calc.exe via an '&' metacharacter, and EPSS sits at 2.08% (81st percentile); there is no confirmed active exploitation (not in CISA KEV).
A buffer overflow in the TOTOLINK N600R router's HTTP management interface allows authenticated remote attackers to execute arbitrary code by sending an overlong 'wepkey' parameter to the setWiFiBasicConfig function. Publicly available exploit code exists, and the EPSS score is low (1.04%, 63rd percentile), suggesting limited exploitation activity. Affected devices run firmware up to 4.3.0cu.7866_B20220506, and no vendor patch has been identified; mitigation relies on restricting management interface access and changing default credentials.
Unauthenticated fastjson deserialization in WukongCRM 9.0 (Java edition) via the /OaExamine/setOaExamine HTTP endpoint allows remote attackers to supply attacker-controlled class references that the Alibaba fastjson library instantiates at runtime, enabling arbitrary Java gadget-chain execution. A public proof-of-concept is available on GitHub, lowering the exploitation bar considerably. While the assigned CVSS scores impact conservatively at I:L/A:L with no confidentiality loss, this is inconsistent with the well-documented RCE potential of fastjson deserialization gadget chains - the actual impact may be understated. No public exploit has been confirmed as actively exploited (not in CISA KEV).
SQL injection in the WordPress plugin Community Events (versions up to and including 1.5.1) lets an attacker inject SQL through the event_category parameter and extract sensitive data from the site's database. The vendor/NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, 9.8) implies an unauthenticated attacker, but CISA/analyst review and the Wordfence description both require an authenticated account with Subscriber-level access or above, so the practical prerequisite is a low-privilege login - trivially obtainable only where self-registration is enabled - with impact constrained by wpdb's typical blocking of stacked queries to UNION-style read-only data extraction. There is no public exploit code identified and no evidence of active exploitation (not in CISA KEV), and EPSS is low at 0.39% (31st percentile), so this should be prioritized by exposure (open registration plus outdated plugin) rather than by mass-exploitation signals.
Unauthenticated SQL injection in code-projects Web-Based Inventory and POS System 1.0 allows remote attackers to manipulate the emailid parameter on login.php, potentially leading to data theft, authentication bypass, or database corruption. Public exploit code is available, but EPSS indicates a low probability of exploitation (0.03%). No vendor patch has been identified.
SQL injection in PHPGurukul Beauty Parlour Management System 1.1 allows remote unauthenticated attackers to manipulate database queries via the searchdata parameter in /admin/search-invoices.php. Public exploit code is available, but EPSS score is very low (0.03%) and no active exploitation has been confirmed by CISA KEV. The vulnerability can lead to partial data exposure or modification.
SQL injection in Beauty Parlour Management System 1.1 via admin search-appointment.php allows remote attackers to extract or modify database contents. The vulnerability has a publicly available exploit but is not listed in CISA's Known Exploited Vulnerabilities catalog, and
SQL injection in Campcodes Advanced Online Voting System 1.0 exposes the admin login endpoint (/admin/login.php) to unauthenticated remote exploitation via a malicious Username parameter. A publicly available proof-of-concept exploit exists, lowering the barrier to exploitation significantly despite a low EPSS score. Successful exploitation can enable authentication bypass or arbitrary data extraction from the backend database, effectively compromising the integrity of the voting system's administrative interface.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to inject malicious SQL via the order_id parameter of /pages/edit_order_details.php. Exploit code is publicly available, though real-world exploitation probability is very low (EPSS 0.03%). No authentication is required, and the impact is limited to low confidentiality, integrity, and availability impacts.
SQL injection in PHPGurukul Beauty Parlour Management System 1.1 allows remote attackers to manipulate the 'delid' parameter in /admin/new-appointment.php, enabling arbitrary SQL command execution. Exploit code is publicly available, increasing potential risk, although no active exploitation has been confirmed by CISA KEV. Affected systems may suffer unauthorized data access, modification, or deletion.
