Missing authorization in the Storage Management Endpoint of Mogu Blog v2 (up to version 5.2) enables unauthenticated remote attackers to access or manipulate files in the /storage/ directory. The attack complexity is high and a publicly available exploit exists, though no active exploitation is confirmed and EPSS indicates very low likelihood of exploitation.
Deserialization in nutzam NutzBoot's LiteRpc-Serializer component allows remote attackers to potentially read sensitive data from affected systems. An exploit is publicly available; no active exploitation has been confirmed. The vulnerability carries an extremely low CVSS 4.0 score of 2.9 due to high attack complexity and limited confidentiality impact, though real-world impact may be greater if deserialization gadget chains permit arbitrary code execution.
Command injection in ADSLR NBR1005GPEV2 firmware version 250814-r037c allows remote authenticated attackers with low privileges to execute arbitrary commands via the mac parameter in the ap_macfilter_add function of /send_order.cgi. Exploit code is publicly available, though the EPSS exploitation probability is low (0.56%) and the vulnerability has not been cataloged in CISA KEV. The vendor has not responded, leaving no official patch.
Command injection in ADSLR B-QE2W401 firmware version 250814-r037c allows remote attackers to execute arbitrary commands via the `del_swifimac` parameter in the `/send_order.cgi` endpoint. Exploit code is publicly available; no active exploitation (CISA KEV) is reported, though the EPSS likelihood of exploitation is at the 68th percentile (0.56%). The vendor has not responded to disclosure.
Authenticated command injection in ADSLR NBR1005GPEV2 router firmware 250814-r037c allows remote attackers with low privileges to execute arbitrary OS commands via the mac parameter in /send_order.cgi. Exploit code is publicly available, though no active exploitation has been reported. The vulnerability scores only 2.1 in CVSS 4.0 due to limited impact.
Command injection in ADSLR NBR1005GPEV2 firmware 250814-r037c allows remote authenticated attackers to execute arbitrary commands via the mac parameter in the ap_macfilter_del function of /send_order.cgi. A public proof-of-concept exploit is available and the vendor has not responded or released a patch. EPSS score is low (0.41%), indicating limited likelihood of widespread exploitation despite the availability of an exploit.
Authenticated path traversal in Mogu Blog v2 up to 5.2 allows remote attackers to write files to arbitrary directories via the /networkDisk/unzipFile endpoint. The vulnerability exists in the FileOperation.unzip function processing the fileUrl argument without proper sanitization, enabling ZIP slip-style extraction. Exploit code is publicly available, but no active exploitation has been confirmed by CISA KEV; the EPSS probability is low (0.15%).
Unrestricted file upload in Mogu Blog v2 up to version 5.2 allows remote attackers with low privileges to upload arbitrary files via the /file/pictures endpoint by manipulating the filedatas argument. A public proof-of-concept exploit is available, but no active exploitation has been confirmed by CISA KEV. The EPSS exploitation probability is 0.05%, indicating low likelihood of widespread exploitation.
Server-side request forgery in orion-ops allows authenticated remote attackers to manipulate SSH connection parameters (host, port, credentials) to trigger outbound requests from the server, potentially reaching internal services. The vulnerability affects all versions up to commit 5925824 and has a publicly available proof-of-concept exploit. Exploitation requires low-privilege access and may impact confidentiality, integrity, and availability of internal assets.
A security vulnerability in orionsec orion-ops (CVSS 4.3). Risk factors: public PoC available.
We are tasked with analyzing CVE-2025-13811 and producing a JSON object with the specified fields. We must synthesize multiple intelligence sources. Here's the data we have: - CVE ID: CVE-2025-13811 - Description: Affects jsnjfz WebStack-Guns 1.0, file PageFactory.java, argument 'sort' leads to SQL injection. Remote attack possible, exploit publicly disclosed, vendor contacted but no response. - CVSS Score: 2.1 (but there is a CVSS v4.0 vector, note: CVSS v4.0 vector doesn't map to a 2.1 score; maybe it's a typo or they provided a vector with base score? CVSS v4.0 vector provided but with all base metrics set to X? Wait, the vector is: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. That includes AV:N, AC:L, AT:N, PR:L, UI:N, VC:L/VI:L/VA:L, SC:N/SI:N/SA:N. The base score for that would be: using CVSS 4.0 calculator, AV:N (network), AC:L (low attack complexity), AT:N (no attack requirements), PR:L (low privileges required), UI:N (no user interaction), VC:L (low impact on confidentiality), VI:L (low impact on integrity), VA:L (low impact on availability), SC:N, SI:N, SA:N. The base score would be 2.3? Actually, let's compute: Base Score = likelihood subscore + impact subscore. Likelihood subscore: [8.1 - (0.0+0.0+0.0+0.2+0.0)] = 7.9? I need to recall CVSS 4.0 formula. Simpler: use the fact that the given score is 2.1, but that might be the CVSS v2 or v3 score. Actually, they provided "CVSS Score: 2.1" but also a CVSS v4.0 vector. It might be that the CVSS v4.0 vector's base score is 2.3, but they approximated as 2.1? Either way, the vector indicates network attack vector with low privileges, low attack complexity, no user interaction, and low impact on