Stored cross-site scripting (XSS) in JhumanJ OpnForm up to version 1.9.3 allows remote attackers to inject malicious scripts via the /show/submissions endpoint, affecting all users who view affected submissions. The vulnerability requires user interaction (UI:P) to trigger but carries low integrity impact (VI:L). Public exploit code exists, and a patch has been released; however, the CVSS 2.1 score and 0.05% EPSS percentile indicate limited real-world exploitation despite public disclosure.
Unrestricted file upload in Campcodes Advanced Online Voting System 1.0 allows authenticated attackers to upload arbitrary files via manipulation of the photo parameter in /admin/voters_add.php. The vulnerability requires valid login credentials (PR:L) but affects confidentiality, integrity, and availability with low severity. Publicly available exploit code exists; however, EPSS score of 0.04% indicates minimal real-world exploitation probability despite public POC availability.
Missing authorization in OpnForm up to version 1.9.3 allows authenticated remote attackers to access the /custom-domains API endpoint without proper permission checks, potentially enabling unauthorized configuration changes. The vulnerability affects unknown code handling custom domain management and is confirmed to have publicly available exploit code, though with a low CVSS score (2.1) and minimal exploitation probability (EPSS 0.04%), indicating limited real-world risk despite the authentication bypass nature.
SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the Type parameter in /uploadProduct.php, resulting in limited confidentiality, integrity, and availability impact. The vulnerability has a low CVSS score (2.1) and EPSS score (0.04%) despite public exploit availability, indicating minimal real-world exploitation risk due to the requirement for prior authentication and constrained impact scope.
SQL injection in Blood Bank And Donation Management System allows authenticated remote attackers to manipulate the fullname parameter in /donate_blood.php, potentially leading to unauthorized data access or modification. The vulnerability affects all versions up to commit dc9e0393d826fbc85fad9755b5bc12cba1919df2, with publicly available exploit code and a low EPSS score of 0.03% despite CVSS 2.1, indicating exploitation is unlikely in practice due to authentication requirements and limited technical impact.
SQL injection in E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the supp_email parameter in /pages/supplier_add.php, achieving limited information disclosure and integrity violation. The vulnerability requires login credentials (PR:L in CVSS 4.0 vector) but can be exploited over the network with low complexity. Publicly available exploit code exists, though EPSS scoring (0.03%) suggests minimal real-world exploitation despite proof-of-concept availability.
SQL injection in E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the prod_name parameter in /pages/product_add.php, leading to limited confidentiality, integrity, and availability impact. The vulnerability has low real-world risk despite public exploit availability due to low EPSS score (0.03%, 8th percentile) and requirement for prior authentication, suggesting exploitation is unlikely in typical deployments.
SQL injection in code-projects Web-Based Inventory and POS System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the shopid parameter in /transaction.php, resulting in limited data confidentiality, integrity, and availability impact. The CVSS 2.1 score reflects low severity due to authentication requirement and constrained scope, but publicly available exploit code exists and the vulnerability has been publicly disclosed.
Improper access controls in OpnForm versions up to 1.9.3 allow authenticated remote attackers to manipulate the /edit function, gaining unauthorized access to resources or functionality. The CVSS score of 2.1 reflects low severity due to authentication requirements and limited confidentiality impact, though the exploit has been publicly disclosed and an upstream patch is available. Real-world risk is minimal given the low EPSS score (0.03%, 8th percentile) despite public POC availability.
Missing authorization in OpnForm up to version 1.9.3 allows authenticated remote attackers to manipulate the /show/integrations endpoint, bypassing access controls and potentially exposing integration configurations with limited confidentiality impact. The vulnerability requires low-privilege authentication (PR:L per CVSS 4.0 vector), limiting its severity despite public exploit availability; EPSS score of 0.03% indicates minimal real-world exploitation likelihood despite POC publication.
SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the Name parameter in /buyNow.php, enabling data exfiltration or modification with limited impact. The vulnerability is exploitable via network access without elevated privileges, publicly available exploit code exists, but real-world risk remains low due to authentication requirement and constrained scope (limited confidentiality, integrity, and availability impact per CVSS4.0 scoring).
SQL injection in SourceCodester Farm Management System 1.0 allows authenticated remote attackers to manipulate the pid parameter in /myCart.php, enabling database queries with limited confidentiality and integrity impact. Public exploit code exists, though the EPSS score of 0.03% suggests minimal real-world exploitation despite the availability of proof-of-concept.
