Unauthenticated arbitrary file deletion in the WooCommerce Designer Pro WordPress plugin (all versions through 1.9.26) allows remote attackers to wipe every file in a directory of their choosing on the server. Because the vulnerable 'wcdp_save_canvas_design_ajax' handler can be reached with no authentication and no user interaction (CVSS 9.8, AV:N/AC:L/PR:N/UI:N), any site running the plugin with default configuration is exposed; the practical outcomes are data loss and site unavailability, with remote code execution achievable only as a follow-on step if a critical file such as wp-config.php is destroyed and the attacker hijacks the subsequent WordPress reinstallation. No public exploit code has been identified at time of analysis, and the plugin's narrow distribution through the CodeCanyon listing and the Pricom printing-company theme keeps the exposed population small, although EPSS assigns a modest 0.81% (56th percentile) probability of exploitation in the next 30 days.
Unauthenticated arbitrary file upload in the Ovatheme Events Manager plugin for WordPress through version 1.8.5 allows remote attackers to place attacker-controlled files on the web server, with the potential for remote code execution if the uploaded file is served from a PHP-executable path. The flaw sits in the plugin's process_checkout() function, which performs no file type validation, so any anonymous visitor able to reach the event registration/checkout flow can attempt an upload - no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Risk is rated 9.8, but exposure is bounded by the plugin's niche installed base, EPSS is modest at 0.76% (54th percentile), and there is no public exploit identified at time of analysis.
Unauthenticated privilege escalation in the WP Freeio plugin for WordPress (all versions up to and including 1.2.21) allows remote attackers to register a new account with the 'administrator' role, granting full control of the affected site. The plugin's process_register() function fails to restrict which roles a self-registering user may request, so supplying a role parameter of 'administrator' during the normal public registration flow is sufficient - the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), requiring no authentication or user interaction. WP Freeio is a commercial ThemeForest item used as a freelance-marketplace theme, and because the vulnerable registration flow is the plugin's core function it is exposed by default rather than under a special configuration; EPSS is low (0.62%, ~48th percentile) and no public exploit code or CISA KEV entry was identified at time of analysis, but the trivial exploitation path makes this a genuine high-priority issue rather than a CVSS-inflated one.
SQL injection in projectworlds Online Food Ordering System 1.0 exposes the `/all-orders.php` endpoint to unauthenticated remote exploitation via the unsanitized `Status` parameter, enabling attackers to read, modify, or delete backend database contents. A proof-of-concept exploit has been publicly disclosed on GitHub, lowering the barrier for opportunistic exploitation. No vendor-released patch has been identified; the product is an academic/demo PHP application with very limited production deployment.
SQL injection in code-projects E-Commerce Website 1.0 allows remote, unauthenticated attackers to manipulate database queries via the order_id parameter in /pages/delete_order_details.php, potentially leading to data theft or modification. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed by CISA KEV, and EPSS probability is very low (0.03%).
SQL injection in SourceCodester Best Salon Management System 1.0 allows unauthenticated remote attackers to manipulate the ServiceId parameter in /panel/add_invoice.php, potentially accessing or modifying database contents. Public proof-of-concept code is available, though EPSS indicates low exploitation probability (0.03%) and no active exploitation is confirmed.
SQL injection in SourceCodester Best Salon Management System 1.0 allows remote attackers to compromise the application database via the editid parameter in /panel/edit-appointment.php. Publicly available exploit code exists, and the vulnerability can be triggered without authentication. EPSS score is 0.03%, indicating low exploitation probability despite the easy remote attack vector.
SQL injection in code-projects E-Banking System 1.0 allows unauthenticated remote attackers to manipulate database queries via the username and password parameters in the registration form. Publicly available exploit code exists, but no active exploitation has been confirmed and the EPSS score is very low (0.03%), indicating limited real-world risk despite the ease of exploit.
