LogicalDOC Community Edition up to 9.2.1 fails to implement rate limiting on the admin login page (/login.jsp), allowing remote attackers to conduct brute-force authentication attacks with high complexity but difficult exploitability. Publicly available exploit code exists, though the vendor has not responded to early disclosure notification, and real-world exploitation risk remains low given the EPSS score of 0.16% and high attack complexity.
Stored cross-site scripting (XSS) in LogicalDOC Community Edition up to 9.2.1 allows authenticated users to inject malicious scripts via the API Key creation UI, affecting the integrity of user data and potentially enabling credential theft or session hijacking. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), but publicly available exploit code exists and the vendor has not responded to early disclosure notification.
Missing authorization checks in Rank Math SEO WordPress plugin (versions through 1.0.252.1) allow authenticated high-privilege users to perform actions that exceed their intended access level, resulting in limited integrity and availability impact. The vulnerability stems from incorrectly configured access control security levels (CWE-862), enabling exploitation of plugin functionality without proper capability verification. No public exploit exists and EPSS remains at 0.01% (3rd percentile), indicating negligible real-world exploitation pressure at time of analysis.
Broken access control in WPDeveloper Essential Addons for Elementor (lite, ≤6.2.4) permits a high-privileged authenticated WordPress user to access restricted functionality or data beyond their intended authorization scope. The vulnerability stems from missing server-side authorization checks (CWE-862), meaning the plugin fails to verify whether the requesting principal has permission to perform a given action. With a CVSS score of 2.7 and EPSS at 0.03%, real-world exploitation risk is low; no public exploit code or active KEV listing has been identified at time of analysis.
Performance degradation in Python's os.path.expandvars() can be triggered by a local attacker with high privileges who supplies crafted input containing environment variable syntax to that function. Both the POSIX (posixpath.py) and Windows (ntpath.py) implementations were affected, as their manual character-by-character loop logic exhibited algorithmic complexity issues under adversarial input. No public exploit is identified at time of analysis, and an EPSS score of 0.14% at the 4th percentile signals negligible exploitation probability.