Stack-based buffer overflow in the HTTP request handler of the Tenda WH450 router (firmware 1.0.0.18) lets a remote attacker corrupt memory by sending a crafted request to /goform/DhcpListClient with a manipulated 'page' parameter, with high confidentiality, integrity and availability impact on the device. Publicly available exploit code exists, including a GitHub proof-of-concept with full reproduction steps, so the barrier to exploitation is low; there is no CISA KEV listing, meaning confirmed active exploitation in the wild has not been established. The vendor-supplied CVSS 4.0 vector advertises an unauthenticated attack (PR:N, base 8.9), but our independent assessment scores it AV:N/AC:L/PR:L/UI:N (CVSS 3.1, all-high impact) because the DHCP client-list endpoint may sit behind the router admin session - if so, valid credentials or an authenticated session are required, and practical exposure is largely limited to attackers on the same LAN unless the web UI is deliberately exposed to the WAN.
Command injection in the DHCP daemon of D-Link DIR-860L B1 and DIR-868L B1 routers running firmware 203b01/203b03 allows an attacker who can reach the device on the same broadcast domain to execute arbitrary shell commands as root by supplying a crafted Hostname (DHCP option 12) string in a DHCP request. Exploitation requires LAN adjacency rather than Internet reachability - DHCP is not routable, so the source data's 'remote' label is constrained to local-network delivery - but needs no authentication and no user interaction against a default-running service (our assessment vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. high confidentiality, integrity and availability impact). Publicly available exploit code exists and is linked from the references, EPSS is 3.80% (90th percentile), and there is no CISA KEV entry or other confirmation of active in-the-wild exploitation; no vendor-released patch has been identified, and both models are end-of-life hardware revisions.
Stack-based buffer overflow in the Tenda AC20 router running firmware 16.03.08.12 allows a remote attacker to overwrite stack memory by sending a crafted rebootTime value to the formSetRebootTimer handler behind /goform/SetSysAutoRebbotCfg, leading to a daemon crash and potential arbitrary code execution in the httpd process. Publicly available exploit code exists, so any unit whose web management interface is reachable from an untrusted network should be treated as at risk. The flaw carries a CVSS 4.0 base score of 7.4 with exploit maturity E:P; the supplied vector indicates low-privilege authentication (PR:L) and no user interaction, but authentication requirements are not confirmed by the description, and this bug class is frequently pre-authentication on Tenda devices, so the true prerequisite should be verified against the firmware.
A stack-based buffer overflow in the httpd component of Tenda AC20 firmware 16.03.08.12 allows a remote attacker to overwrite memory on the stack by submitting an oversized 'list' argument to the /goform/setPptpUserList endpoint, which is processed by the formSetPPTPUserList function. Based on the CVSS vector the attacker must first authenticate with at least low-privilege credentials (PR:L) and be able to reach the device's web-management interface, which is normally confined to the LAN unless remote management is enabled or the router is directly exposed. Publicly available exploit code exists (a public write-up with proof-of-concept is linked from the NVD references), and EPSS assigns a 3.33% exploitation likelihood (88th percentile), but there is no confirmed active exploitation (CISA KEV) and no vendor-released patch identified at the time of analysis.
Stack-based buffer overflow in the Tenda AC20 router (firmware 16.03.08.12) allows an authenticated attacker who can reach the device's management web interface to corrupt memory and potentially execute code or crash the httpd service by sending an oversized schedStartTime or schedEndTime value to the /goform/openSchedWifi endpoint. The issue carries a CVSS 4.0 score of 7.4 (E:P) and our independent assessment scores it CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity and availability impact once a low-privilege session is established. Publicly available exploit code exists, though EPSS is low at 0.74% (53rd percentile) and there is no confirmed active exploitation (not listed in CISA KEV).
Remote heap-based buffer overflow in Exim before 4.99.1 allows an unauthenticated attacker to corrupt memory when the server runs certain non-default rate-limit configurations, potentially achieving code execution or denial of service. The published CVSS is 9.8, but the independent assessment sets attack complexity to High because exploitation hinges on the non-default rate-limit setup and default installations are not exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Heap-based buffer overflow in snap7-rs up to version 1.142.1 allows remote attackers to corrupt memory via crafted S7 write requests to the S7Client::as_ct_write function. Public exploit code exists, but EPSS score is low (0.09%) and no active exploitation has been confirmed (KEV not listed). The vulnerability poses a moderate risk of denial of service or potential code execution in industrial automation environments using this Rust S7 library.