SQL injection in PHPGurukul Beauty Parlour Management System 1.1 allows unauthenticated remote attackers to access or manipulate database data via the `delid` parameter in `/admin/manage-services.php`. A public proof-of-concept exploit is available, though EPSS indicates low exploitation likelihood (0.03%).
SQL injection in Simple E-Commerce Bookstore 1.0 allows remote attackers to inject SQL via the register_username parameter during user registration, potentially exposing or altering database contents. Exploit code is publicly available, but EPSS indicates a low 0.03% exploitation probability, and no active exploitation is reported.
SQL injection vulnerability in SourceCodester Wedding Reservation Management System 1.0 allows remote attackers to inject malicious SQL via the 'number' parameter in the insertReservation function of function.php, potentially compromising database confidentiality and integrity. Exploit code is publicly available, and the vulnerability has a CVSS 4.0 base score of 5.5 (Medium) with a low EPSS exploitation probability of 0.03%, indicating limited real-world risk while still enabling data theft or tampering.
SQL injection in the Wedding Reservation Management System 1.0 allows remote attackers to manipulate the 'User' parameter in /global.php to execute arbitrary SQL queries. A public proof-of-concept exploit exists, but no active exploitation has been confirmed in the wild. The low EPSS score (0.03%) suggests limited real-world exploitation likelihood despite the publicly available exploit.
SQL injection in Simple E-Commerce Bookstore 1.0 allows remote attackers to execute arbitrary SQL via the login_username parameter in /index.php. The vulnerability permits unauthorized access to the database, potentially leading to data exposure or authentication bypass. Public exploit code is available, but no active exploitation or vendor patch has been confirmed.
SQL injection in Advanced Library Management System 1.0 via the user_id parameter in view_member.php allows remote unauthenticated attackers to manipulate database queries, potentially reading, modifying, or deleting data. Exploit code is publicly available, but EPSS indicates very low exploitation likelihood and no active attacks have been reported.
Remote SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows attackers to manipulate database queries via the currsymbol parameter in /edit_curr.php. Exploit code is publicly available, but no active exploitation has been confirmed, and EPSS indicates a low exploitation probability (0.03%).
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter of /edit_room.php, leading to unauthorized database access or modification. A proof-of-concept exploit is publicly available, though active exploitation is not confirmed. The vulnerability affects the default installation without any special configuration changes.
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /edit_customer.php endpoint. Exploit code is publicly available, though EPSS suggests low exploitation probability (0.03%). The vulnerability can lead to unauthorized data modification or exfiltration with low impact on confidentiality, integrity, and availability.
SQL injection in the login page of Student Transcript Processing System 1.0 allows unauthenticated remote attackers to inject arbitrary SQL commands via the 'uname' parameter. A publicly available proof-of-concept exploit exists, but no evidence of active exploitation or inclusion in CISA KEV has been reported. EPSS predicts a very low exploitation probability (0.03%).
SQL injection in itsourcecode Leave Management System 1.0 allows remote attackers to manipulate database queries via the employid parameter in /reset.php. A public proof-of-concept exploit exists, but the EPSS exploitation probability is very low (0.03%), suggesting limited real‑world exploitation despite ease of attack. No active exploitation (CISA KEV) has been reported, and the vendor has not issued a patch.
SQL injection in SourceCodester Simple E-Commerce Bookstore 1.0 allows remote attackers to manipulate the 'remove' parameter in /cart.php to execute arbitrary SQL commands. A publicly available proof-of-concept exploit exists, but the EPSS exploitation probability is very low (0.03%), indicating minimal real-world exploitation risk despite the remote attack vector. No active exploitation in the wild has been confirmed (CISA KEV not listed).
Unauthenticated operating system command injection in Framelink Figma MCP Server (published as GLips/Figma-Context-MCP) versions before 0.6.3 lets a remote attacker who can reach the server's HTTP transport run arbitrary OS commands with the privileges of the MCP process. A crafted HTTP POST carrying shell metacharacters reaches an input path that is passed unsanitized into the fetchWithRetry curl invocation, so the injected command executes on the host. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects an unauthenticated, network-reachable, high-impact flaw, and while EPSS is elevated at 5.83% (93rd percentile), no public exploit has been identified at time of analysis and there is no CISA KEV listing.