SQL injection in SourceCodester Online Student Result System 1.0 allows unauthenticated remote attackers to inject SQL commands via the Username field on the /login.php page. Exploit code is publicly available, but EPSS score of 0.03% (8th percentile) indicates a low likelihood of widespread exploitation, and the product is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection vulnerability in Campcodes Online Apartment Visitor Management System 1.0 allows remote unauthenticated attackers to perform low-impact database manipulation via the /forgot-password.php email parameter. Public exploit code is available, though no active exploitation has been reported (not listed in CISA KEV), and EPSS signals very low real-world exploitation
Unauthenticated sensitive information exposure in the Trinity Audio 'Text to Speech AI audio player' plugin for WordPress (all versions up to and including 5.21.0) lets anyone who can reach the site read a phpinfo() diagnostic page that the plugin drops into its own directory at install time. Because the file sits at the predictable path wp-content/plugins/trinity-audio/admin/inc/phpinfo.php and no authentication or user interaction is needed, a remote attacker can simply request it and harvest server configuration, absolute paths, loaded modules, and potentially secret-bearing environment variables. Risk is assessed as medium (CVSS 5.3, CWE-200) with an EPSS score of roughly 1.00% (62nd percentile); no public exploit code was identified at time of analysis and there is no KEV confirmation of active exploitation. The flaw is trivially exploitable against default installations but only affects sites that actually run the plugin and serve the file over HTTP.
Authorization bypass in the GSheetConnector For Gravity Forms WordPress plugin (versions ≤ 1.3.27) allows any authenticated user holding subscriber-level access or above to invoke the plugin's 'install_plugin' function, which performs no capability check, and push arbitrary plugin packages onto the target site. Successful installation of a malicious or otherwise exploitable plugin can lead to arbitrary code execution on the web server, though the vendor description qualifies this as achievable only 'under certain conditions' rather than automatically. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low (0.43%, ~35th percentile), while the CVSS v3.1 base score of 8.8 reflects high confidentiality, integrity and availability impact once the plugin-install primitive is chained to code execution.
UNISOC modem firmware can be crashed by remote attackers via improperly validated input, as described in CVE-2025-31718. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) indicates a network-reachable, low-complexity, unauthenticated flaw whose sole impact is availability, despite the 'privilege escalation' tag. No public exploit code or confirmed active exploitation has been identified, and EPSS is 1.02% (62nd percentile).
Malformed cellular signaling messages can crash the baseband/modem firmware on UNISOC-based devices, producing a remote denial of service (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) that requires neither authentication nor user interaction. The flaw is an input-validation failure in modem message handling: when the modem receives a crafted signaling message it fails to parse safely and the system crashes, with no path to code execution, privilege escalation, or data disclosure. Impact is bounded to availability, and real-world exploitation is constrained by the fact that the malicious message must reach the baseband - typically over the air, requiring radio proximity or a rogue/malicious base station. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.64% (49th percentile), indicating a low, non-urgent likelihood of exploitation in the near term.
Hard-coded cryptographic key in express-session component of code-projects Hospital Management System 1.0 allows remote attackers to bypass session security and disclose sensitive information. The vulnerability stems from use of a fixed secret parameter in the session middleware, enabling attackers to forge or predict session tokens. While a public exploit exists, the attack requires high complexity and difficult exploitation, reflected in the low CVSS 2.9 score and minimal EPSS probability (0.19%), suggesting limited real-world risk despite information disclosure impact.
Server-Side Request Forgery (SSRF) in WP Scraper WordPress plugin versions up to 5.8.1 allows authenticated administrators to make arbitrary web requests from the affected server, enabling reconnaissance of internal services, metadata theft on cloud instances, and potential information disclosure. The vulnerability exists in the wp_scraper_extract_content function and requires high-level administrative privileges to exploit, making it a post-authentication lateral movement and reconnaissance vector for compromised administrator accounts.
