Stored cross-site scripting (XSS) in projectworlds Gate Pass Management System 1.0 allows authenticated users to inject malicious scripts via the /add-pass.php endpoint, which execute in the browsers of other users who view the affected content. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting its scope to reflected or stored XSS within an authenticated session. Publicly available exploit code exists, though EPSS exploitation probability remains very low at 0.03%, suggesting limited real-world weaponization despite public disclosure.
SQL injection in Bdtask Wholesale Inventory Control and Inventory Management System up to version 20251013 allows high-privileged remote attackers to manipulate the first_name and last_name parameters in the /Admin_dashboard/edit_profile endpoint, leading to unauthorized database queries with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.
Stored cross-site scripting (XSS) in code-projects Client Details System 1.0 allows authenticated users with high privileges to inject malicious scripts via the /admin/manage-users.php endpoint, which are then executed in the browsers of other users who interact with the managed user data. The vulnerability requires administrative privileges and user interaction (UI:P) to exploit, resulting in limited integrity impact (VI:L). Public exploit code is available, though the extremely low CVSS score (1.9) and EPSS probability (0.04%) reflect the high privilege barrier and user interaction requirement that significantly constrain real-world risk.
Stored cross-site scripting (XSS) in Willow CMS up to version 1.4.0 allows authenticated administrative users to inject malicious scripts via the title or body parameters in the Add Post Page (/admin/articles/add), which are then executed in the browsers of other users who view the post. The vulnerability requires high-privilege authentication and user interaction (visiting the affected page) to trigger, resulting in limited integrity impact. Public exploit code is available, though EPSS analysis indicates minimal real-world exploitation probability at 0.03%.
Reflected cross-site scripting in PHPGurukul Curfew e-Pass Management System 1.0 allows authenticated high-privilege users to inject malicious scripts via the Fullname or Category parameters in view-pass-detail.php, exploitable only when a victim with sufficient privileges views a crafted link. The CVSS score of 1.9 reflects severe exploitation constraints: high privilege requirement, user interaction dependency, and limited impact scope, despite a public exploit being available.
Stored or reflected cross-site scripting (XSS) in PHPGurukul Curfew e-Pass Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the catname parameter in edit-category-detail.php, affecting application integrity with low severity (CVSS 1.9, EPSS 0.03%). Publicly available exploit code exists; however, exploitation requires user interaction and high-level administrative credentials, significantly limiting real-world attack surface.
Stored cross-site scripting (XSS) in PHPGurukul Curfew e-Pass Management System 1.0 allows authenticated high-privilege users to inject malicious scripts via the adminname or email parameters in admin-profile.php, affecting user interface integrity and enabling credential theft or malware delivery. The vulnerability requires high-privilege access and user interaction (UI:P), resulting in a CVSS score of 1.9 despite network accessibility. Public exploit code exists but exploitation probability is exceptionally low (EPSS 0.03%, 9th percentile), suggesting this is primarily a demonstration or proof-of-concept rather than an active threat.
Cross-site scripting (XSS) in code-projects Client Details System 1.0 allows remote attackers with high privileges and user interaction to inject malicious scripts via the /welcome.php file, resulting in limited integrity impact. The vulnerability has been publicly disclosed with exploit code available, though real-world exploitation is constrained by the requirement for high administrative privileges and user interaction, reflected in the exceptionally low CVSS score of 1.9 and EPSS probability of 0.03%.
Stored cross-site scripting in projectworlds Expense Management System 1.0 allows high-privileged authenticated users to inject malicious scripts via the Expense Categories creation page, affecting other users who view the poisoned content. The vulnerability requires administrator-level access and user interaction (rendering the page), limiting real-world impact despite remote network delivery. Publicly available exploit code exists; EPSS exploitation probability is very low at 0.03%, suggesting this is primarily a proof-of-concept risk rather than an actively exploited threat.
Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the Currency Page create function (/public/admin/currencies/create), which are then reflected to other users who interact with that page. The vulnerability requires user interaction and high-level administrative privileges to exploit, resulting in limited real-world risk despite public exploit availability and low EPSS score.
Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows authenticated high-privilege users to inject malicious scripts via the Roles Page create endpoint (/public/admin/roles/create), which are then reflected to other users. The vulnerability requires high-privilege authentication and user interaction to trigger, limiting real-world exploitation despite public POC availability and network accessibility.
Stored cross-site scripting (XSS) in projectworlds Expense Management System 1.0 allows high-privileged authenticated users to inject malicious scripts via the /public/admin/users/create endpoint, which are executed in the browsers of other users viewing the affected page. The vulnerability requires administrator privileges and user interaction (clicking a link), significantly limiting exploitation scope despite remote accessibility and publicly available proof-of-concept code.
Null pointer dereference in Kamailio 5.5.0's grammar rule handler (src/core/cfg.y, yyerror_at function) causes denial of service when processing malformed configuration files. Local authenticated attackers can trigger the vulnerability by manipulating config files, resulting in application crash. Publicly available exploit code exists, but exploitation requires local access and config file manipulation, limiting real-world attack surface. EPSS score of 0.03% indicates minimal exploitation probability despite disclosed POC.
Kamailio 5.5.0 suffers a null pointer dereference in the rve_is_constant function (src/core/rvalue.c) triggered by manipulation of local configuration files, resulting in denial of service. The attack requires local access with low privileges and produces only availability impact. Publicly available exploit code exists, but active exploitation has not been confirmed by CISA KEV, and the vulnerability's genuine existence remains disputed by the original reporter. Real-world risk is minimal given the low EPSS score (0.03%), requirement for config file manipulation, and minimal impact surface.
Stored cross-site scripting (XSS) in code-projects Client Details System 1.0 allows authenticated high-privilege users to inject malicious scripts into the /admin/clientview.php endpoint that execute in the context of other users' browsers. The vulnerability requires user interaction (victim must view affected content) and high administrative privileges to exploit, limiting real-world risk despite public exploit disclosure. EPSS score of 0.03% reflects the stringent authentication and interaction requirements that prevent widespread automated exploitation.
Cross-site scripting (XSS) in code-projects Client Details System 1.0 allows high-privileged authenticated users to inject malicious scripts via the /update-clients.php endpoint, requiring user interaction to execute. The vulnerability carries a low CVSS score of 1.9 due to high privilege requirements (PR:H) and mandatory user interaction (UI:P), but publicly available exploit code exists, making it actionable for insider threats or social engineering scenarios targeting administrators.
Stored cross-site scripting in the Dynamic User Directory WordPress plugin (versions ≤ 2.3) allows a high-privileged authenticated user to inject persistent malicious scripts that execute in the browsers of other site visitors or administrators. Disclosed by Patchstack (audit@patchstack.com), the flaw carries a CVSS base score of 5.9 with Scope:Changed, reflecting cross-origin browser impact that can escalate to session hijacking even from a low-C/I impact rating. EPSS places exploitation probability at 0.02% (7th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting (XSS) in the Usercentrics CMP WordPress plugin (versions up to 1.0.9) allows authenticated administrator-level attackers to inject arbitrary JavaScript that executes in other users' browsers. Successful exploitation can lead to session hijacking, credential theft, or defacement of the consent management interface. No active exploitation or publicly available proof-of-concept has been identified at time of analysis, and EPSS indicates very low exploitation probability.
Stored cross-site scripting in Photospace Responsive WordPress plugin versions up to 2.2.0 allows authenticated administrators to inject malicious scripts that execute in the context of other users' sessions. The vulnerability, assigned CVE-2025-62899, can lead to limited compromise of confidentiality, integrity, and availability. With a very low EPSS score (0.02%) and no exploit code publicly available, current exploitation likelihood is minimal.
Use-after-free vulnerability in Kamailio 5.5.0 configuration file parser allows local authenticated attackers to cause denial of service or memory corruption via malformed configuration files. The vulnerability exists in the sr_push_yy_state function within the lexical analyzer (cfg.lex) and has publicly available exploit code, though the vendor has not responded to disclosure and practical exploitability remains uncertain due to the requirement for direct configuration file manipulation.
Heap-based buffer overflow in Kamailio 5.5.0's rve_destroy function allows local authenticated attackers to cause limited data corruption through manipulation of configuration files, with publicly available exploit code but extremely low real-world risk due to local access requirement, authenticated privilege level, and acknowledged uncertainty about vulnerability existence.