Heap-based buffer overflow in gmg137 snap7-rs library up to version 1.142.1 allows remote attackers to corrupt heap memory via the TSnap7MicroClient::opWriteArea function. The vulnerability requires no authentication or user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N) and a public exploit is available, though the EPSS score is low at 0.09%, suggesting limited active exploitation at this time.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate the stud_id parameter in /admin/delete_student.php, potentially leading to unauthorized database access or data manipulation. The vulnerability has a publicly available exploit and affects the code-projects application. No vendor patch is available at this time.
SQL injection in Student File Management System 1.0 allows remote attackers to manipulate database queries via the user_id parameter in /admin/delete_user.php. The vulnerability can lead to unauthorized access or modification of data, and publicly available exploit code exists, though no active exploitation has been confirmed.
SQL injection in Student File Management 1.0 via /admin/save_student.php enables remote, unauthenticated attackers to manipulate the database through the stud_no parameter. Publicly available exploit code exists, but the vulnerability is not listed in CISA KEV, and the low EPSS score (0.07%) indicates limited exploitation risk. The impact is limited to low confidentiality, integrity, and availability compromises.
SQL injection in Campcodes Advanced Online Examination System 1.0 allows remote attackers to manipulate the Username argument in /query/loginExe.php to inject malicious SQL. This can lead to unauthorized data access or modification. A public proof-of-concept is available, but EPSS indicates low exploitation probability.
SQL injection in COVID Tracking System 1.0 allows remote unauthenticated attackers to manipulate the meta_value argument in /admin/?page=system_info to execute arbitrary SQL commands. Exploit code is publicly available, though EPSS indicates low exploitation probability, consistent with the product's limited deployment footprint.
SQL injection vulnerability in itsourcecode COVID Tracking System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL queries via the Username parameter in /admin/?page=user. Exploit code is publicly available, making exploitation straightforward, though no active exploitation has been reported by CISA. The impact is rated low, potentially allowing limited data disclosure or modification.
SQL injection in Campcodes Supplier Management System 1.0 allows remote attackers to execute arbitrary SQL commands through the chkId[] parameter in /admin/view_unit.php. The vulnerability can be exploited without authentication to access or modify database contents. Exploit code is publicly available, but no active exploitation has been confirmed as of this analysis.
SQL injection in itsourcecode Student Management System version 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the 'sy' parameter in the /advisers.php endpoint. A publicly available proof-of-concept exploit exists, though EPSS suggests low real-world exploitation activity (0.05%). No vendor advisory or patch has been independently confirmed at this time.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in the /addrecord.php endpoint. Public exploit code is available, but no active exploitation is confirmed (not listed in CISA KEV). The vulnerability can lead to unauthorized data access or modification.
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the ID parameter of the /admindetail.php?action=edit endpoint, potentially leading to low-impact data exposure or modification. A publicly available proof-of-concept exploit exists, though EPSS indicates low exploitation probability (0.05%).
SQL injection in itsourcecode Online Cake Ordering System 1.0 allows remote unauthenticated attackers to manipulate database queries via the 'Product' parameter of /cakeshop/product.php. Publicly available exploit code exists, though EPSS indicates low probability of widespread exploitation. No vendor patch is available.
SQL injection in Online Cake Ordering System 1.0 allows remote attackers to manipulate database queries through the supplier parameter in /cakeshop/supplier.php. This can lead to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been reported.
SQL injection in Computer Book Store 1.0 allows remote unauthenticated attackers to manipulate the database via the /admin_delete.php script. A publicly available exploit exists (GitHub issue), but the low EPSS score (0.05%) suggests limited real-world targeting. No active exploitation has been confirmed by CISA KEV.
SQL injection in itsourcecode Student Management System 1.0 allows remote attackers to manipulate database queries via the ID parameter in /update_subject.php. Exploit code is publicly available, though no active exploitation has been confirmed (EPSS: 0.05%).
SQL injection in Simple Attendance Record System 2.0 allows remote attackers to manipulate database queries via the 'student' parameter in /check.php, leading to unauthorized data access or modification. A public proof-of-concept exploit is available, though no active exploitation has been reported. The vulnerability can be triggered without authentication or user interaction.
SQL injection in itsourcecode Student Management System 1.0 via the ID parameter of /uprec.php allows remote unauthenticated attackers to execute arbitrary SQL commands, potentially reading or modifying the application database. A publicly available proof-of-concept exploit exists, but no active exploitation has been confirmed, and the EPSS score (0.05%) suggests low likelihood of widespread attacks.