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the Name parameter in /edit_booking.php, resulting in limited confidentiality and integrity impact. The vulnerability has public exploit code available but carries exceptionally low EPSS exploitation probability (0.03%, 8th percentile), suggesting minimal real-world threat despite network accessibility and low attack complexity.
SQL injection in SourceCodester Hotel and Lodge Management System 1.0 allows authenticated remote attackers to manipulate the Contact parameter in /pages/save_customer.php, enabling data exfiltration or modification with limited scope impact. Publicly available exploit code exists and the vulnerability carries a low CVSS score (2.1) due to requirement for prior authentication and limited technical impact, though the public exploit availability increases practical exploitation risk for unpatched instances.
Unrestricted file upload in SourceCodester Hotel and Lodge Management System version 1.0 allows high-privileged authenticated attackers to upload arbitrary files via the website_image or back_login_image parameters in /manage_website.php, potentially enabling remote code execution. Publicly available exploit code exists, though the low CVSS score of 2.0 reflects the requirement for high-level administrative privileges to trigger the vulnerability.
Unrestricted file upload in code-projects Voting System 1.0 allows authenticated high-privilege administrators to upload arbitrary files via the photo parameter in /admin/voters_add.php, potentially leading to remote code execution. The vulnerability requires high-privilege credentials (PR:H) to exploit and affects only administrative functions; publicly available exploit code exists but exploitation is limited to admin-authenticated attackers with access to the administrative interface.
Reflected cross-site scripting (XSS) in itsourcecode Leave Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the ID query parameter in /module/employee/controller.php?action=reset, requiring user interaction to execute. Public exploit code is available, though the vulnerability carries low real-world risk (EPSS 0.03%, CVSS 2.0) due to authentication and user-interaction requirements limiting broad exploitation.
Stored cross-site scripting (XSS) in code-projects Voting System 1.0 allows authenticated users with low privileges to inject malicious scripts via the Firstname, Lastname, or Platform parameters in /admin/candidates_edit.php, which execute in the context of other users' browsers when the edited candidate record is viewed. The vulnerability requires user interaction (UI:P) but affects integrity of data displayed to administrators. Exploit code is publicly available on GitHub, though EPSS score of 0.03% indicates limited real-world exploitation despite published POC.
Out-of-bounds read in GNU Binutils 2.45 linker component allows local authenticated attackers to trigger memory access violations via crafted input to the _bfd_x86_elf_late_size_sections function in bfd/elfxx-x86.c. The vulnerability has publicly available exploit code and requires local access with limited privileges; real-world impact is minimal availability loss (CVSS 1.9, EPSS 0.03%) rather than confidentiality or integrity compromise.
Stored cross-site scripting (XSS) in SourceCodester Student Grades Management System 1.0 allows authenticated administrators with high privileges to inject malicious scripts via the first_name or last_name parameters in the Manage Users Page (/admin.php), which are then executed when viewed by other users. The vulnerability requires administrator authentication and user interaction (page view), limiting real-world impact despite public exploit availability. EPSS exploitation probability is extremely low (0.03%, 9th percentile), reflecting the restrictive access controls (PR:H) and user interaction requirement (UI:P) despite network-accessible delivery.
Cross-site scripting vulnerability in JhumanJ OpnForm up to version 1.9.3 allows authenticated remote attackers with high privileges to inject malicious scripts via the Form Editor component at /api/open/forms/. The vulnerability requires user interaction to trigger and is mitigated by default when users configure their own domain. Publicly available exploit code exists, though real-world risk is severely constrained by the high privilege requirement, user interaction dependency, and vendor's default mitigation posture (CVSS 1.9, EPSS 0.03%).
Stored cross-site scripting in projectworlds Advanced Library Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the firstname parameter in /edit_admin.php, affecting other users who view admin profiles. Exploitation requires high-privilege authentication and user interaction (UI:P), limiting real-world impact despite network accessibility. Public exploit code exists and EPSS exploitation probability is minimal at 0.03%, suggesting this remains a low-priority vulnerability despite CVE assignment.
Heap-based buffer overflow in GNU Binutils 2.45 linker component affects the elf_x86_64_relocate_section function, allowing authenticated local attackers to cause availability impact with low complexity exploitation. CVSS score of 1.9 reflects limited scope (availability only, no confidentiality or integrity impact), though publicly available exploit code exists and patch has been released by the upstream project.