OS command injection in the Curo UC300 (firmware 5.42.1.7.1.63R1) unified communications device lets an authenticated attacker with admin-panel access run arbitrary operating-system commands by injecting shell metacharacters into the "IP Addr" parameter. Successful exploitation yields full command execution on the underlying device (high confidentiality, integrity, and availability impact). A public GitHub repository referenced by NVD indicates publicly available exploit code exists, though the flaw is not listed in CISA KEV and its EPSS probability is modest (1.15%, 63rd percentile).
Local privilege escalation in MongoDB Connector for BI 2.0.0 through 2.14.24 on Windows allows an authenticated low-privileged user to obtain elevated privileges when the product was installed via the MSI package into a custom (non-default) directory. The installer fails to set restrictive ACLs on that custom directory, so a non-privileged local user who can write to it can plant or modify files that a privileged process subsequently executes (CWE-276, Incorrect Default Permissions); exploitation is local, requires an existing foothold on the host, and only matters for custom-path installations, as default install locations are reportedly unaffected. No public exploit code has been identified at time of analysis and exploitation has not been confirmed in the wild; EPSS is very low at roughly 0.12 percent (2nd percentile), and MongoDB addressed the issue in the 2.14.25 release.
Server-side request forgery in the Remote Browser Plugin of Sonatype Nexus Repository 2.x up to and including 2.15.2 allows unauthenticated remote attackers to exfiltrate stored proxy repository credentials via crafted HTTP requests. Exploitation requires the Remote Browser Plugin to be enabled and the instance to have stored proxy repository credentials; Nexus Repository 3.x is not affected. No public exploit identified at time of analysis, and this is a genuinely high-risk issue that warrants prompt attention on affected instances.
Cleartext transmission in the proprietary DNET protocol used by CGM MEDICO allows an attacker who already has intranet access to passively eavesdrop on and manipulate clinical data, because encryption for DNET connections is optional and unprotected sessions are established without it. The issue is a missing-encryption flaw (CWE-311) affecting the protocol layer rather than a remotely exploitable service bug: no authentication or user interaction is required to capture traffic once the attacker is on the same network and can take a man-in-the-middle position. Exploitation is rated through an adjacent-network vector (AV:A) with high confidentiality impact, no public exploit code has been identified and the CVE is not in CISA KEV, and EPSS is very low (0.12%, 2nd percentile), indicating limited observed exploitation activity to date.
Authenticated arbitrary file deletion in the Motors - Car Dealership & Classified Listings plugin for WordPress (all versions up to and including 1.4.89) lets any Subscriber-level user delete files anywhere on the server through the plugin's profile-picture deletion routine. Because the attacker controls the path passed to the delete operation without validation, removing a critical file such as wp-config.php can drop the site into a reinstall/configuration state and readily pave the way to remote code execution. Exploitation requires only a low-privilege account (CVSS 3.1 vector PR:L, score 8.1) - trivial on sites with open registration - and no victim interaction. At time of analysis there is no public exploit identified and the issue is not in CISA KEV; EPSS is low at 0.49% (40th percentile), so this is a credible, actionable priority for exposed sites rather than a mass-exploitation emergency.
Authenticated SQL injection in the Find Me On WordPress plugin through 2.0.9.1 allows any subscriber-level user or higher to inject SQL via an unsanitized parameter and read sensitive database contents. Exploitation requires an existing WordPress account (subscriber or above), making it practical mainly on sites with open registration or pre-existing low-privilege accounts; there is no public exploit identified at time of analysis, no KEV entry, and a low EPSS score (0.27%, 17th percentile). The independent assessment rates this as moderate risk with high confidentiality impact only, and no user interaction or special plugin configuration is required.
