Stored Cross-Site Scripting in code-projects Simple Scheduling System 1.0 allows an attacker to inject arbitrary JavaScript via the Subject Description field, which executes in victims' browsers when they view the affected page. The scope change in the CVSS vector (S:C) confirms the script runs in a different security context than where the payload is injected, enabling session hijacking, credential theft, or malicious redirects against users of the application. A publicly available proof-of-concept exploit exists, though exploitation probability remains low (EPSS 0.22%) and no confirmed active exploitation is recorded.
Stored cross-site scripting in code-projects Client Details System 1.0 allows an attacker who can submit customer records to persist malicious JavaScript in the username field, which then executes in the browser of any user who subsequently views that record. The CVSS scope change (S:C) indicates the payload crosses from the application's trust boundary into a victim's browser session, enabling session hijacking or credential theft against administrative users. A publicly available proof-of-concept exists, though no CISA KEV listing has been issued and the EPSS score of 0.22% (12th percentile) reflects low observed exploitation activity.
Unauthenticated attackers bypass authentication and gain complete account access, including administrator privileges, in Search & Go - Directory WordPress Theme versions ≤2.7 when Facebook login functionality is enabled. Exploitation requires no user interaction and no authentication. The vulnerability stems from insufficient user validation in the search_and_go_elated_check_facebook_user() function, allowing arbitrary account takeover. No public exploit identified at time of analysis. This issue is remotely exploitable over the network with low attack complexity.
Denial-of-service in Tenda W12 router firmware 3.0.0.6(3948) via a null pointer dereference in the `wifiScheduledSet` HTTP request handler. A remote attacker with low-privilege credentials can trigger the flaw to disrupt router availability. Public exploit code exists, but active exploitation has not been confirmed (CISA KEV absent) and the EPSS score (0.09%) suggests a low probability of widespread exploitation.
Authentication bypass in ChurchCRM up to version 5.18.0 allows unauthenticated remote attackers to access API endpoints due to a missing authentication check in the AuthMiddleware component. The publicly available exploit permits trivial remote access to sensitive member data, and a patch has been committed. While EPSS indicates low exploitation probability (0.11%) and no active exploitation is confirmed, the vulnerability presents a moderate risk for exposed ChurchCRM instances.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to manipulate the supp_id parameter in /pages/supplier_update.php, potentially reading, modifying, or deleting database data. Exploit code is publicly available, but no active exploitation has been reported and EPSS indicates low exploitation probability (0.04%).
SQL injection in projectworlds Gate Pass Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the fullname parameter in /add-pass.php. Exploit code is publicly available; no active exploitation has been confirmed (not in CISA KEV). EPSS indicates a very low probability of widespread exploitation (0.03%), likely due to the product's limited deployment.
SQL injection in code-projects E-Commerce Website 1.0 allows remote attackers to manipulate database queries via the Search parameter in /pages/user_index_search.php. Exploit code is publicly available, but no active
SQL injection in Simple Leave Manager 1.0’s /user.php via the ‘table’ parameter allows remote unauthenticated attackers to read, insert, or modify database content. Exploit code is publicly available but no active exploitation in the wild has been confirmed; EPSS score indicates very low exploitation probability.
SQL injection in Campcodes Online Learning Management System 1.0 allows remote unauthenticated attackers to manipulate database queries via the date_start parameter in /admin/calendar_of_events.php. Publicly available exploit code exists, increasing risk, though the EPSS score is low (0.03%) suggesting limited active exploitation. No patch has been identified at time of analysis.
Remote code execution in Newforma Project Center Server (NPCS) 2024.3 allows unauthenticated attackers to execute arbitrary code with NT AUTHORITY\NetworkService privileges by sending malicious serialized .NET data to the '/ProjectCenter.rem' endpoint on TCP port 9003. The vulnerability stems from insecure deserialization of untrusted data on a network-exposed endpoint. While vendor architecture recommends internal-only deployment, the service accepts network connections without authentication (CVSS AV:N/PR:N), creating critical risk for organizations with exposed instances. CWE-306 (Missing Authentication) confirms the root cause as lack of authentication controls on a sensitive endpoint.
