SQL injection vulnerability in the Broken Link Checker SEO WordPress plugin up to version 1.2.6 allows authenticated administrators to execute arbitrary SQL commands, potentially exposing sensitive information from the database. The flaw, tracked as CVE-2025-67962, carries a CVSS 3.1 base score of 7.6 from Patchstack but is limited to high-privileged users, and no public exploit code or active exploitation (KEV) has been observed. The low EPSS score of 0.06% further suggests minimal real-world exploitation probability at this time.
Blind SQL injection in the Newsletter plugin for WordPress up to
Remote denial-of-service in the Linux kernel's libceph (Ceph client) module allows a malicious or compromised Ceph OSD/monitor to crash the kernel by sending OSDMap packets containing out-of-bounds OSD indexes. Because libceph previously used BUG_ON assertions on OSD index values drawn directly from untrusted network data, an attacker-controlled index exceeding map->max_osd triggers a kernel panic. This is a fixed issue with upstream stable-tree commits; no public exploit has been identified and EPSS exploitation probability is low (0.17%, 7th percentile).
Denial of service in the Linux kernel's NVMe multipath subsystem allows a lockdep-detected deadlock among disk->open_mutex, the kblockd workqueue, and partition_scan_work completion, which can hang block-device operations. The fix moves partition_scan_work off the kblockd workqueue onto nvme_wq to break the lock-dependency cycle. No public exploit identified at time of analysis; the issue surfaces intermittently during NVMe partition scanning on systems using NVMe multipath.
Denial of service in the Linux kernel IPv4 routing subsystem allows a permanent device reference-count leak through a race condition in FIB next-hop exception (fnhe) handling. On systems using tunnel drivers such as sit or gretap, concurrent transmit paths can bind a soon-to-be-freed fnhe to a new dst, leaking the dst and its device reference so the interface can never be unregistered (visible as 'unregister_netdevice: waiting for sitX to become free'). This is availability-only, has no public exploit identified at time of analysis, and carries a low EPSS score of 0.17%.
Denial-of-service hardening in the Linux kernel's page_pool subsystem addresses noisy allocation-failure handling on the network receive datapath. Because driver authors frequently omit GFP_NOWARN, ATOMIC page allocations that fail under memory pressure emit full allocation-failure warnings/backtraces; the fix makes page_pool add GFP_NOWARN by default for ATOMIC allocations. Rated CVSS 7.5 for availability impact only (C:N/I:N), with no public exploit identified at time of analysis and a low EPSS score (0.17%, 6th percentile).
Denial of service in the Linux kernel's Samsung sxgbe 10G Ethernet driver stems from a NULL pointer dereference in sxgbe_rx(), where the receive path logs an error when an skb is NULL but then dereferences that same NULL skb on the following line. The fix adds a 'break' so the code falls through to sxgbe_rx_refill() instead of crashing, mirroring the handling already used by other NIC drivers such as Calxeda's xgmac_rx(). There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 6th percentile); the bug was found during code review rather than in-the-wild.
Denial of service in the Linux kernel's lan966x Ethernet switch driver (Microchip LAN966x SoC) allows a potential deadlock and kernel warning when network statistics are read while holding an atomic context. The driver incorrectly used a sleeping mutex (lan966x_stats_get) inside an atomic/spinlock-held path, tripping a 'sleeping function called from invalid context' BUG and risking system instability; the fix replaces the mutex with a spinlock. No public exploit identified at time of analysis, and the EPSS score is negligible (0.16%, 6th percentile).
Remote unauthenticated denial of service in the Linux kernel's ksmbd in-kernel SMB server allows an attacker to exhaust kernel socket resources by repeatedly tripping the per-IP connection limit. When ksmbd_kthread_fn() rejects a connection that exceeds the per-IP limit, it sets ret = -EAGAIN and continues the accept loop without releasing the just-accepted socket, leaking one socket per rejected attempt from a single source IP. This is a resource-leak DoS with no public exploit identified at time of analysis and a low EPSS score (0.16%, 6th percentile).
Memory corruption (use-after-free) in the Linux kernel's Intel iwlwifi wireless driver, specifically in iwl_mld_remove_link(), where the code frees the 'link' object via kfree_rcu() and then dereferences it to read link->fw_id. On systems with Intel WiFi hardware using the newer MLD (multi-link device) code path, a triggered link-removal race can access freed memory, most likely crashing the kernel (denial of service) with only a theoretical path to further corruption. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS probability is low (0.16%, 6th percentile).