Deno 2.x runtimes prior to 2.5.3 and 2.2.15 fail to apply the write-permission check to Deno.FsFile.prototype.utime() and utimeSync(), so a script running with read-only file access under --deny-write=./ can still change a file's access (atime) and modification (mtime) timestamps. The attacker must already be executing JavaScript/TypeScript inside the Deno sandbox with read permission on the target file and must open it as a read-only file handle; no remote or unauthenticated path exists, and impact is limited to metadata (timestamps) with no content write, read, or deletion. Publicly available proof-of-concept code is included in the GitHub security advisory, but EPSS is very low (0.20%, 9th percentile) and there is no confirmed active exploitation (CISA KEV); this is a low-severity, local sandbox-hardening issue.
File-metadata disclosure in the Deno runtime allows code running under the permission model to retrieve stats for files it is explicitly denied read access to: Deno.FsFile.prototype.stat and Deno.FsFile.prototype.statSync skip the --deny-read check when a file handle has been opened with write-only flags (read:false, write:true), leaking file type, size and timestamps even though the analogous Deno.stat/Deno.statSync correctly enforce allow-read. Affected are Deno releases before 2.5.3 on the 2.5.x line and before 2.2.15 on the 2.2.x line (local code execution with write permission, per the PR:L vector). Severity is genuinely low and the signals agree: CVSS 3.3, EPSS 0.19% (8th percentile), a publicly available proof-of-concept in the vendor advisory, and confirmed fixes shipped by the vendor in 2.5.3 and 2.2.15 - no active exploitation is indicated.
Improper authorization in Casdoor (an open-source Identity and Access Management / SSO platform) versions 2.26.0 and earlier lets a remote authenticated administrator of ANY organization escalate beyond their tenant boundary. Because the permission-verification module and the organization/application editing interface fail to enforce object-level scope, a low-trust org admin can bypass access controls simply by concatenating/manipulating URLs after login to read and modify resources belonging to other organizations. A public technical writeup/PoC gist exists; it is not listed in CISA KEV and EPSS is low (0.61%, 45th percentile), so exploitation is plausible but not confirmed in the wild. Fixed in v2.63.0.
Authenticated SQL injection in the WordPress plugin RegistrationMagic (all versions up to and including 6.0.6.2) allows a user holding administrator privileges or higher to append arbitrary SQL to the plugin's reports query, exposing sensitive rows from the site database, while a secondary unauthenticated reflected XSS is reachable through a crafted User-Agent header captured on form submission and later rendered to a victim. The vendor advisory assigns CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but our independent assessment re-scores impact as confidentiality-high, integrity-low, availability-none (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N) because the SQLi is gated behind the highest privilege tier and the XSS is bounded to a reflected form-submission context. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, with EPSS at 0.41% (33rd percentile), so the effective priority is lower than the base score suggests despite the plugin's broad install base.
OpnForm versions up to 1.9.3 fail to properly restrict excessive authentication attempts when the X-Forwarded-For HTTP header is manipulated, allowing remote attackers to bypass rate-limiting controls. An attacker can exploit this by spoofing their source IP address through header manipulation to conduct brute-force attacks against user credentials without triggering account lockout mechanisms. Publicly available exploit code exists; however, the CVSS score of 2.9 and EPSS percentile of 35% indicate low real-world exploitation likelihood despite the public POC, suggesting this requires specific application configurations or deployment contexts to be practically exploitable.
OpnForm versions up to 1.9.3 expose sensitive information through a timing-based discrepancy in the forgotten password handler endpoint (/api/password/email), allowing remote unauthenticated attackers to enumerate valid email addresses or extract partial account information with high attack complexity. The vulnerability is rooted in a Laravel framework issue (Laravel #46465) for which the vendor has taken no mitigation action. Publicly available exploit code exists, though EPSS scoring (0.04%) indicates low real-world exploitation likelihood despite theoretical exploitability.
Authenticated SQL injection in the Welcart e-Commerce plugin for WordPress (all versions up to and including 2.11.21) lets an attacker who holds an Author-level account or higher append arbitrary SQL to existing queries by supplying a crafted cookie value, allowing extraction of sensitive data from the site's database. The defect is a classic CWE-89 escaping/preparation failure (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confined to confidentiality with no integrity or availability effect and no user interaction required. Exploitation is not trivial for an anonymous visitor because at least the Author role is required, but the barrier collapses on multi-author blogs, marketplaces, or any site with open registration; EPSS is 0.28% (18th percentile) and no public exploit code or CISA KEV entry was identified at time of analysis. A vendor code fix is present in the WordPress.org Trac changeset 3374119 for the usc-e-shop plugin.
