Improper control of dynamically-identified variables in youlai-mall 1.0.0/2.0.0 allows authenticated low-privilege users to read or modify other users’ address data via the /mall-ums/app-api/v1/addresses/ endpoint. Public exploit code is available, though no evidence of active exploitation exists at this time. The vendor was notified but did not respond.
A security vulnerability in macrozheng mall-swarm (CVSS 5.4). Risk factors: public PoC available.
Server-side request forgery in XunRuiCMS up to 4.7.1 allows authenticated high-privilege attackers to make arbitrary server-side requests via the Email Setting Handler. A publicly available proof-of-concept exists, but exploitation requires administrative access to the CMS admin panel. No active exploitation has been confirmed and EPSS indicates a very low likelihood of widespread exploitation.
Server-side request forgery in dayrui XunRuiCMS up to 4.7.1 allows authenticated administrators to force the server to make arbitrary network requests via the ‘v’ parameter in the Project Domain Change Test API endpoint. Exploit code is publicly available, but exploitation requires high privileges, significantly limiting real-world risk.
Cross-site scripting in XunRuiCMS up to 4.7.1 allows remote attackers to inject arbitrary web script via the data[name] parameter in the Add Data Validation Page. The vulnerability requires low-privileged access and user interaction to trigger. Publicly available exploit code exists, but no active exploitation has been confirmed (EPSS 0.04%).
SQL injection in JIZHICMS up to version 2.5.5 allows remote authenticated attackers to execute arbitrary SQL commands via the batch comment deletion functionality, potentially leading to data manipulation or unauthorized access to the database. A public proof-of-concept exploit is available, and the vendor has not released a
SQL injection in JIZHICMS up to 2.5.5 allows remotely authenticated attackers with high privileges to execute arbitrary SQL commands via the 'aid' or 'tid' parameters in the comment administration interface. Successful exploitation could lead to unauthorized reading or modification of database contents. Public exploit code is available, but no active exploitation is confirmed, and EPSS predicts very low exploitation probability.
Stored cross-site scripting in JIZHICMS up to version 2.5.5 enables authenticated administrators to inject JavaScript into the comment body field, leading to script execution in other users' browsers. A public proof-of-concept exploit exists, but EPSS indicates low exploitation probability and the vulnerability is not listed in CISA KEV. No vendor patch has been released.
Stored cross-site scripting in XunRuiCMS 4.7.1 and earlier allows authenticated administrators to inject arbitrary JavaScript via the 'data[name]' parameter in the Add Display Name Field component. A public proof-of-concept exploit exists, but active exploitation has not been confirmed and EPSS estimates a low probability of exploitation.
Cross-site scripting (XSS) vulnerability in XunRuiCMS up to 4.7.1 allows authenticated high-privileged attackers to inject arbitrary scripts via the domain name binding page. The attack requires high complexity and user interaction, reducing realistic exploitation risk. A public exploit exists but active exploitation is not confirmed (not in KEV) and EPSS score is low.
Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit web requests to an API endpoint that would expose sensitive user information. This issue affects CareLink Network: before December 4, 2025.
A remote code execution vulnerability in Anthropic Sandbox Runtime (CVSS 1.8) that allows sandboxed code. Remediation should follow standard vulnerability management procedures.