Missing authorization checks in the Admin Management Xtended WordPress plugin (versions through 2.5.1) allow authenticated users to exploit incorrectly configured access control levels, performing administrative operations beyond their assigned role boundary. The CVSS scope change component (S:C) signals the vulnerability's impact crosses the exploiting user's permission boundary within the WordPress installation, enabling privilege escalation within the CMS. No public exploit code has been identified at time of analysis, and the EPSS score of 0.05% (16th percentile) indicates very low real-world exploitation probability currently.
SQL injection in Abdullah-Hasan-Sajjad's Online-School PHP application allows remote unauthenticated attackers to manipulate database queries through the Email parameter in the student login endpoint. All versions up to commit f09dda77b4c29aa083ff57f4b1eb991b98b68883 are affected, with a publicly available exploit report published via GitHub. The vendor was contacted prior to disclosure but did not respond, meaning no patch exists and the application remains unpatched.
SQL injection in CLTPHP 3.0 exposes the application's database to unauthenticated remote attackers via the `keyword` parameter in the `/home/search.html` search endpoint. The vulnerability stems from unsanitized user input being passed directly into SQL query construction, enabling data extraction and potential modification. A public proof-of-concept exploit has been disclosed (E:P in the CVSS 4.0 vector), though EPSS of 0.03% at the 7th percentile indicates low observed exploitation activity and no CISA KEV listing at time of analysis.
Unauthenticated remote attackers can bypass authorization controls in TS Demo Importer plugin for WordPress (versions ≤0.1.3), enabling high-impact integrity and availability compromise through misconfigured access control. EPSS scoring at 7th percentile (0.07%) suggests low observed exploitation probability. No CISA KEV listing indicates no confirmed active exploitation at time of analysis, though the authentication bypass tag and critical CVSS 9.1 rating warrant immediate attention for exposed WordPress installations.
Missing authorization in the MDZ Persian Admin Fonts WordPress plugin (versions through 4.1.03) allows low-privileged authenticated users to perform actions reserved for administrators due to absent capability checks. The CVSS vector (PR:L, AV:N, S:U) confirms that any authenticated WordPress user - such as a subscriber or contributor - can reach the vulnerable endpoints over the network with no user interaction required. No public exploit code has been identified at time of analysis, and EPSS sits at 0.06% (18th percentile), indicating negligible observed exploitation activity.
Broken access control in IgnitionDeck WordPress plugin (versions ≤2.0.15) enables authenticated users to bypass authorization checks and perform unauthorized actions with elevated privileges. The vulnerability requires low-privilege authentication but has low attack complexity (CVSS 8.8, AV:N/AC:L/PR:L), allowing compromise of confidentiality, integrity, and availability. EPSS probability is low (0.05%, 15th percentile), and no public exploit is identified at time of analysis, suggesting limited active targeting despite the high severity rating.
Broken access control in WP Flights & Hotels Booking WP Plugin (adiaha-hotel) versions ≤3.1 allows authenticated users with low privileges to bypass authorization checks and gain unauthorized access to high-impact functionality. Attackers can achieve complete compromise of confidentiality, integrity, and availability within the plugin's scope. EPSS score of 0.05% (15th percentile) indicates low observed exploitation probability, and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Missing authorization in the GoCache CDN WordPress plugin (versions through 1.3.6) allows low-privileged authenticated users to invoke restricted plugin actions beyond their intended access level, resulting in limited integrity and availability impact against CDN configuration. Reported by Patchstack via coordinated disclosure, with no public exploit code identified and an EPSS of 0.03% (10th percentile), indicating very low near-term exploitation probability. No active exploitation has been confirmed by CISA KEV.
Broken access control in Conversios.io WooCommerce analytics plugin (versions ≤7.2.13) allows authenticated low-privilege users to access or modify high-sensitivity data without proper authorization checks. The vulnerability enables privilege escalation where any authenticated user can bypass intended access restrictions to read confidential information or alter plugin settings/data. EPSS score of 0.03% (9th percentile) indicates low predicted exploitation probability; no public exploit identified at time of analysis.