Arbitrary file deletion in the CrowdStrike Falcon sensor for Windows (versions before 7.24) requires an attacker to already have the ability to execute low-privileged code on the host. The flaw is a local logic/origin-validation error (CWE-346) that can delete files outside the attacker's normal authorization; Mac, Linux, and Legacy sensors are unaffected, and no public exploit identified at time of analysis. EPSS is 0.17% (6th percentile), consistent with a moderate-severity, defense-in-depth issue rather than an urgent priority.
Information disclosure in HAProxy Kubernetes Ingress Controller before 3.1.13 allows an authenticated attacker with Kubernetes RBAC create/update permissions on Ingress resources to obtain an ingress token secret when the non-default config-snippets feature flag is enabled. Exploitation requires two specific preconditions: the config-snippets feature flag must be active, and the attacker must already possess create/update permissions on Ingress objects. No public exploit code has been identified, and the EPSS score is 0.26% (16th percentile), indicating low likelihood of exploitation. The issue is fixed in version 3.1.13 for the open-source controller and in enterprise versions 3.0.16-ee1, 1.11.13-ee1, and 1.9.15-ee1.
Opencast Editor before 17.8 and 18.2 can execute a previously selected publish workflow when an authenticated user with write access clicks 'Save & Publish' and then chooses 'Save', potentially exposing internal media without notification. The issue is a low-severity information-disclosure risk because the actor must already have event write access, must deliberately use the editor, and must follow that specific action order; the vendor notes real-world impact is very low. Publicly available exploit code exists, but EPSS is only 0.29% and active exploitation is not confirmed by CISA KEV.
OS command injection in DesktopCommanderMCP up to version 0.2.13 allows authenticated remote attackers to execute arbitrary operating system commands via the extractBaseCommand function in src/command-manager.ts when processing absolute file paths. The vulnerability requires authentication and has limited real-world impact scope, reflected in a low CVSS score of 2.1 and EPSS of 0.15%, though publicly available exploit code exists and the vendor acknowledges the issue remains unfixed pending real-world incident reports.
OS command injection in DesktopCommanderMCP up to version 0.2.13 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the CommandManager function in src/command-manager.ts. The vulnerability has a low CVSS score (2.1) due to authentication requirement and limited scope, but publicly available exploit code exists and the low EPSS score (0.14th percentile) suggests real-world exploitation risk is minimal despite public POC availability.
OpnForm up to version 1.9.3 contains a cross-site request forgery vulnerability in an undisclosed API endpoint, though the practical exploitability is severely constrained by the vendor's mandatory use of JWT Bearer token authentication. The vulnerability requires an attacker to first obtain a valid JWT token through a separate XSS attack, which the vendor states has been mitigated in the product, making the CSRF itself a secondary concern rather than an independent attack vector. Publicly available exploit code exists, but real-world impact is minimal given the authentication and XSS mitigation barriers.
Unrestricted file upload in JhumanJ OpnForm through version 1.9.3 allows authenticated users to bypass upload restrictions via the /answer endpoint, resulting in unauthorized file storage with limited confidentiality and integrity impact. The vulnerability requires valid authentication and has a publicly available exploit with low real-world exploitation probability (EPSS 0.05%), but the combination of low CVSS (2.1), authentication requirement, and limited impact suggests this is not a critical priority despite public exploit availability.
Unrestricted file upload in projectworlds Advanced Library Management System 1.0 allows authenticated remote attackers to upload arbitrary files via the image parameter in /edit_book.php, resulting in low-impact confidentiality, integrity, and availability violations. Public exploit code is available, though EPSS exploitation probability remains very low at 0.05%, suggesting limited real-world attack incentive despite authentication requirement bypass potential.