Denial of service in the Linux kernel's veth (virtual Ethernet) driver allows a permanently stalled transmit queue and halted network traffic once a lost-wakeup race is triggered under load. The flaw is a regression introduced by commit dc82a33297fc ('veth: apply qdisc backpressure on full ptr_ring'), where the producer in veth_xmit() misuses the __ptr_ring_empty() API to decide whether to re-wake a stopped TXQ; when a consumer on another CPU empties the ring concurrently, the wakeup is lost and the queue stays in QUEUE_STATE_DRV_XOFF. It was observed in production on ARM64 (Ampere Altra Max) systems. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and it is not in CISA KEV.
Local file inclusion in the Stockholm Core WordPress plugin (≤2.4.6) allows authenticated users with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation or public exploit code is known at this time, though the low EPSS score indicates limited real-world risk despite the high CVSS impact.
We need to construct a comprehensive analysis based on the provided CVE. Data: - CVE ID: CVE-2025-68065 - Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LiquidThemes Hub Core hub-core allows PHP Local File Inclusion. Affected Hub Core: from n/a through <= 5.0.8. - CVSS: 7.5, vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CWE: CWE-98 - EPSS: 0.08%, percentile 23% - Reported by: audit@patchstack.com - Tags: PHP, Information Disclosure, LFI - References: patchstack.com links. No KEV mentioned, no POC mentioned explicitly. Patchstack likely says it's a local file inclusion vulnerability (LFI). The description says "PHP Remote File Inclusion" but then says "allows PHP Local File Inclusion". Possibly a mix-up: the CWE-98 is about improper control of filename for include/require, leading to remote file inclusion or local file inclusion. The description says PHP Remote File Inclusion but then says "allows PHP Local File Inclusion". The tags say LFI. So likely it's a Local File Inclusion (LFI) vulnerability with potential for RFI? But the title says remote file inclusion. Could be that it's technically improper control of filename for include/require, which can lead to both RFI and LFI. But the patchstack report title says local file inclusion. I'll treat it as a local file inclusion vulnerability in the Hub Core plugin for WordPress. The CVSS vector implies AV:N (network), AC:H (high attack complexity), PR:L (low privileges required), UI:N, S:U, C:H/I:H/A:H. That's interesting: for an LFI, local file inclusion typically might lead to information disclosure (reading local files). But they've scored it with high integrity and availability impact as well. That could be if the included file may be executed, leading to arbitrary code execution, thus impacting all three aspects. Or it could be a remote file inclusion (RFI) if allow_url_include is on? But the description says "allows PHP Local File Inclusion". Might be a misnomer. I'll stick with the data. The EPSS is very low (0.08%), so low likelihood of exploitation. No KEV, no POC mentioned. Patchstack doesn't mention patch status explicitly? It says "from n/a through <= 5.0.8". So likely versions up to 5.0.8 are vulnerable, and presumably fixed in 5.0.9? However, no explicit fix version is provided. I'll need to check the references later but they are just links to patchstack. In the remediation field, I'll mention that the vendor should update, but exact fix version not provided. Possibly we can infer that fixed in version beyond 5.0.8, but we should be cautious. I'll say "patch available per vendor advisory (likely in version 5.0.9 or later)" but that's speculative. The instruction says: "If patch data says available but no version: 'Patch available per vendor advisory'". I have no explicit patch data saying available. The description says "from n/a through <= 5.0.8". That could mean the vulnerability exists in those versions and presumably higher versions are fixed. So I can say "Patch available: update to version 5.0.9 or later (exact fix version not confirmed by source)". The rule says: "Patch status: if input includes exact fix version: Vendor-released patch: [exact version]". Not there. If patch refs point to a PR/commit: not there. If patch data says available but no version: we can say that. So I'll check if the reference indicates patch: patchstack often says "fixed in version X". I'll examine the links. The links are patchstack.com/database/Wordpress/Plugin/hub-core/vulnerability/wordpress-hub-core-plugin-5-0-8-local-file-inclusion-vulnerability. So it's a vulnerability database entry. It might list fixed version. I can't fetch the page, but given typical patchstack entries, they list fixed version if known. But I'll assume that the patch is available in a later version and state that the vendor hasn't confirmed exact fix version. I'll be careful. Also, reported by audit@patchstack.com, so it's a researcher. No CISA KEV