SQL injection in WP Links Page plugin for WordPress (all versions up to 4.9.6) allows authenticated attackers with Subscriber-level access and above to extract sensitive database information via the unescaped 'id' parameter. The vulnerability stems from insufficient input sanitization and lack of prepared statements, enabling attackers to append arbitrary SQL queries to existing database operations. CVSS 6.5 reflects the high confidentiality impact for authenticated remote exploitation with low attack complexity; no public exploit code or active exploitation has been confirmed at analysis time.
Stored cross-site scripting in the Enable Media Replace WordPress plugin affects all versions up to and including 4.1.6, allowing authenticated users with contributor-level access or above to inject arbitrary JavaScript into pages through the plugin's [file_modified] shortcode, whose attributes are insufficiently sanitized and escaped. The injected script executes when any user - including administrators - subsequently views the affected page, though exploitation requires a victim to load that page and sites that do not grant contributor access to untrusted users are not realistically exposed. No public exploit code has been identified at time of analysis, this CVE is not in CISA KEV, and the EPSS score is low at 0.24% (14th percentile), consistent with a moderate-risk authenticated issue rather than an emergency.
Stored cross-site scripting in the WP Easy Toggles plugin for WordPress (all versions up to and including 1.9.0) allows authenticated attackers holding contributor-level access or higher to inject arbitrary JavaScript through unsanitized attributes on the plugin's 'toggles' shortcode; the script persists in the page content and executes in the browser of any visitor, editor, or administrator who later views that page. The issue is a CWE-79 input-sanitization and output-escaping failure rated CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), with scope change reflecting that the injected script runs in the context of higher-privileged users. Risk is real but low-urgency: EPSS is only 0.23% (13th percentile), no public exploit code was identified at time of analysis, and exploitation is gated behind a contributor account, making open or untrusted user registration the primary amplifier.
Stored cross-site scripting in the Draft List plugin for WordPress (all versions up to and including 2.6.1) lets an authenticated attacker holding a contributor-level account or higher inject arbitrary JavaScript through the plugin's 'drafts' shortcode attributes, which is then stored and rendered to other users of the site. The impact is script execution in the browser context of any user - including administrators - who views the injected page, consistent with the assessed CVSS 3.1 profile of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), which requires contributor privileges but yields only low confidentiality and integrity impact with a scope change. Risk is moderate rather than high: EPSS is only 0.23% (13th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Colibri Page Builder (all versions through 1.0.334) allows an authenticated attacker holding a contributor-level account or higher to inject arbitrary JavaScript via unsanitized attributes of the colibri_newsletter shortcode, which then executes in the browser of any user who later views the affected page. The issue is scored CVSS 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and exploitation is gated by real prerequisites: the plugin must be installed and active at a vulnerable version and the attacker must already control a contributor+ account capable of inserting shortcodes into content, so closed-registration and single-administrator sites have minimal exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.23% (13th percentile), indicating limited real-world urgency rather than critical priority.
Stored cross-site scripting in the WordPress plugin Easy Plugin Stats (all versions up to and including 2.0.1) lets authenticated users holding contributor-level privileges or higher inject arbitrary JavaScript through the plugin's 'eps' shortcode, which is stored without sanitization or escaping and executes in the browser of any user who later views the affected page. The vulnerability requires a valid contributor-or-above account on the target site and a viewing victim, so sites that do not grant untrusted users contributor access or that disable open self-registration are materially less exposed. At time of analysis there is no public exploit identified, no CISA KEV listing, and EPSS is 0.19% (8th percentile), indicating a low probability of exploitation and a realistically low operational priority.