Arbitrary file deletion in the CrowdStrike Falcon sensor for Windows (versions below 7.24) is possible when an attacker who already has the ability to execute code on the host wins a race condition in the sensor's file-handling path. The issue is local-only (AV:L, PR:L) and timing-dependent (AC:H), so it does not expose the host to a remote attacker and offers no direct path to data theft or code modification - its only rated effect is loss of availability through deleted files. CrowdStrike fixed the flaw in Falcon sensor for Windows 7.24 and above and in all Long Term Visibility (LTV) sensors; there is no public exploit code and no confirmed active exploitation at time of analysis, and the EPSS score is negligible at roughly 0.12% (2nd percentile).
Remote command injection in D-Link DIR-852 routers allows unauthenticated attackers to execute arbitrary shell commands via the HNAP1 web interface. A public exploit is available, and the product is end-of-life with no vendor patches planned. The EPSS score of 0.34% indicates low probability of widespread exploitation, but exposed devices remain at immediate risk.
Unauthenticated attackers can invoke administrative functions in the Chartify (chart-builder) WordPress plugin through version 3.5.9 because the plugin registers an AJAX action that maps a request-supplied value to admin-class method names without any nonce or capability check. Any site running an affected version with the plugin active and reachable is exposed via wp-admin/admin-ajax.php, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicating no authentication or user interaction is required and the demonstrated impact is limited to integrity. Public exploit code has not been identified and the issue is not in CISA KEV; EPSS is a low 0.41% (33rd percentile), making this a genuine but moderate-priority issue that depends on an attacker enumerating callable administrative method names.
Stored cross-site scripting in Liferay DXP and Liferay Portal Forms allows remote attackers to inject arbitrary web script or HTML via a crafted payload in a rich-text-type form field, which executes in a victim's browser when the submission is viewed. Affected versions include Liferay Portal 7.3.2 through 7.4.3.111 and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35. No public exploit code has been identified at the time of analysis, and the EPSS score is 0.24% (14th percentile), indicating low predicted exploitation activity.
Stored cross-site scripting in Opencast Paella Player 7 lets authenticated users with media write access inject HTML and JavaScript through event or series metadata, which then executes in the browsers of viewers who open the prepared media. Opencast 17.x before 17.8 and 18.x before 18.2 are affected; exploitation requires a writer account plus a victim viewing the player, and the assessed vector is CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS is low at 0.21% (11th percentile), no public exploit was identified at time of analysis, and CISA KEV does not list this issue.
Symlink following in DesktopCommanderMCP up to version 0.2.13 allows local authenticated attackers to read files outside intended directory boundaries through the isPathAllowed function in filesystem.ts. The vulnerability requires local access and authenticated user privileges, with high attack complexity and low exploitability difficulty despite public availability of proof-of-concept code. This affects only unsupported product versions and carries minimal real-world risk (CVSS 1.1, EPSS 0.02%), though the vendor acknowledges the issue as a guardrail limitation rather than a hardened security boundary.
Stored cross-site scripting in OPEXUS FOIAXpress before 11.13.3.0 lets an authenticated administrative user upload an SVG logo containing embedded JavaScript or other active content, which is then rendered and executed in the browsers of other users who visit affected pages. A successful attack allows the malicious administrator to act on behalf of those victims - including stealing session cookies, credentials, or other sensitive data - but it requires high administrative privileges (PR:H) to reach the upload function and depends on victims actually loading the branded pages. No public exploit code or confirmed active exploitation has been identified, and EPSS rates the likelihood of exploitation very low at 0.24% (14th percentile); only unpatched deployments below 11.13.3.0 are affected.
Stored cross-site scripting in OPEXUS FOIAXpress before 11.13.3.0 allows an authenticated administrative user to place JavaScript or other active content into the Technical Support Hyperlink Manager, which then executes in another user's browser when that user clicks the crafted link. The issue requires two conditions: the attacker must already have administrative privileges, and a separate victim must interact with the malicious hyperlink, so the assessed risk is low-to-moderate rather than a broadly exploitable remote compromise. No public exploit was identified at time of analysis, and EPSS is 0.24% (14th percentile).
Stored cross-site scripting in OPEXUS FOIAXpress before 11.13.3.0 allows an authenticated administrative user to inject JavaScript or other content via the Annual Report Enterprise Banner image upload field, which then executes in the context of other users when they generate an Annual Report. Successful exploitation can let the attacker perform actions on behalf of the victim, including stealing session cookies, credentials, or sensitive data. Exploitation requires a high-privileged admin account to plant the payload and a separate victim user to trigger report generation; no public exploit code exists and EPSS is 0.24% (14th percentile), making this a low-to-moderate priority issue that is realistically an insider-abuse or post-admin-compromise scenario.
