Local low-privileged attackers can crash Huawei HarmonyOS 5.0.1 and 5.1.0 by triggering a stack-based buffer overflow (CWE-121) in the device management module, causing availability loss; the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates authenticated local access is required, with no confidentiality or integrity impact and no code execution path identified. The EPSS score is 0.09% (percentile 0%), and no public exploit code was identified at time of analysis; this is a genuine but low-priority issue, not a high-CVSS scare.
Bypassing permission verification in the Huawei Camera app on HarmonyOS 5.0.1 and 5.1.0 allows local attackers to disclose confidential information by convincing a user to install or run a malicious application. The flaw is moderate severity (CVSS 5.5) with low EPSS (0.09%) and no public exploit identified at time of analysis; exploitation requires local access and user interaction.
A stack-based buffer overflow in the sensor service shipped with Huawei HarmonyOS 5.1.0 lets a local attacker who already holds low-level privileges on the device crash or destabilize the service, degrading availability. Exploitation requires local access to the device and the ability to feed crafted input to the sensor service (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is confined to the specific 5.1.0 release named in the CPE and carries no confidentiality or integrity impact. There is no evidence of active exploitation (not in CISA KEV), no public exploit code has been identified, and EPSS is negligible at roughly 0.09%, making this a moderate-severity, low-real-risk local availability bug.
Denial-of-service in Huawei HarmonyOS 5.0.1 and 5.1.0 allows a local attacker with low-level privileges to crash the development framework module via a stack-based buffer overflow. The vulnerability requires local access and pre-existing low privileges (PR:L) with no user interaction; successful exploitation only affects availability (A:H) with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified, and the EPSS score is very low (0.09%).
Local information disclosure in Huawei HarmonyOS 5.0.1 and 5.1.0 allows an application that already holds low-level privileges on the device to reach camera data or camera-module services beyond its authorization, because the camera module's permission control is improperly enforced. Successful exploitation affects confidentiality only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N, C:H/I:N/A:N) with no integrity or availability impact and no expansion of privilege scope. No public exploit code or confirmed active exploitation has been identified, and the EPSS score is 0.09% (0th percentile), so real-world urgency is low.
In Huawei HarmonyOS 5.0.1 and 5.1.0, permission checks in the media module are insufficient, allowing a low-privileged local actor - in practice a malicious or compromised app already installed and running on the device - to reach confidential media-related data it should not be able to access. The flaw is not remotely exploitable (AV:L), requires no user interaction (UI:N), and impacts confidentiality only (C:H/I:N/A:N), yielding a CVSS 3.1 base score of 5.5. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is a negligible 0.09%, and the practical barrier is the need for an on-device foothold, with exposure limited to the two confirmed HarmonyOS versions.
Improper exception handling in the Huawei HarmonyOS print module leaves HarmonyOS 5.0.1 and 5.1.0 devices open to a local low-privileged attacker - in practice an already-installed or running application that can reach the print service - who can supply crafted input that the module fails to process correctly and thereby crash or disable printing. The impact is availability-only (CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5), with no data exposure, privilege escalation, or code-integrity loss reported, and no user interaction is required. No public exploit code has been identified at time of analysis and EPSS is negligible (0.09%, 0th percentile); this is a moderate-severity, low-priority hardening issue rather than an active threat.
A stack-based buffer overflow in the HarmonyOS package management module allows locally-positioned code running at low privilege to feed crafted input into the component and crash or destabilize it, affecting Huawei HarmonyOS 5.0.1 and 5.1.0 devices. Impact is availability-only (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) - there is no confidentiality or integrity effect and no user interaction is required once the low-privilege foothold is obtained, for example through an installed app. No public exploit code has been identified at time of analysis, EPSS is 0.09% (0th percentile), and the CVE is not listed in CISA KEV; consistent with the independent assessment, this is a genuinely moderate, availability-only issue rather than a top-tier priority.
Locally executing code with low-level privileges can abuse improper exception handling in the Huawei HarmonyOS print module to crash the print service and degrade availability on HarmonyOS 5.0.1 and 5.1.0 devices. Exploitation requires an attacker-controlled or compromised application already running on the device that can reach the print path; there is no remote or unauthenticated vector and no user interaction is needed (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N, availability-only impact). The issue is not listed in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is very low at 0.09%, making this a moderate-severity, low-priority item in practice.
