MaxSite CMS up to version 109 contains an improper access control vulnerability in the file editor plugin that allows authenticated remote attackers to upload arbitrary files by manipulating the file_path and content parameters in save-file-ajax.php. Publicly available exploit code exists for this vulnerability, and the vendor has not responded to early disclosure attempts, leaving affected installations unpatched.
MaxSite CMS up to version 109 contains an unrestricted file upload vulnerability in the auto_post plugin's upload handler that allows authenticated remote attackers to bypass file upload restrictions by manipulating HTTP headers (X-Requested-FileName and X-Requested-FileUpDir). Public exploit code is available, though EPSS score (0.05%) suggests limited real-world exploitation despite the publicly disclosed proof-of-concept.
Stored cross-site scripting (XSS) in code-projects E-Commerce Website 1.0 allows remote attackers to inject malicious scripts via the supp_name or supp_address parameters in /pages/supplier_update.php. Exploitation requires user interaction (clicking a malicious link) but no authentication. Publicly available exploit code exists; real-world exploitation risk is low (EPSS 0.04%, CVSS 2.1) due to limited scope and required user interaction, but the vulnerability is disclosed and weaponizable.
Stored cross-site scripting (XSS) vulnerability in SourceCodester Student Grades Management System 1.0 allows authenticated administrators with high privileges to inject malicious scripts via the delete_user function in /admin.php, which execute in the context of other users' browsers when they interact with affected content. The vulnerability requires user interaction and administrative privileges to exploit, resulting in low integrity impact with a CVSS score of 1.9. Publicly available exploit code exists, though the very low EPSS score (0.05%, 14th percentile) suggests limited real-world exploitation despite POC availability.
Path normalization bypass in Keycloak allows unauthenticated network attackers to circumvent reverse proxy access controls protecting the /admin interface by submitting HTTP requests with non-normalized paths (containing `..` or `//`). Proxies such as HAProxy perform literal string matching on the raw request URI and do not block these crafted paths, while Keycloak internally normalizes them to resolve to /admin — effectively defeating the proxy-layer security control. This vulnerability is not in CISA KEV and carries a low EPSS score (0.38%), but is directly relevant to any proxy-protected Keycloak deployment following the vendor's own recommended hardening guidance.
Yonyou U8 Cloud versions up to 5.1sp allow authenticated remote attackers to bypass file upload restrictions via manipulation of the ts and sign parameters in the /service/NCloudGatewayServlet endpoint, enabling unrestricted file uploads. The vulnerability affects the Request Header Handler component and has been publicly disclosed with exploit code available, though the vendor has not responded to early notification.