listing. No EPSS high. So risk: likely a niche WordPress plugin, limited exploitation probability. Prevalence: LiquidThemes Hub Core is a commercial WordPress theme's core plugin? Hub is a theme by LiquidThemes, so this core plugin is likely installed with the Hub theme. WordPress plugin hub-core. How widely used? Unknown, but probably not extremely widespread. I'll estimate prevalence as "low" (niche theme plugin). Basis: "commercial theme plugin with limited install base". Now construct JSON fields. product_name: "Hub Core" (the plugin name). Or "LiquidThemes Hub Core"? The description says "LiquidThemes Hub Core hub-core". So I'll use "Hub Core". summary: Start with impact verb and product. "Local file inclusion in Hub Core plugin for WordPress allows authenticated attackers to read local files, potentially leading to complete system compromise." Since CVSS has PR:L, authenticated. And AC:H, so it's complex. So: "Local file inclusion (LFI) in the Hub Core plugin for WordPress (versions <=5.0.8) enables authenticated users (subscriber-level or higher) to read arbitrary local files on the server, possibly executing malicious PHP code to achieve remote code execution, impacting confidentiality, integrity, and availability. No known active exploitation, EPSS score very low." technical_context: Explain CWE-98, PHP include/require with user-controlled filename, and how LFI works. The plugin doesn't properly sanitize include path, allowing path traversal to include arbitrary local files. CPE not given but product is WordPress plugin. Mention PHP local file inclusion and possible RFI if allow_url_include is enabled but primary LFI. Reference CWE-98. risk_assessment: Assess CVSS vector: AV:N (network), AC:H (complex), PR:L (low priv, any logged-in user), UI:N, S:U, C:H/I:H/A:H. High impact on all. But EPSS 0.08% very low. KEV no, POC not indicated. SSVC: exploitation none, automatable maybe, technical impact total. So risk is moderate but not currently exploited. Compare: high CVSS but low EPSS suggests theoretical risk, not imminent. CVSS indicates network but requires low privileges, high complexity. Complexity likely from needing crafted payloads and specific conditions (allow_url_fopen off? or log poisoning? LFI requires some technique). So overall, real-world risk is low due to lack of exploitation and low prevalence. affected_products: "LiquidThemes Hub Core plugin for WordPress, all versions up to and including 5.0.8. CPE not specified, but applies to any WordPress site with the plugin installed. Vendor advisory at https://patchstack.com/database/wordpress/plugin/hub-core/vulnerability/wordpress-hub-core-plugin-5-0-8-local-file-inclusion-vulnerability." remediation: "Update the Hub Core plugin to version 5.0.9 or higher (exact patched version unconfirmed; check the plugin’s update history at Patchstack advisory). As a temporary workaround, disable the plugin if not essential, or restrict access to the affected endpoint by implementing IP allowlisting or removing low-privileged user accounts. Note that removing the plugin may break site functionality if the Hub theme depends on it." exploit_scenario: "An attacker with subscriber-level access to a WordPress site exploiting a vulnerable Hub Core plugin crafts a malicious request to a PHP file that processes user-supplied input for include/require directives, leveraging path traversal to include a local file such as /etc/passwd or a PHP file in /tmp/uploaded via other upload mechanisms, leading to arbitrary code execution." exploitation_conditions: "Requires authenticated low-privilege user (subscriber or above) on a WordPress site running Hub Core plugin <=5.0.8. The high attack complexity suggests the LFI vulnerability may need specific server configurations (e.g., PHP’s `allow_url_include` enabled for remote inclusion, though primary vector is local) or chaining with another technique like log poisoning to achieve code execution. No special network access beyond standard HTTP/HTTPS connectivity to the WordPress site." No generic. Mention authenticated, low priv, high complexity. attack_chain: "Authenticate as subscriber → Identify vulnerable endpoint → Craft HTTP request with path traversal in include path → Include arbitrary local file → Execute embedded PHP to escalate to code execution → Achieve full system compromise." 6 steps. Use kill chain. I'll produce: "Reconnaissance of target site → Authenticate as subscriber-level user → Deliver crafted HTTP request to vulnerable PHP file → Exploit improper filename sanitization to traverse directory → Include and execute arbitrary local file → Exfiltrate data or gain command execution" Simplify: "Authenticate as subscriber → Deliver crafted request with path traversal → Include local PHP file → Execute code as web server user → Further privilege escalation → Full system compromise." 