Stored cross-site scripting (CWE-79) in OPEXUS FOIAXpress before 11.13.3.0 lets an actor who already holds administrative access inject JavaScript or other markup into the Annual Report Template, which is then rendered and executed in the browser context of other users when they generate an Annual Report. Successful exploitation lets the administrative attacker act as the victim - stealing session cookies, credentials, or other sensitive data the victim can access - but the CVSS 4.0 vector (PR:H, UI:P) makes clear this requires high privilege on the attacker's side plus a separate, deliberate victim action, so it is not a self-triggering or remotely unauthenticated flaw. The EPSS score of 0.24% (14th percentile) and the absence of any public exploit code indicate low real-world likelihood of exploitation at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported.
Stored cross-site scripting in the Liferay Commerce diagram-type product feature lets a user who can author or edit Commerce products upload a crafted SVG that carries script, which then executes in the browser of anyone who views the affected diagram or product page. Exploitation requires an authenticated account with Commerce content-authoring permissions (PR:L) plus victim interaction (UI:R), and the impact is scoped to the victim's browser session (limited confidentiality and integrity, no availability impact). Risk is genuinely medium/low priority: the Commerce module with diagram-type products must be deployed, EPSS is only 0.22% (12th percentile), and no public exploit code was identified at time of analysis.
Stored cross-site scripting in the Liferay Commerce Product Comparison Table widget affects Liferay Portal 7.4.0 through 7.4.3.111 and Liferay DXP 7.4 GA through update 92, 2023.Q3.1 through 2023.Q3.8, and 2023.Q4.0 through 2023.Q4.5, letting an authenticated user who can create or edit Commerce Products inject arbitrary web script or HTML into a product's Name field so it executes in the browser of a victim who views the comparison table containing that product. Exploitation requires the Commerce module and this specific widget to be deployed, an attacker account with catalog-edit rights (PR:L), and victim interaction (UI:A/R); no public exploit identified at time of analysis and EPSS is 0.22% (12th percentile), making this a low-to-moderate priority stored XSS rather than a critical issue.
Stored cross-site scripting in the Notifications widget of Liferay Portal 7.4.3.102 through 7.4.3.111 and Liferay DXP 2023.Q3/2023.Q4 allows an authenticated low-privileged user to inject script into profile name fields or content-flagging inputs, which then executes when a moderator or administrator views the notification. Exploitation depends on a valid account and victim interaction; EPSS is low at 0.21%, and no public exploit was identified at time of analysis.
Information disclosure in Bitdefender Total Security allows an unauthenticated local attacker with a triggering action by the victim to access Sync account data, including account credentials and email-protection information. Exploitation requires local access, a high-complexity precondition outside the attacker’s control, and legitimate user interaction, so real-world risk is lower than the high confidentiality impact alone suggests; no public exploit identified at time of analysis and EPSS is very low (0.14%, 3rd percentile).
Authorization bypass in Dell PowerScale OneFS versions prior to 9.12.0.0 allows a high-privileged local attacker to bypass access controls and gain unauthorized access to NFSv4 or SMB shares, resulting in high confidentiality impact. The vulnerability requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) and is assessed as low-to-moderate risk due to the low EPSS score (0.13%) and no public exploit or active exploitation identified.
Improper authorization enforcement in Tenable Security Center versions prior to 6.7.0 allows an authenticated user with a limited, low-privilege account to reach data and functionality outside their assigned authorization scope. The flaw carries a vendor-assigned CVSS of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and an independent assessment raises the confidentiality impact to low (C:L), landing at the same low-to-moderate severity tier; exploitation requires a valid existing session, network reachability to the application, and no user interaction. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, and EPSS is negligible at 0.19% (8th percentile), so the practical risk is limited and driven primarily by exposure of the login surface to untrusted users.
Code injection in the ClineProvider prompt handler of Kilo Code up to version 4.86.0 allows remote attackers with user interaction to manipulate input prompts and inject arbitrary code. The vulnerability affects the prompt processing component through insufficient input validation in src/core/webview/ClineProvider.ts. Public exploit code is available, and a patch has been released by the vendor, though the low CVSS score (2.1) and minimal EPSS percentile (12%) suggest limited real-world exploitation risk despite public availability.
Information disclosure in Gemini iOS occurs when the app's conversation-sharing feature creates a public link that includes the entire chat history instead of only the snippet the user selected. The issue affects users of the Google Gemini iOS client and requires the authenticated account owner to voluntarily initiate sharing and distribute the resulting link; realized exposure then depends on that public link reaching an unintended recipient through forwarding, indexing, or guessing. No public exploit code was identified and EPSS is 0.12% (2nd percentile), so this is a low-priority privacy weakness rather than an actively exploited remote compromise.