SQL injection in itsourcecode Online Pet Shop Management System 1.0 allows remote attackers to manipulate the ID parameter in /pet1/update_cnp.php, potentially leading to unauthorized data access or modification. A publicly available exploit exists, though no active exploitation has been confirmed. EPSS indicates low exploitation probability (0.05%).
NXLog Agent versions before 6.11 honor the OPENSSL_CONF environment variable when initializing its OpenSSL runtime, allowing a local attacker who can control that variable to point the agent at a malicious configuration file that loads arbitrary engines or providers, which amounts to code execution in the agent's security context. The flaw is a CWE-829 configuration-injection issue with a local-only vector and high attack complexity, and it is most dangerous where the agent service runs with higher privileges than the attacker, creating a privilege-escalation path; it cannot be reached over the network. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, and the EPSS score of 0.12% (2nd percentile) indicates low predicted exploitation activity.
Unauthenticated SQL injection in the wpForo Forum plugin for WordPress (all versions through 2.4.12) allows remote attackers to append arbitrary SQL to the plugin's existing queries via the post_args and topic_args parameters, exposing sensitive database contents such as user credentials and secrets. The flaw is network-reachable and needs no authentication or user interaction (CVSS 7.5, PR:N/UI:N), requiring only that the plugin be installed, active, and its forum/topic pages reachable - default installations are affected, and exploitation is limited to confidentiality impact (no data modification or direct site takeover, though harvested credentials could enable follow-on compromise). No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is modest (0.38%, 29th percentile), making this a credible but not emergency-level priority.
Stored cross-site scripting in the WordPress plugin Addon Elements for Elementor (all versions up to and including 1.14.3) allows authenticated attackers holding Contributor-level privileges or above to inject arbitrary JavaScript through multiple widget parameters, which then executes when any user - including administrators - views the affected page. Exploitation is authentication-gated and requires the plugin to be installed with one of the affected widgets placed on a page the attacker can edit, so sites that do not grant untrusted users Contributor rights are largely unexposed. Risk is moderate: EPSS is only 0.23% (13th percentile), there is no CISA KEV listing, and no public exploit code identified at time of analysis, though the upstream code change tied to this issue is visible in the public plugin repository.
Cross-site scripting in Mayan EDMS 4.10.1 and earlier allows remote unauthenticated attackers to inject scripts via the /authentication/ endpoint. Exploiting this vulnerability could enable session hijacking or phishing if a victim visits a malicious link. Public exploit code is available, but no active exploitation is confirmed.
Command injection in DedeBIZ up to version 6.5.9 allows authenticated high-privilege administrators to execute arbitrary system commands via the /src/admin/catalog_add.php endpoint. The vulnerability requires high-privilege authentication (PR:H in CVSS v4.0) and has publicly available exploit code, but real-world risk is constrained by the authentication requirement and limited scope of impact (CVSS 2.0, EPSS 0.28%).
Unrestricted file upload in Computer Laboratory System 1.0 via the technical_staff_pic.php file allows high-privilege users to upload arbitrary files to the server. The vulnerability requires administrator-level access (PR:H) and affects confidentiality, integrity, and availability with low impact scope. Publicly available exploit code exists; however, the EPSS score of 0.07% (21st percentile) and high-privilege requirement significantly limit real-world exploitation risk compared to the CVSS 2.0 baseline.
Unrestricted file upload in Computer Laboratory System 1.0 via the admin_pic.php image parameter allows high-privilege authenticated users to upload arbitrary files remotely, with publicly available proof-of-concept code demonstrating exploitation. Despite the CVSS 2.0 score reflecting the high authentication barrier (PR:H), the vulnerability enables attackers with admin credentials to bypass upload restrictions and potentially establish persistence or execute malicious code on the server.
Cross-site scripting (XSS) in code-projects Student File Management System 1.0 allows high-privilege users to inject malicious scripts via the /admin/update_student.php endpoint, requiring user interaction to execute. The vulnerability has low real-world impact (CVSS 1.9, EPSS 0.06%) despite publicly available exploit code, as it demands high administrative privileges and user action; however, the low exploitation threshold (EPSS percentile 18%) indicates this is not a widespread threat.
Cross-site scripting vulnerability in code-projects Student File Management System 1.0 allows high-privilege authenticated users to inject malicious scripts via the Update User Page at /admin/update_user.php, requiring user interaction to trigger. The exploit is publicly available and rated CVSS 1.9 due to restrictive privilege and UI requirements, though EPSS score of 0.05% indicates minimal real-world exploitation risk.