Denial of service in Apache Tomcat occurs when multipart upload errors leave temporary disk files uncleaned, allowing attackers to exhaust disk space faster than garbage collection reclaims it. Affected versions 8.5.0-8.5.100 (EOL), 9.0.0-M1-9.0.109, 10.1.0-M1-10.1.46, and 11.0.0-M1-11.0.11 require authenticated access (PR:L) and high attack complexity, making real-world exploitation limited despite the medium CVSS score.
Unauthenticated access to CSV export data in the MSTW CSV EXPORTER plugin for WordPress versions up to 1.4 allows an attacker to retrieve exported information without any authentication. The issue arises from a missing authorization check on a publicly accessible export endpoint. No active exploitation or public exploit code is known, and the EPSS score of 0.06% indicates a very low probability of widespread exploitation.
An unauthenticated attacker can exploit missing authorization checks in the Everest Backup WordPress plugin (<=2.3.8) to trigger resource-intensive backup operations without any privileges, causing a low impact on server availability. No active exploitation or public proof-of-concept is known, and the EPSS score is very low (0.06%).
Unauthorized access to restricted functionality in Sunshine Photo Cart plugin for WordPress allows unauthenticated attackers to perform unauthorized actions. The vulnerability affects all versions up to and including 3.5.3, and stems from missing authorization checks that enable attackers to access functionality not properly constrained by Access Control Lists. With a low EPSS score (0.04%) and no reported active exploitation, the real-world risk is limited, though the flaw has a CVSS 5.3 medium rating.
Broken access control in the Sendle Shipping WordPress plugin (official-sendle-shipping-method) versions through 6.02 allows unauthenticated remote attackers to invoke plugin functionality that should be restricted to authorized users. The flaw stems from missing authorization checks (CWE-862), meaning certain shipping-related actions are accessible without any privilege verification. Real-world impact is limited to availability disruption (CVSS A:L), with no confidentiality or integrity impact identified. No public exploit code exists and EPSS places exploitation probability at 0.04% (11th percentile), indicating negligible active threat at time of analysis.
Unauthorized information disclosure in Export Categories plugin for WordPress through version 1.0 allows unauthenticated attackers to access category data due to a missing authorization check (CWE-862). Only category information is exposed, with no integrity or availability impact. The vulnerability has a low CVSS base score of 5.3, very low EPSS exploitation probability (0.04%), and no reports of active exploitation or public proof-of-concept.
Sensitive system information disclosure in ThemeHunk WP Popup Builder plugin for WordPress (versions ≤1.3.8) allows unauthenticated remote attackers to retrieve embedded sensitive data without authentication. The vulnerability presents a CVSS 7.5 HIGH severity with confirmed network-based exploitation requiring no user interaction. EPSS score of 0.03% (10th percentile) indicates minimal observed exploitation activity, and no public exploit identified at time of analysis. The flaw stems from improper exposure of sensitive information to unauthorized control spheres (CWE-497).
Sensitive data exposure in Atarim Visual Collaboration WordPress plugin (versions through 4.2.1) allows unauthenticated remote attackers to retrieve embedded confidential information via network-accessible endpoints. The vulnerability enables direct extraction of sensitive data with no authentication required and low attack complexity. EPSS score of 0.03% (10th percentile) indicates minimal current exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.
Missing authorization controls in the Baidu SEO Collection WordPress plugin versions up to 2.1.4 allow unauthenticated remote attackers to access restricted functionality and retrieve sensitive information without proper permission checks. The vulnerability affects the plugin's core access control mechanisms, enabling unauthorized information disclosure with a CVSS score of 5.3. EPSS exploitation probability is low at 0.03%, and no active exploitation has been confirmed.
Link Whisper Free WordPress plugin through version 0.9.2 allows unauthenticated remote attackers to read sensitive information via missing authorization checks on API endpoints. The vulnerability enables bypassing access controls to retrieve data that should be restricted, confirmed with CVSS 5.3 and EPSS 0.03% exploitation probability. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in RealMag777 MDTF (WordPress Meta Data Filter and Taxonomy Filter) plugin versions up to 1.3.6 allows low-privileged authenticated users to bypass authorization controls and access or modify sensitive metadata and taxonomy filter configurations. While rated CVSS 8.1 (High), real-world exploitation risk remains moderate with EPSS at 0.03% (9th percentile) and no confirmed active exploitation or public exploit code identified at time of analysis. This authentication bypass vulnerability was disclosed by Patchstack's security audit team.