Stored cross-site scripting in the WordPress Live Webcam Widget & Shortcode plugin (all versions up to and including 1.2) allows an authenticated attacker holding contributor-level access or higher to inject arbitrary JavaScript through the plugin's 'webcam' shortcode attributes, which then executes in the browser of any user who later views the affected page. The 6.4 CVSS score carries a scope-change vector (S:C), reflecting that the injected script runs in the context of the broader WordPress site rather than the plugin itself. Exploitation is gated by the credential requirement and by the shortcode actually being usable in post or page content, EPSS measures only 0.19% (8th percentile), there is no CISA KEV entry indicating confirmed active exploitation, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting (XSS) in Stock History & Reports Manager for WooCommerce plugin versions up to 2.2.2 allows authenticated contributors and above to inject arbitrary JavaScript through the 'alg_wc_stock_snapshot_restocked' shortcode attributes due to insufficient input sanitization and output escaping. When an injected page is accessed, the malicious script executes in the context of all visitors' browsers, potentially compromising site users and enabling credential theft, malware distribution, or account takeover. No public exploit code or active exploitation has been confirmed at the time of analysis.
SQL injection in code-projects Client Details System 1.0 allows authenticated remote attackers to manipulate the uid parameter in /admin/update-profile.php, enabling arbitrary database queries with limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.04% and CVSS 2.1 severity indicate low real-world exploitation probability despite low barriers to attack (network-accessible, low complexity, no user interaction required).
SQL injection in code-projects E-Commerce Website 1.0 allows authenticated remote attackers to manipulate the prod_id parameter in /pages/product_add_qty.php, potentially leading to unauthorized database access or data disclosure. The vulnerability has a CVSS score of 2.1 with low impact across confidentiality, integrity, and availability, but public exploit code exists and may lower the exploitation barrier despite the requirement for prior authentication.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in /addcategory.php, compromising data confidentiality and integrity. The vulnerability has publicly available exploit code and is confirmed to have limited scope impact (affecting only data confidentiality, integrity, and availability of specific queries); however, EPSS score of 0.03% (8th percentile) suggests minimal real-world exploitation likelihood despite public availability of proof-of-concept code.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /addproduct.php. The vulnerability has low practical risk despite public exploit availability due to CVSS 2.1 scoring and minimal confidentiality/integrity impact, though it requires prior authentication. EPSS exploitation probability is extremely low at 0.03% percentile, suggesting limited real-world attack interest despite public POC availability.
SQL injection in SourceCodester Simple Inventory System 1.0 via the uemail parameter in /user.php allows authenticated remote attackers to manipulate database queries with low impact. CVSS 2.1 reflects the low severity due to authentication requirement and limited scope, but a public exploit exists and EPSS percentile of 8% indicates below-average real-world exploitation likelihood despite POC availability.
SQL injection in SourceCodester Simple Inventory System 1.0 via the editBrandName parameter in /brand.php allows authenticated remote attackers to manipulate database queries with low confidentiality, integrity, and availability impact. The CVSS 2.1 score reflects limited scope (authenticated access required, low impact to CIA triad), but publicly available exploit code exists despite minimal real-world exploitation probability (EPSS 0.03%, 8th percentile).
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the Category parameter in /editproduct.php, with publicly available exploit code demonstrating the vulnerability. Despite a low CVSS score of 2.1, the vulnerability requires valid credentials and produces limited confidentiality impact, explaining the minimal EPSS exploitation probability of 0.03%.
SQL injection in Simple Food Ordering System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the cname parameter in editcategory.php, resulting in limited confidentiality and integrity impact. Publicly available exploit code exists; however, the EPSS score of 0.03% indicates minimal real-world exploitation probability despite remote network accessibility and low attack complexity.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/actions/delete-equipment.php. The vulnerability requires valid user credentials (PR:L) and has publicly available exploit code; however, the EPSS score of 0.03% and limited impact scope (VC:L/VI:L/VA:L) indicate low real-world exploitation probability despite technical exploitability.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /admin/edit-equipmentform.php. The vulnerability requires valid user credentials (privilege level L) but no user interaction. Publicly available exploit code exists, though EPSS indicates very low real-world exploitation probability (0.03%, 8th percentile). Despite the public POC, the CVSS 2.1 score and minimal impact scope (VC:L/VI:L/VA:L with no scope change) suggest limited practical risk in most deployments.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /admin/actions/delete-member.php, enabling unauthorized database queries with limited confidentiality and integrity impact. The vulnerability requires valid administrative credentials and carries a CVSS score of 2.1 with low confidentiality and integrity impact but no availability risk. Publicly available exploit code exists, though real-world exploitation remains extremely limited based on a 0.03% EPSS score.