confidentiality, integrity, and availability. Exploit maturity: P (proof-of-concept). So we'll use this for our assessment. - EPSS Score: 0.04% (percentile 12%) very low probability of exploitation. - POC/Exploit: Publicly available. Tags: SQLi, Java. - KEV: Not mentioned, so NO. - Patch: Not available, vendor unresponsive. - CPE: cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:* - References include GitHub POC, VulDB entries. We need to construct a JSON with the required fields. Each field is a string (paragraph). Let's go through each field: 1. "product_name": "1-3 words ONLY. The specific product or service name affected. Pick primary one: 'WebStack-Guns'" (since jsnjfz is the organization). "WebStack-Guns" is the product name. So product_name: "WebStack-Guns" 2. "summary": 2-3 sentence plain-language summary. Must not copy description. Start with impact verb and product. Exploitation conditions: it's an SQL injection in PageFactory.java 'sort' argument. The vector indicates low privileges required, network exploitation. Exploit available publicly. Vendor unresponsive. EPSS low. So summary: "SQL injection in WebStack-Guns 1.0 allows remote authenticated attackers to manipulate database queries via the 'sort' parameter in PageFactory.java. Exploit code is publicly available, but the vulnerability has low EPSS score and limited real-world impact due to low privilege requirements and low C/I/A impacts. Vendor has not responded to disclosure." 3. "technical_context": Explain technology/library/protocol involved. CWE-74 is improper neutralization of special elements in output used by a downstream component ('Injection'). Since it's Java and SQL injection, likely uses mybatis or JDBC where user input is not parameterized. File: PageFactory.java, constant factory. So we'll mention Java-based web application, likely uses MyBatis or JDBC, argument 'sort' inadvertently concatenated into SQL. Use CPE to identify exact affected product. State that the vulnerability is an SQL injection in the sort parameter of a page factory class. 4. "risk_assessment": CVSS v4.0: AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, base score about 2.3. EPSS 0.04% (12%), low probability. POC available, but not in KEV. Low impact on confidentiality, integrity, availability. So real risk is low. Also note that the attack requires low privileges, which limits exploitation to authenticated users. So the risk is low. Mention that the PR:L indicates that an attacker needs some authenticated access, so it's not remote unauthenticated. The vendor hasn't responded, so no patch. Contrast the CVSS severity (Low) with the low EPSS; all signals point to low priority. Include that. 5. "affected_products": List affected products: jsnjfz WebStack-Guns version 1.0. Use CPE string. There is a vendor advisory? VulDB links may serve as advisory. So write: "jsnjfz WebStack-Guns version 1.0 is affected (cpe:2.3:a:jsnjfz:webstack-guns:1.0:*:*:*:*:*:*:*). The vulnerability is documented in VulDB entry 333821 and a GitHub proof-of-concept report. No official vendor advisory is available." 6. "remediation": No patch available. Suggest compensating controls: Since SQL injection in sort parameter, input validation, use parameterized queries, or deploy a Web Application Firewall to block malicious sort inputs. Also consider restricting access to the affected endpoint if possible. As no fix version, say "No vendor-released patch is available. Mitigations include validating and sanitizing the 'sort' parameter to allow only expected values, using prepared statements, or deploying a WAF rule to block SQL injection attempts. Restrict access to the affected functionality to trusted users only." 7. "exploit_scenario": Attack scenario: Given PR:L, attacker needs authenticated access with low privileges. They send a crafted request to the endpoint that processes the sort parameter, injecting SQL, potentially reading or modifying database contents. Since VC/VI/VA are low, impact is minor. Mention POC available. So: "An authenticated attacker with low privileges sends a malicious HTTP request containing a crafted sort parameter. The injected SQL is executed, leading to potential low-level data leakage or modification." 8. "exploitation_conditions": From description, the unknown code in PageFactory.java and argument sort. The CVSS vector indicates PR:L, so exploitation requires low-level authentication. So conditions: attacker must be authenticated with low privileges and the application must use the unsanitized sort argument in SQL. No other special configuration noted. So: "Exploitation requires authentication as a low-privileged user on WebStack-Guns 1.0. The vulnerable 'sort' parameter must be processed by the PageFactory class without input sanitization." 9. "attack_chain": We need steps separated by arrows. Based on description: network access -> send crafted sort param -> SQL injection -> data manipulation/disclosure. Since PR:L, need to authenticate first. So: "Authenticate to application as low-privileged user → Identify vulnerable PageFactory endpoint → Send HTTP request with malicious sort parameter → SQL injection executes → Read or modify database records (low impact)." 10. "confidence_notes": Data completeness: exploit confirmed by public POC on GitHub, vendor contacted but no response, so no official patch. CVSS vector provided by VulDB, so confidence in the vector is high? But note the CVSS v4.0 vector is from VulDB, and NVD might not have analyzed it yet. The EPSS is from FIRST. So: "Exploit publicly available via GitHub POC. CVSS v4.0 base metrics and impact confirmed by VulDB. No vendor advisory or fix. The low impact ratings (VC:L, VI:L, VA:L) suggest limited severity despite the SQL injection nature." 