A privilege escalation vulnerability exists in the integration between Active Directory and the System Security Services Daemon (SSSD) on Linux systems, where an attacker with permissions to modify AD attributes can impersonate privileged users by exploiting a fallback mechanism in the Kerberos authentication plugin. The vulnerability affects domain-joined Linux hosts running SSSD in default configurations and allows attackers to gain unauthorized access with high privileges. With a low EPSS score of 0.05% and no KEV listing, this appears to be a theoretical risk requiring existing AD permissions rather than an actively exploited vulnerability.
Denial of wireless scanning in the Linux kernel's mac80211 subsystem occurs on Sub-1GHz (S1G / 802.11ah) hardware because the S1G capability element is not counted in scan_ies_len, causing a buffer-length validation failure in ieee80211_prep_hw_scan() and a triggered WARN in __ieee80211_start_scan(). Affected builds are Linux 6.17 release candidates (rc1-rc4); the result is that hardware scanning stops functioning on S1G-capable adapters. There is no public exploit identified at time of analysis, EPSS is very low (0.14%), and the upstream fix is available via kernel.org stable commits.
Local privilege escalation and kernel memory disclosure in the Linux kernel's GPIO ACPI subsystem (gpiolib) affects development builds 6.17-rc1 through 6.17-rc6, where an uninitialized acpi_gpio_info structure is passed to __acpi_find_gpio() and its stale info->quirks field is later consumed in acpi_populate_gpio_lookup(). The regression, introduced by commit 7c010d463372, breaks the i2c_hid_acpi driver (probe fails with -EINVAL / 'has not been provided an Int IRQ') and causes the kernel to act on uninitialized stack memory. No public exploit identified at time of analysis, and EPSS is low at 0.14% (4th percentile), consistent with a hard-to-weaponize local memory-safety regression confined to release candidates.
Local privilege-boundary corruption in the Linux kernel's io_uring zero-copy notification path (io_link_skb) affects the 6.17 release-candidate series (rc1 through rc6). A copy-paste style bug assigned prev_notif from the current 'nd' instead of 'prev_nd', so the context-validation check compares a notification against itself and never enforces the intended same-context constraint, allowing a local low-privileged user to link skb notifications across mismatched io_uring contexts with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).
Kernel-level memory corruption in the Linux kernel's rxrpc/RxGK subsystem allows an out-of-bounds access when the rxgk_yfs_decode_ticket() function parses an authentication response packet. The flaw stems from an unchecked unsigned subtraction ('ticket_len - 10 * 4') on attacker-influenced length data, which can underflow and drive an out-of-bounds write (CWE-787). It affects Linux 6.17 release-candidate kernels (rc1 through rc6); there is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.13% (3rd percentile).
A local privilege-boundary/state-handling flaw in the Linux kernel's TCP stack lets an unprivileged user leave a stale TCP Fast Open request socket (fastopen_rsk) attached to a socket after tcp_disconnect(), which the retransmit timer later dereferences. By abusing accept() → connect(AF_UNSPEC) → connect() on a server-side TFO socket before the 3-way handshake completes, an attacker drives the socket into TCP_ESTABLISHED while retaining fastopen_rsk, triggering a kernel WARNING in tcp_retransmit_timer() and a failed retransmission. There is no public exploit identified at time of analysis, and the issue is not in CISA KEV; it was found by syzbot and resolved upstream by calling reqsk_fastopen_remove() in tcp_disconnect().
Command injection in Tenda AC7 firmware 15.03.06.44 via the /goform/AdvSetLanip endpoint allows authenticated remote attackers to execute arbitrary commands with low impact on confidentiality, integrity, and availability. The vulnerability requires valid login credentials (PR:L) and affects the lanIp parameter. Publicly available exploit code exists, and EPSS scoring of 0.39% indicates low real-world exploitation probability despite public POC availability.
Insecure inherited permissions in Portabilis i-Educar up to version 2.9.10 allow authenticated remote attackers to escalate privileges through the User Type Handler component in AccessLevelController.php, potentially gaining unauthorized access to protected functionality. The vulnerability requires valid login credentials (PR:L) but carries low confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L). Publicly available exploit code exists, though EPSS score of 0.06% (19th percentile) suggests limited real-world exploitation despite public disclosure.