7-step: Recon → Authenticate → Deliver request → Exploit filename control → Execute malicious code → Persist → Impact. I'll output: "Reconnaissance of target WordPress site → Authenticate as low-privilege user → Deliver HTTP request with crafted include path → Exploit improper filename control → Include and execute arbitrary local file → Escalate privileges or exfiltrate data → Achieve complete system compromise" But limited to 7 steps max. Good. confidence_notes: "Vulnerability reported by Patchstack, no CISA KEV entry. CVSS vector provided indicates authenticated and high complexity. No confirmed public exploit code; fixed version not explicitly stated—infer that patch is available in version after 5.0.8, but independent confirmation lacking." prevalence: "low" prevalence_basis: "commercial WordPress theme plugin, limited install base" assessed_cvss_vector: Should I use given CVSS? The instruction: "Your OWN independent CVSS 3.1 base-metric vector... grounded in description and exploitation conditions — NOT a copy of any score in the input." I need to reassess based on my understanding. Given LFI, typically CVSS might be AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N for info disclosure LFI. But they gave C:H/I:H/A:H. That implies code execution, i.e., the LFI leads to RCE. Is that reasonable? If the attacker can include arbitrary local files, they could include a file they've planted (e.g., via log poisoning, or via uploaded file) and execute code. That would justify all impacts. But it's high complexity. So I'd likely assign AV:N, AC:H (needs specific conditions like file upload capability), PR:L (low priv), UI:N, S:U, C:H, I:H, A:H (code execution). So I'll keep similar, but I might change UI to N (none) which matches given. Yes. So I'll keep: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. But I need to justify. rationale: "Requires low-privilege authentication and high complexity due to chaining with file upload or log poisoning; impact covers full code execution." I'll output that. assessed_cvss40_vector: Mapping: CVSS 4.0/AV:N, AC:H => AC:L? Wait, CVSS 4.0 has AC (Attack Complexity) and AT (Attack Requirements). High AC in 3.1 might map to AC:H in 4.0. I'll use CVSS:4.0/AV:N/AC:H/AT:P? Actually, AT:P is "Present" if attack requires some specific condition. LFI with high complexity might involve some attack requirements, so AT:P. But I'll keep it simple: AV:N, AC:H (since exploit requires high complexity), AT:N? In CVSS 4.0, AT is "Attack Requirements" presence: none or present. If specific conditions are needed (like allow_url_include), then AT:P. I'll use AT:P because LFI often requires specific PHP settings or file existence. PR:L, UI:N, VC:H/VI:H/VA:H (vulnerable system impacts), SC:N/SI:N/SA:N (no scope change). So vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. I'll output that. Rationale in assessed_cvss40_vector field? The field only requires the vector string. I'll provide that. Now all fields as plain strings. Now
Local file inclusion in ThemeMove EduMall WordPress theme up to version 4.4.7 allows authenticated attackers to read arbitrary files on the server. Exploitation requires low-privilege access and high attack complexity, with no user interaction needed; CVSS base score is 7.5. No active exploitation reported; EPSS probability is very low at 0.08%.
Information disclosure in Menulux Mobile App versions prior to 9.5.8 allows remote unauthenticated attackers to access other users' data by manipulating trusted identifiers (IDOR-style flaw). The vulnerability falls under CWE-639 (Authorization Bypass Through User-Controlled Key) and was reported by Turkey's national CERT (USOM). There is no public exploit identified at time of analysis, and EPSS scoring places exploitation probability at just 0.04% (13th percentile).
Denial of service in the Linux kernel's NXP ENETC Ethernet driver (enetc) on Layerscape LS1028A platforms allows the CPU to hang under normal network load, causing RCU stalls on PREEMPT_RT kernels. The flaw stems from recursive acquisition of the read-side enetc_mdio_lock in the enetc_poll NAPI path, which deadlocks when a higher-priority writer is queued between two reader acquisitions. No public exploit identified at time of analysis; EPSS is very low (0.03%, 8th percentile) and it is not CISA KEV listed, consistent with a reliability/self-triggered availability bug rather than an attacker-weaponized flaw.
Local file inclusion in PenciDesign Soledad WordPress theme versions through 8.7.0 allows authenticated attackers with low privileges to include and execute arbitrary PHP files via improper filename control in include/require statements. Attack complexity is high (AC:H), requiring specific server configuration or authenticated access to exploit. No active exploitation confirmed at time of analysis, but vulnerability class (CWE-98) is commonly targeted once POC becomes available. EPSS data not provided; exploitation status unknown beyond vendor disclosure.