11. "prevalence": One word. WebStack-Guns is a niche web stack management tool. Not widely known. Likely low adoption. So "low". 12. "prevalence_basis": Short justification: "Niche web management framework, limited adoption." So: "Niche web framework with limited enterprise deployment." 13. "assessed_cvss_vector": Our own independent CVSS 3.1 vector based on description and conditions. Let's map: AV:N (network attack), AC:L (low complexity), PR:L (low privileges), UI:N (no user interaction), S:U? The description says it's a manipulation of argument sort leading to SQL injection, no mention of scope change. So S:U. C:L/I:L/A:L? The CVSS v4.0 gave VC:L/VI:L/VA:L, so low impact. In CVSS 3.1, low means partial. So C:L/I:L/A:L. So CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. That would be base score 6.3 (medium). But the v4.0 score was low. Actually, in CVSS 4.0 low impact scores lead to low base score because impact is much lower. So in 3.1, the low impacts still give a medium score. But the description might actually allow full database access? The description doesn't specify magnitude, but the v4.0 vector gave low impacts. We'll stick with that. So the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. But we need to justify: It's a SQL injection with network vector, low complexity, low privileges, no user interaction, unchanged scope, low confidentiality, integrity, availability impact. So rationale: "Requires low privileges (PR:L) and network access; low impact assumed due to limited data exposure." 14. "assessed_cvss_rationale": one sentence. "Network-exploitable with low privileges; low impact assumed from description and similar CVSS scores." Or "SQL injection with low complexity, low privileges; limited to low data impact." So: "Low attack complexity and privileges; limited confidentiality, integrity, and availability impact based on vulnerability report." 15. "assessed_cvss40_vector": We'll use the provided v4.0 vector as base, but we must ensure it's consistent with our 3.1 assessment. The v4.0 vector provided actually has AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N. That's the base vector. That's already the vector we'd use. So we can output that. But if we need to provide our own independent one, it's the same. So: "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N" Now, assemble the JSON. All fields strings, no arrays. Make sure not to copy description, original synthesis. Use the terms as per rules: exploitation conditions, confidence, etc. For prevalence, we said low, basis: "Niche web framework with limited enterprise deployment." Risk assessment: must contrast CVSS score (low base score in v4.0) with EPSS (low). The v4.0 score was 2.3, but v3.1 would be 6.3, but the provided score is 2.1 (likely they computed v4.0 base). So we'll mention that the CVSS v4.0 base score is low (2.3), indicating low severity, EPSS very low, no active exploitation, no KEV. So risk is low. Patch missing but impact limited. Remediation: note that vendor did not respond so no patch, suggest parameterized queries, WAF, restrict access. Also mention that since PR:L, only authenticated users can exploit, so limiting access further reduces risk. Attack chain: I'll structure as: "Authenticate as low-privileged user → Locate vulnerable endpoint → Send crafted HTTP request with malicious sort parameter → SQL injection modifies query logic
Information disclosure in NutzBoot 2.6.0-SNAPSHOT allows remote attackers with low privileges to access sensitive Ethereum wallet data via a manipulation of the EthModule.java endpoint. Public exploit code is available, but no active exploitation has been confirmed; EPSS estimates very low exploitation probability (0.04%).
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Server-side request forgery in deco-cx apps 0.120.1 and earlier allows a low-privileged remote attacker to manipulate the `url` parameter in the AnalyticsScript loader, forcing the server to fetch arbitrary URLs. This can result in low-impact information disclosure, internal network reconnaissance, or interaction with internal services. A public exploit exists, but there is no evidence of active exploitation (EPSS 0.05%); upgrading to version 0.120.2 removes the vulnerable parameter.
Cross-site scripting in jairiidriss RestaurantWebsite allows remote attackers to inject arbitrary web scripts via the selected_date parameter in the Make a Reservation component. The vulnerability has a low CVSS 4.0 base score and an EPSS score of 0.04%, indicating low exploitation likelihood, but public exploit code exists. User interaction is required to trigger the script execution.
Uncontrolled memory allocation in Python's plistlib module allows a crafted binary plist file to cause out-of-memory (OOM) exhaustion in any Python process that parses it. The module reads data blocks sized according to values embedded in the plist file itself, with no cap or validation against actual available data; a malicious file can specify sizes up to 2^64 bytes, triggering allocations that exhaust process or system memory. Affected CPython versions span all major release lines prior to the fixed releases (3.10.20, 3.11.15, 3.12.13, 3.13.10, 3.14.1, 3.15.0a3); no public exploit or CISA KEV listing exists, and EPSS is extremely low at 0.03%.