Stored cross-site scripting (XSS) in code-projects Voting System 1.0 allows remote attackers to inject malicious scripts via the Firstname, Lastname, or Platform parameters in /admin/voters_add.php, requiring user interaction to trigger payload execution. The vulnerability has a low CVSS score (2.1) due to UI requirement, but publicly available exploit code exists and the attack requires no authentication or special configuration.
SQL injection vulnerability in Courier Management System 1.0 allows authenticated remote attackers to manipulate the Shippername parameter in /add-courier.php, enabling database queries to be executed with limited confidentiality and integrity impact. The publicly available exploit code and low CVSS score (2.1) reflect the requirement for valid authentication credentials, limiting real-world risk despite confirmed exploit availability.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /admin/category.php, with publicly available exploit code. CVSS score of 2.1 reflects limited confidentiality impact and requirement for low-privilege authentication; EPSS of 0.03% indicates very low real-world exploitation probability despite public POC availability.
SQL injection in code-projects Student Result Manager 1.0 allows authenticated remote attackers to manipulate roll, name, or GPA parameters in Database.java, resulting in limited confidentiality, integrity, and availability impact. The vulnerability requires valid login credentials and has been publicly disclosed with exploit code available, but carries very low exploitation probability (EPSS 0.03%) and minimal security impact due to restricted scope.
SQL injection in Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the state parameter in /cms/admin/state.php, enabling data exfiltration or modification with limited scope. Publicly available exploit code exists; however, the CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world exploitation risk despite the presence of proof-of-concept.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the cid parameter in /cms/users/complaint-details.php, leading to limited data exposure. The vulnerability requires valid user authentication and has a publicly available proof-of-concept, but the EPSS score of 0.03% and CVSS impact metrics (VC:L/VI:L/VA:L) indicate low real-world exploitation probability despite public availability of exploit code.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the cid parameter in /cms/users/register-complaint.php, resulting in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, though the EPSS score of 0.03% and requirement for prior authentication significantly constrain real-world exploitation risk compared to the CVSSv4 score of 2.1.
SQL injection in code-projects Online Complaint Site 1.0 allows authenticated remote attackers to manipulate the Username parameter in /cms/users/index.php and execute arbitrary SQL queries with limited impact to confidentiality, integrity, and availability. The CVSS 2.1 score and 0.03% EPSS percentile indicate low real-world risk despite public exploit availability, likely due to the authentication requirement (PR:L) and constrained impact scope.
Kernel panic in the Linux igc Ethernet driver (Intel I225/I226/I227) triggers when igc_led_setup() fails during driver probe and igc_probe() propagates that failure without calling unregister_netdev() first, causing free_netdev() to hit a BUG assertion at net/core/dev.c:12047. Systems running Linux kernel 6.17-rc1 through rc6 with Intel I225/I226/I227 NICs are affected; a local low-privileged user who can induce an LED setup allocation failure - naturally under memory pressure or deliberately via the kernel fault-injection framework - can crash the host. No public exploit exists and EPSS sits at the 5th percentile, reflecting negligible opportunistic exploitation probability.
Improper input neutralization in Palo Alto Networks PAN-OS management web interface allows authenticated high-privilege administrators to bypass system restrictions and execute arbitrary commands through command injection. The vulnerability affects PAN-OS across multiple versions (specific version ranges not independently confirmed from provided data), with a low EPSS exploitation probability (0.06%, 17th percentile) and no confirmed active exploitation or public proof-of-concept. Risk is significantly reduced when CLI access is restricted to a limited administrator group; Cloud NGFW and Prisma Access are unaffected.
Race condition in the Linux kernel's AMD IOMMU host page table subsystem (iommu/amd/pgtbl) allows a local low-privileged attacker to cause IOMMU unmap failures and trigger WARN_ON conditions, resulting in a denial of service. The flaw arises because iommu_v1_unmap_pages() calls fetch_pte() to read pgtable->root and pgtable->mode without holding the spinlock, while increase_address_space() updates those fields non-atomically under lock on another CPU, creating a window where the reader observes a torn state (new root, old mode). No active exploitation is confirmed - EPSS stands at 0.10% (1st percentile) and this CVE is not in CISA KEV - making this primarily a kernel stability and reliability concern for systems with AMD IOMMU hardware.