SQL injection in CodeAstro Gym Management System 1.0 allows authenticated remote attackers to manipulate the ename parameter in /admin/equipment-entry.php, enabling database query modification with low confidentiality, integrity, and availability impact. Publicly available exploit code exists but real-world risk is minimal due to low EPSS score (0.03%, 8th percentile), limited scope impact, and requirement for authenticated access despite the network attack vector.
SQL injection in Campcodes Online Apartment Visitor Management System 1.0 allows high-privileged remote attackers to manipulate the mobilenumber parameter in /admin-profile.php, potentially leading to unauthorized database access or modification. The vulnerability requires administrative privileges to exploit and has limited confidentiality and integrity impact; public exploit code is available but real-world exploitation risk remains low due to EPSS score of 0.03% and the administrative access prerequisite.
Missing authorization in the WordPress plugin Everest Backup (versions up to and including 2.3.5) lets unauthenticated remote attackers call the 'everest_process_status' AJAX action and obtain the file location of an in-progress backup, which can then be fetched directly. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, 5.9) reflects that no authentication or user interaction is needed but that the disclosure only occurs while a backup is actually running, making the attack a timing-window problem rather than a persistent exposure; EPSS is 0.40 percent (32nd percentile) and no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than an urgent emergency, since a successful hit requires an administrator-initiated or scheduled backup to be in progress exactly when the attacker polls the endpoint.
Improper quantity validation in the PHP-Bookstore-Website-Example cart/payment flow allows unauthenticated remote attackers to tamper with order quantities via crafted input to /index.php, altering application-level order logic. The rolling-release example application has no versioned affected or fixed releases, publicly available exploit code exists (no CISA KEV active-exploitation confirmation), and EPSS is low at 0.38% (30th percentile). Impact is limited to low integrity (order manipulation) with no confidentiality, availability, or system-level compromise.
Denial of service in Huawei HarmonyOS 5.0.1 and 5.1.0 allows a locally-present, low-privileged application to crash the device's 'office service' by supplying crafted path input that triggers a relative path-traversal condition, degrading availability of the affected service. The attack is local-only (AV:L) and requires the attacker to already hold a low-privilege authenticated context on the device (PR:L), with no user interaction needed (UI:N); there is no confidentiality or integrity impact and no code execution. Risk to most environments is limited: no public exploit identified at time of analysis, EPSS is 0.11% (1st percentile), and the issue is not listed in CISA KEV.
Denial of service in the office service of Huawei HarmonyOS 5.0.1 and 5.1.0 allows local attackers with low-level privileges to crash or degrade the service, impacting availability only. The vulnerability requires local access (AV:L) and no user interaction, with no effect on confidentiality or integrity. No public exploit code or active exploitation has been identified, and the EPSS score is 0.11% (percentile 1%).
Denial of service in the Huawei HarmonyOS office service (shipped with HarmonyOS 5.0.1 and 5.1.0) lets a locally running application with only low-level privileges crash or hang the service, affecting availability with no confidentiality or integrity impact. Exploitation is not remote: the attacker must already have code executing on the device (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5), and no user interaction is required once that foothold exists. There is no public exploit identified at time of analysis and EPSS is very low (0.11%, 1st percentile); Huawei documented the issue in its October 2025 consumer security bulletin, so this is a low-to-moderate priority hardening item rather than an emergency.
