Arbitrary file read and write in Flowise versions prior to 3.0.8 allows an authenticated attacker with access to the flow builder to read or overwrite any file the Flowise process can reach, including secrets such as /root/.flowise/encryption.key and database.sqlite in Docker deployments, or /etc/shadow and SSH private keys on bare-metal installs. The issue is rated 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-22) and publicly available exploit code exists, so the barrier is mainly the need for a valid account and the ability to add the vulnerable file tools to a flow; command execution is achievable through arbitrary file write to sensitive paths rather than being guaranteed by the traversal alone. No CISA KEV listing or confirmed in-the-wild exploitation has been reported, but default deployments that permit open self-registration are effectively wide open to this chain.
Unauthenticated file upload in the melis-cms-slider module of Melis Technology's Melis Platform lets remote attackers push a dangerous file through the 'mcsdetail_img' parameter of a POST request to /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm and, if that file is written into a web-accessible, script-executable directory, obtain remote code execution with the web server's privileges. Both the published CVSS v4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H, SC/SI/SA:N) and the independent CVSS v3.1 assessment agree on network reachability, low attack complexity, no required privileges and no user interaction; because the affected route sits inside the CMS back-office, however, some deployments may in practice still require a valid authenticated session, a point that should be confirmed with the vendor or coordinator. Publicly available exploit code exists (a GitHub proof-of-concept) and EPSS is 2.66% (roughly the 85th percentile), but the CVE does not appear in CISA KEV, so active exploitation is not confirmed by the available intelligence.
Unauthenticated SQL injection in the melis-cms module of Melis Platform lets remote attackers execute arbitrary SQL through the 'idPage' parameter of the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint, enabling full read, creation, update, and deletion of database contents. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote, requires no authentication and no user interaction against any reachable Melis instance; publicly available exploit code exists (a dedicated GitHub proof-of-concept), and the vendor/coordinator advisory is published by INCIBE. EPSS is 0.41% (33rd percentile), indicating limited observed exploitation activity, and the flaw is not listed in CISA KEV, so it is not confirmed as actively exploited. Overall risk is high for exposed deployments because database confidentiality, integrity, and availability are all fully compromised, though the practical exposure is bounded by the product's small install base and by whether the administrative endpoint is reachable from untrusted networks.
Unauthenticated attackers can create a fully privileged administrator account on Melis Platform by sending a request to the melis-core endpoint /melis/MelisCore/ToolUser/addNewUser, because that controller action performs no authorization check (CWE-862 Missing Authorization). The issue affects network-reachable Melis Platform instances running an unpatched melis-core module; no credentials, special feature flags, or user interaction are required (CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, assessed 9.8; vendor/NVD scoring raises it to 9.3 under CVSS v4.0). Publicly available exploit code exists (a GitHub PoC), so weaponization is trivial, although EPSS currently rates near-term exploitation likelihood low at 0.33% (24th percentile) and there is no KEV entry confirming active exploitation. Successful exploitation yields complete compromise of the platform's confidentiality, integrity, and availability through the attacker-controlled admin account.
SQL injection in the WordPress plugin Community Events (versions up to and including 1.5.1) lets an attacker inject SQL through the event_category parameter and extract sensitive data from the site's database. The vendor/NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, 9.8) implies an unauthenticated attacker, but CISA/analyst review and the Wordfence description both require an authenticated account with Subscriber-level access or above, so the practical prerequisite is a low-privilege login - trivially obtainable only where self-registration is enabled - with impact constrained by wpdb's typical blocking of stacked queries to UNION-style read-only data extraction. There is no public exploit code identified and no evidence of active exploitation (not in CISA KEV), and EPSS is low at 0.39% (31st percentile), so this should be prioritized by exposure (open registration plus outdated plugin) rather than by mass-exploitation signals.