SVG-based server-side request forgery in ThingsBoard versions prior to 4.2.1 allows upload of crafted SVG files containing external URL references to the dashboard Image Upload Gallery, causing the platform to initiate unintended outbound HTTP requests toward internal network resources. All ThingsBoard deployments (community, professional edition) running versions before 4.2.1 are affected via this gallery feature. No public exploit code or CISA KEV listing exists at time of analysis; however, the upstream fix in PR #13927 - which adds a Content-Security-Policy response header rather than sanitizing SVG content at upload - indicates the primary exploitation path may be browser-mediated rather than purely server-side, warranting scrutiny of the PR:N (no privileges required) CVSS assignment.
Stored cross-site scripting (XSS) in the Memberlite Shortcodes WordPress plugin through version 1.4.1 allows authenticated attackers to inject arbitrary web scripts. This vulnerability can lead to session hijacking or arbitrary actions executed in the context of the victim's browser when they view a page containing malicious shortcode content. No active exploitation or public exploit code has been identified at time of analysis.
Stored cross-site scripting in the MediaWiki WebAuthn extension allows authenticated, low-privilege attackers to inject malicious scripts via WebAuthn key names. When an administrator or another user views the key listing page, the script executes, potentially leading to session hijacking, content manipulation, or application disruption. No active exploitation or public exploit code has been reported.
We need to produce a JSON object for CVE-2025-11849. First, parse the input data: CVE ID: CVE-2025-11849 Description: Versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth from 0.3.25 and before 1.11.0; versions of the package mammoth before 1.11.0; versions of the package org.zwobble.mammoth:mammoth before 1.11.0 are vulnerable to Directory Traversal due to the lack of path or file type validation when processing a docx file containing an image with an external link (r:link attribute instead of embedded r:embed). The library resolves the URI to a file path and after reading, the content is encoded as base64 and included in the HTML output as a data URI. An attacker can read arbitrary files on the system where the conversion is performed or cause an excessive resources consumption by crafting a docx file that links to special device files such as /dev/random or /dev/zero. CVSS Score: 5.4 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-22 EPSS: 0.23% (percentile 46%) Patch: Available from vendor Tags: Path Traversal References: multiple snyk and GitHub gist, commit. So product is "mammoth". It's a docx to HTML converter library. Versions <1.11.0 are affected. The fix is in commit that disables external file access by default. Patch available (from vendor, meaning version 1.11.0). Now follow instructions strictly. product_name: "mammoth" (1-3 words, specific product: mammoth) summary: Must be original synthesis, not copy description. Start with impact verb. Example: "Directory traversal in mammoth library before 1.11.0 allows ..." Since it's directory traversal leading to arbitrary file read and resource consumption. Mention actively exploited? Not in KEV, no active exploitation mentioned. POC? There's a Gist, but that's a security advisory, not necessarily a public exploit
Stored Cross-Site Scripting in CobbleStone Enterprise Contract Management Portal v22.4.0 allows a low-privileged, authenticated remote attacker to inject persistent malicious scripts into the application's chat box component. When a victim user views the chat, the injected script executes in their browser session, enabling session hijacking, credential theft, or in-application action forgery scoped to the vulnerable system. Notably, the vendor has disclosed that v22.4.0 is an obsolete, unsupported version no longer in active distribution, which substantially narrows the real-world attack surface. No public exploit identified at time of analysis, though a researcher writeup on Medium constitutes partial technical disclosure.
Authenticated subscribers in the Binary MLM Plan WordPress plugin up to version 5.0 can access other users' payout summaries through insecure direct object reference (IDOR) in the /bmp-account-detail/ endpoint. The vulnerability stems from the bmp_user_payout_detail_of_current_user() function failing to verify payout record ownership before returning data, allowing any authenticated user with the bmp_user role to enumerate and view arbitrary payout details by manipulating the payout-id parameter. This is a low-severity information disclosure affecting MLM WordPress sites; no public exploit code or active exploitation has been confirmed.