Missing authorization in RelyWP Coupon Affiliates plugin (versions up to 7.2.0) allows unauthenticated remote attackers to access restricted functionality and read sensitive data due to inadequate access control list (ACL) enforcement. The vulnerability requires no authentication and has low attack complexity, enabling attackers to bypass WordPress permission checks and retrieve coupon-related information not intended for public access.
Improper neutralization of HTML script tags in WP Recipe Maker through version 10.0.x enables reflected cross-site scripting (XSS) attacks against users. The vulnerability affects the Brecht WP Recipe Maker WordPress plugin and requires user interaction (clicking a malicious link) to exploit. An attacker can inject arbitrary JavaScript into the page context, achieving code execution in the victim's browser with potential to steal session tokens or perform actions on behalf of authenticated users. The vulnerability has low real-world exploitation probability (EPSS 0.02%) and does not appear to be actively exploited in the wild.
Sensitive data exposure in the Publitio WordPress plugin (versions ≤2.2.5) allows unauthenticated remote attackers to retrieve embedded sensitive information through network requests. The vulnerability exposes confidential data with high impact to confidentiality (CVSS C:H), though exploitation probability remains low (EPSS 3rd percentile). No public exploit identified at time of analysis, and exploitation requires no privileges or user interaction (PR:N/UI:N), making it trivially exploitable if targeted.
Server-Side Request Forgery in the Codeless Slider Templates WordPress plugin (versions ≤1.0.3) enables authenticated low-privilege users to induce the server to make arbitrary outbound HTTP requests, potentially reaching internal network resources such as cloud metadata services or private APIs. The CVSS vector (AV:N/AC:H/PR:L/S:C/C:L/I:L) confirms network exploitation requires an authenticated WordPress account and high attack complexity, with scope change indicating cross-boundary impact on internal infrastructure. No active exploitation is confirmed - EPSS sits at 0.03% (10th percentile) and no KEV listing exists - placing this firmly in the low real-world priority tier despite the scope change.
Open redirect in the WP Gravity Forms Zoho CRM and Bigin WordPress plugin (versions ≤ 1.2.8) allows unauthenticated remote attackers to redirect victims from a trusted WordPress site to an arbitrary attacker-controlled URL, enabling phishing attacks. The CVSS Scope:Changed designation reflects that the trust boundary of the originating WordPress site is crossed, lending legitimacy to malicious links. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.03% (8th percentile) confirms very low observed exploitation probability at time of analysis.
An access control vulnerability in the SEO Meta Description Updater WordPress plugin (versions ≤1.2.0) allows low-privileged authenticated users to modify plugin settings without proper authorization. This missing authorization flaw (CWE-862) can be exploited over the network without user interaction, leading to unauthorized manipulation of SEO meta descriptions. No public exploit or active exploitation has been identified.
Missing authorization in Clicksend CF7 Plugin for WordPress versions ≤1.4.0 allows authenticated attackers to modify SMS notification settings without proper capability checks. The vulnerability has a low CVSS score of 4.3, no known public exploit, and an EPSS score of 0.06% indicating very low exploitation probability.
An access control weakness in Referral Link Tracker for WordPress up to 1.1.4 allows authenticated users with minimal privileges to interact with restricted plugin functionality, leading to limited availability impact. No data exposure or integrity tampering is indicated, and there is no evidence of active exploitation or public exploit code.
Broken access control in Revive Old Posts (tweet-old-post) WordPress plugin through version 9.3.3 allows authenticated attackers with low-level privileges to escalate permissions and execute high-impact operations including data exfiltration, modification, and service disruption. EPSS score of 0.05% (15th percentile) indicates low probability of mass exploitation, though the 8.8 CVSS score reflects significant potential damage once low-privilege access is obtained. No public exploit identified at time of analysis, and no CISA KEV listing exists.