A local denial-of-service condition in the 'office service' component of Huawei HarmonyOS 5.0.1 and 5.1.0 lets an attacker who already holds a foothold on the device with low-level privileges crash or otherwise render that service unavailable, with no confidentiality or integrity impact. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms exploitation is strictly local and requires low privileges, so a locally installed or running app or local account able to reach the office service is sufficient, and no user interaction is needed. Severity is moderate (CVSS 5.5) and the EPSS score is negligible at roughly 0.09% (0th percentile); no public exploit code has been identified and there is no indication of active exploitation. Huawei published an October 2025 consumer security bulletin addressing the affected HarmonyOS releases.
Unauthenticated attackers can add or empty items in other users' wishlists on WordPress sites running WPC Smart Wishlist for WooCommerce versions up to 5.0.3 by exploiting an Insecure Direct Object Reference in several wishlist AJAX functions. Exploitation requires obtaining a shared wishlist key that is exposed when a user shares their wishlist; without the key, the wishlist remains protected. This low-severity integrity flaw (CVSS 5.3, EPSS 0.23%) has no public exploit identified at time of analysis and cannot lead to data disclosure or code execution.
Unauthenticated attackers can access sensitive information through publicly exposed log files in the Code Quality Control Tool WordPress plugin versions 2.1 and earlier, due to inadequate access controls on the error_logger.php component. The vulnerability allows remote attackers to read potentially sensitive data without authentication or user interaction, presenting a confidentiality risk to WordPress installations using affected versions.
SQL injection in the NEX-Forms WordPress form builder plugin (all versions up to and including 9.1.6) lets an authenticated user with Administrator-level capability inject arbitrary SQL through the 'orderby' parameter of the nf_load_form_entries AJAX action, allowing extraction of sensitive data from the WordPress database. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.9) shows a remote, unauthenticated-path issue but a high privilege prerequisite (PR:H), so real risk is concentrated in multi-tenant or delegated-role sites where an administrator hands the required capability to a lower-trust user; on a standard single-admin site the attacker would already hold equivalent database access. No public exploit code was identified at time of analysis, the issue is not in CISA KEV, and EPSS is only 0.32% (22nd percentile), indicating low predicted exploitation activity.
Time-based SQL injection in the Custom 404 Pro WordPress plugin (versions up to and including 3.12.0) allows authenticated attackers with Administrator-level access to extract sensitive information from the database via the 'path' parameter. The vulnerability requires high privileges (PR:H), limiting its real-world impact since administrators already have broad data access, and it only affects confidentiality without modifying or deleting data. No public exploit code or active exploitation has been identified at time of analysis, and EPSS indicates a low likelihood of exploitation (0.30%, 20th percentile).
Authenticated attackers with Administrator-level privileges on WordPress sites running the My Auctions Allegro plugin version 3.6.31 or earlier can exploit an SQL injection flaw in the 'order' parameter to read sensitive information from the database. The vulnerability requires high privileges (PR:H) and does not allow data modification or denial of service, resulting in a low overall risk despite the SQL injection classification. No public exploit code or active exploitation has been identified, and the EPSS score is 0.30% (20th percentile).
Directory traversal in the Error Log Viewer plugin for WordPress (versions up to 1.1.6) allows authenticated administrators to read arbitrary files on the server via the rrrlgvwr_get_file function. The vulnerability is rooted in insufficient path validation (CWE-22) and has a CVSS score of 4.9 due to high confidentiality impact but limited scope (administrator privilege requirement). No public exploit code or active exploitation has been identified at the time of analysis.
Open redirect in the CM Registration plugin for WordPress (all versions up to and including 2.5.6) lets an unauthenticated attacker craft a link that sends a victim's browser to an arbitrary external site by abusing the unvalidated 'redirect_url' parameter in the plugin's login and invitation-based registration flow. Exploitation requires the victim to click a socially engineered link (CVSS 4.7, UI:R, scope-changed), so it cannot be triggered silently or at scale without a phishing lure, and impact is limited to browser redirection with no server-side code execution, data disclosure, or availability effect. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS places the likelihood of exploitation in the near term at roughly 0.21% (11th percentile), consistent with a low-priority issue.
Unauthenticated CSV (formula) injection in the Contest Gallery WordPress plugin, affecting all versions up to and including 27.0.3, lets attackers plant spreadsheet formulas into public gallery submission fields that are later written into exported CSV files. Successful abuse requires a privileged operator to export submissions and then open the resulting CSV in a spreadsheet application configured to auto-execute formulas, DDE or external content, which means the realistic risk is far lower than the unauthenticated entry point suggests - no public exploit code has been identified at time of analysis and EPSS is 0.34% (26th percentile), with no CISA KEV listing. The vendor's CVSS of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects only the injection itself, whereas this assessment scores the full downstream chain at CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H because impact lands on the operator's workstation rather than the WordPress host.