Kubernetes' kube-controller-manager contains a half-blind server-side request forgery that allows highly privileged users to leak information from control-plane host-network endpoints when the deprecated in-tree Portworx provisioner is used. Exploitation requires a non-default Portworx StorageClass and an authorized attacker (PR:H) who can influence provisioning parameters, with high attack complexity (AC:H) and impact limited to confidentiality (CVSS 5.8). No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated settings reset in the HelloLeads CRM Form Shortcode WordPress plugin (versions through 1.0) allows any remote actor who can reach an affected site to wipe or reconfigure the plugin's stored settings without logging in and without any victim interaction, because the reset routine performs neither a capability check nor a CSRF nonce validation. The impact is confined to the plugin's own configuration: the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3) shows no confidentiality loss and no availability impact on the wider WordPress installation, making this a genuine but low-severity high-reach/low-impact defect. There is no CISA KEV listing, no public exploit identified at time of analysis, and EPSS is 0.14% (3rd percentile), reflecting the plugin's narrow deployment footprint; the weakness is notable mainly because the CSRF tag and PR:N/UI:N vector mean the reset can be triggered directly rather than via a tricked administrator.
SnailJob (aizuda snail-job), a Java-based distributed job scheduling platform, up to and including version 1.6.0 contains an injection flaw in QLExpressEngine.doEval, where attacker-supplied input is passed into the QLExpress expression engine without adequate neutralization (CWE-74). An attacker who is authenticated to the SnailJob console (CVSS PR:L) and can reach a feature that evaluates user-controlled QLExpress expressions - for example job workflow/decision or routing expression fields - can inject expression syntax remotely with no user interaction, achieving limited confidentiality, integrity, and availability impact as scored by the vendor (VulDB CVSS 4.0 base 5.3, Medium; independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No public exploit code has been identified at time of analysis, and the issue is fixed by upgrading to version 1.7.0-beta1 (commit 978f316c38b3d68bb74d2489b5e5f721f6675e86).
Denial of service in Sequoia PGP before 2.1.0 allows a remote, unauthenticated attacker (CVSS vector PR:N) to crash any application built on the sequoia-openpgp crate by sending a victim an OpenPGP message whose PKESK or SKESK session-key packet carries an AES key-wrap ciphertext that is shorter than the algorithm requires; the undersized input drives aes_key_unwrap into a panic. Exploitation is constrained by user interaction (UI:R) - the target must actually attempt to decrypt or otherwise process the malicious message - and impact is limited to availability, with no code execution, data disclosure, or integrity loss. This is a moderate-severity availability issue rather than a high-priority emergency, and no public exploit identified at time of analysis; Sequoia 2.1.0 contains the upstream fix.
MJML through 4.18.0 contains a path traversal in the mj-include directive that allows an attacker to probe for file existence and, when type="css" is used, read local files. The flaw is an incomplete fix for CVE-2020-12827 and carries a low severity (CVSS 4.5) with a local attack vector (AV:L), high complexity (AC:H), and low confidentiality impact as assessed (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N). No public exploit code is known at time of analysis, and exploitation requires a deployment where the MJML compiler processes attacker-influenced markup, meaning the practical risk is limited to services that accept untrusted MJML input.
Improper access controls in DecoCMS Mesh up to 1.0.0-alpha.31 allow remote attackers to manipulate the domain argument in the createTool function of the Workspace Domain Handler, resulting in unauthorized information disclosure. The vulnerability requires high attack complexity and has published exploit code available, though real-world exploitation appears difficult. CVSS score of 2.9 reflects low severity with limited confidentiality impact, while EPSS scoring at 25th percentile suggests minimal real-world exploitation probability.
MartialBE one-hub up to version 0.14.27 uses a hard-coded cryptographic key in the SESSION_SECRET environment variable of its default docker-compose.yml configuration, allowing remote attackers to potentially decrypt or forge session tokens with high attack complexity. The vulnerability requires non-standard deployment configurations and affects confidentiality rather than integrity or availability. Exploit code has been disclosed publicly, though active exploitation remains unconfirmed by CISA, and the vendor explicitly recommends against using the default Docker Compose example in production environments.
Stack exhaustion from uncontrolled recursion in uriparser through 0.9.9 allows a crash (denial of service) when an application passes an over-long or crafted URI - such as a path segment containing many commas - into the library's parsing routines. The flaw is rated low severity (CVSS 3.1 base 2.9 from NVD, assessed here as AV:N/AC:L/PR:N/UI:N with only availability impact), requires no authentication at the library level, and is reachable only when the embedding application does not cap URI length before calling uriParseUriA/uriParseSingleUri and related entry points. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; an upstream fix exists in PR/284, which removes all 13 recursion cases, but a released patched version is not independently confirmed.