Denial of service in the office service of Huawei HarmonyOS 5.0.1 and 5.1.0 allows a local attacker with low privileges to make the service unavailable, requiring an existing on-device foothold such as a malicious low-privileged application. The vulnerability is not remotely exploitable and impacts only availability, with no effect on confidentiality or integrity. No public exploit code or active exploitation has been identified, and the EPSS score is very low (0.11%, 1st percentile), indicating minimal real-world urgency.
Huawei Gallery on HarmonyOS 5.0.1 contains an identity-authentication bypass that allows a locally present, low-privilege app to access protected Gallery data, producing high confidentiality impact with no integrity or availability impact. The flaw is locally exploitable (AV:L), requires low privileges (PR:L), and needs no user interaction (UI:N); no public exploit code has been identified at the time of analysis, and the EPSS score is very low at 0.11% (1st percentile). Huawei's October 2025 security bulletin is the available advisory, but it does not detail the exact triggering feature or provide an exact patched version.
Use-after-free in Huawei HarmonyOS 5.0.1 and 5.1.0 office service allows a locally installed low-privileged app to trigger memory corruption and potentially read confidential data from the service's memory. Exploitation requires local access and low privileges (AV:L/PR:L), with no user interaction (UI:N), and impact is limited to confidentiality (C:H/I:N/A:N) within the same security scope (S:U). No public exploit identified at time of analysis, and EPSS is low at 0.10% (1st percentile).
A use-after-free vulnerability in the storage management module of Huawei HarmonyOS 5.0.1 and 5.1.0 allows a local attacker with low privileges to cause a denial of service by crashing the affected service. Exploitation requires local access and existing low-level privileges, and no user interaction is needed. No public exploit code or active exploitation has been identified, and the EPSS score is low at 0.10% (percentile 1%), indicating a moderate-severity, availability-only issue that does not rise to urgent-priority status.
Local information disclosure in Huawei HarmonyOS 5.0.1 and 5.1.0 Wi-Fi module allows an attacker with low-level local privileges to read confidential service data. The flaw is an access-control and permission issue (CWE-264) that requires a malicious or compromised app already running on the device; there is no network vector and no user interaction. No public exploit identified at time of analysis, and the EPSS score is 0.10% (1st percentile), making this a moderate post-compromise issue rather than an emergency.
Local information disclosure in Huawei HarmonyOS 5.0.1 and 5.1.0 allows an already-installed, low-privilege application to abuse a permission-control flaw in the network module to read confidential data. The attacker must already have a local, authenticated app-level foothold on the device, and the impact is limited to confidentiality; there is no privilege elevation or data modification. No public exploit has been identified at time of analysis, and the EPSS score is 0.10% (1st percentile); patches are available through Huawei's October 2025 security bulletin.
Information disclosure in the Huawei HarmonyOS Gallery module lets an authenticated, low-privilege local app on HarmonyOS 5.0.1 or 5.1.0 bypass permission controls and read Gallery data, affecting confidentiality only. The flaw is locally scoped (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) - an attacker cannot reach it remotely and must first get a malicious, sideloaded, or over-permissioned app running on the device, after which the impact stays inside that device (scope Unchanged) with no integrity or availability effect. There is no public exploit identified at time of analysis and EPSS is 0.09% (1st percentile), so this is a moderate-severity local information-disclosure issue rather than an emergency; the reference advisory is Huawei's October 2025 consumer security bulletin.
A stack-based buffer overflow (CWE-121) in the device management module of Huawei HarmonyOS 5.0.1 and 5.1.0 can be triggered by a local actor holding low-level privileges, resulting in a crash or denial of service of the affected component. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms the attack surface is local rather than remote, requires at least low privileges, needs no user interaction, and is limited to availability impact with no confidentiality or integrity consequence - a successful exploit cannot read data, alter data, or execute attacker-controlled code based on the assessed vector. Risk is low in practice: EPSS is only 0.09% (0th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.