Unauthorized plugin installation in the Newsup WordPress theme through version 5.0.10 lets an attacker invoke newsup_admin_info_install_plugin(), which lacks a capability check (CWE-862), to install the ansar-import plugin. Our independent assessment treats this as unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), while NVD's vector lists PR:L, creating an authentication-requirement conflict. Impact is limited to integrity with no confidentiality or availability loss; EPSS is 0.25% (15th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis. An upstream Trac changeset appears to address the missing check.
Attackers can modify widget page block configurations in the Page Blocks WordPress plugin (versions up to and including 1.1.0) via cross-site request forgery by tricking a logged-in site administrator into clicking a crafted link. The flaw is in the admin_process_widget_page_change function, which lacks proper nonce validation (CWE-352), allowing a forged cross-origin request to be accepted in the admin's browser. Exploitation requires an active admin session and user interaction; no public exploit code is identified, and EPSS is 0.17% (5th percentile), consistent with a low-priority issue.
Cross-site request forgery in the WidgetPack Comment System plugin for WordPress (all versions up to and including 1.6.1) allows an unauthenticated attacker to force a logged-in site administrator's browser to fire the wpcmt_sync action, triggering a comment synchronization event without the admin's intent. The flaw is a missing nonce check in the wpcmt_request_handler function; it is network-reachable and needs no attacker credentials (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3), but success depends on social engineering a privileged user into clicking a crafted link or visiting a malicious page. Impact is integrity-only - no data disclosure or service disruption - and risk is further reduced by a very low EPSS score (0.16%, 5th percentile), no CISA KEV listing, and no public exploit identified at time of analysis.
Cross-site request forgery (CSRF) in the Web Accessibility By accessiBe WordPress plugin up to version 2.10 allows unauthenticated attackers to alter plugin settings and create verification files if they can trick a logged-in administrator into clicking a crafted link. The vulnerability exists because several AJAX actions lack nonce validation, and while it is remotely reachable, the mandatory admin interaction and integrity-only impact keep the risk low; no public exploit code or active exploitation has been identified, and the EPSS score is 0.16% (low risk).
Cross-Site Request Forgery in the Course Redirects for Learndash WordPress plugin (versions up to and including 0.4) allows unauthenticated attackers to modify the plugin's redirect settings by tricking a logged-in administrator into clicking a crafted link. The flaw exists because the settings-page form processing lacks nonce validation, so any cross-origin POST request is accepted. Although the CVSS vector is network-based and unauthenticated, exploitation requires an active administrator session and user interaction, and the impact is confined to integrity of the plugin's redirect settings; EPSS is low (0.13%, 2nd percentile) and no public exploit was identified at time of analysis.
Cross-site request forgery in the GSheetConnector For Gravity Forms WordPress plugin (versions up to and including 1.3.23) lets an attacker craft a forged request that activates or deactivates arbitrary WordPress plugins in the context of a logged-in administrator who is lured into clicking a malicious link or visiting a compromised page. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, score 2.4), the attacker needs no prior authentication, but the victim administrator must actively interact while authenticated, and the only resulting impact is a low-integrity change to plugin activation state - no code execution, no data disclosure, and no availability loss. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the EPSS score of 0.15% (4th percentile) reflects a very low likelihood of exploitation in the wild.
Path traversal vulnerability in MoneyPrinterTurbo up to version 1.2.6 allows authenticated remote attackers to manipulate file upload parameters in the music API endpoint, enabling arbitrary file write operations with limited confidentiality and integrity impact. Publicly available exploit code exists and the vulnerability has low EPSS exploitation probability (0.09%, 26th percentile), suggesting limited real-world weaponization despite proof-of-concept availability.
SQL injection in iPynch Social Network's Search component allows authenticated remote attackers to manipulate queries and access or modify database content with low complexity exploitation. The vulnerability affects the product up to commit b6933b6d7f82c84819abe458ccf0e59d61119541, and public exploit code has been released, though the EPSS score of 0.03% and CVSS base score of 2.1 suggest limited real-world exploitation probability despite the low attack complexity and public availability of proof-of-concept materials.