Broken AFBC (Arm Frame Buffer Compression) handling in the Linux kernel's Mediatek DRM driver on MT8188 (Genio 700) SoCs causes constant vblank timeouts and garbled display output when the 32x8/split/sparse AFBC modifier is used, which Mesa v25.0+ enables by default. A local user with GPU/display access can trigger a hung display pipeline (denial of service) and rendering of stale/garbled framebuffer contents (limited information disclosure). No public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hardware-specific reliability bug rather than a widely weaponizable flaw.
Out-of-bounds read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an adjacent attacker to trigger a kernel panic by broadcasting a malformed 802.11 beacon frame. The OnBeacon handler parses an Extended Supported Rates (ESR) information element positioned at the end of the received frame buffer without bounds validation, reading past the buffer. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%), but the flaw is remotely reachable over the air against any device using this driver.
Out-of-bounds memory access in the Linux kernel's AMD CPU microcode-matching logic affects systems running on AMD Zen5 processors, where the zen5_rdseed_microcode revision table lacks a terminating sentinel entry. When x86_match_min_microcode_rev() iterates this array during CPU initialization on a Zen5 part, it reads past the array bounds, tripping KASAN and potentially disclosing adjacent kernel memory or causing instability. No public exploit identified at time of analysis, and EPSS risk is low (0.16%, 6th percentile).
Weakened cryptographic randomness affects the Linux kernel on AMD Zen5 processors, where the RDSEED instruction's 16-bit and 32-bit register variants can return a zero value while falsely reporting success (CF=1), tracked upstream as AMD-SB-7055. Kernel and userspace consumers that rely on RDSEED for entropy can silently receive predictable seed material, undermining key generation and other cryptographic operations. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile); the kernel resolves this by adding a microcode-revision check that works around the faulty hardware behavior.
Out-of-bounds memory access in the RISC-V stack unwinder (walk_stackframe) of the Linux kernel lets KASAN trip and read past a task's kernel stack boundary when unwinding a task other than the current one. The defect mirrors a previously fixed x86 issue (commit 84936118bdf3) and is reached through normal task-introspection paths on RISC-V builds. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.03%, 7th percentile), and it is not in CISA KEV; the fix disables KASAN checks for non-current tasks.
Improper resource cleanup in the Linux kernel's Intel ice Ethernet driver leaves PTP (Precision Time Protocol) resources leaked when driver probe, PTP initialization, or PTP restart hits an error path. On subsequent driver removal the leaked PF PTP state and un-deinitialized 'ps_lock' mutex trigger a kernel WARNING in ice_adapter_put, and the PTP clock is left registered. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and there is no CISA KEV listing; this is a robustness/error-handling defect requiring local privileged access to the NIC driver.
Client-identity confusion in the Linux kernel's NFS client allows a low-privileged local user to have an NFS mount silently reuse an existing RPC connection established under a different TLS X.509 client certificate. Because nfs_match_client() failed to compare the cert_serial and privkey_serial fields that define the client's presented identity, a mount intended to use one certificate could be bound to a connection authenticated with another, enabling access to data under the wrong identity. This is an information-disclosure/identity-mismatch flaw (CVSS 7.0); it is not in CISA KEV, has no public exploit identified at time of analysis, and carries a very low EPSS score of 0.10% (1st percentile).
Stored cross-site scripting (XSS) in ThemeNectar Salient Shortcodes WordPress plugin through version 1.5.4 allows authenticated users with low privileges to inject malicious scripts that execute in the context of higher-privileged administrators or other site visitors. The vulnerability requires user interaction (UI:R in CVSS vector) and affects the shortcode generation functionality, enabling persistence of malicious payloads in page content. EPSS score of 0.06% indicates low real-world exploitation probability despite the moderate CVSS 6.5 rating.
Stored cross-site scripting (XSS) in VK Google Job Posting Manager WordPress plugin versions up to 1.2.22 allows authenticated users with low privileges to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators. The vulnerability requires user interaction (clicking a link or viewing a malicious page) to trigger payload execution and affects the plugin's web page generation functionality. EPSS probability of exploitation is notably low at 0.04%, suggesting this is primarily a theoretical risk without documented active exploitation.
Stored cross-site scripting (XSS) in Premio Stars Testimonials WordPress plugin versions 3.3.4 and below allows authenticated users to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators or visitors. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting immediate risk, but the stored nature means injected payloads persist and affect multiple users. No public exploit code or active KEV status is documented, though the 6.5 CVSS score reflects moderate severity when considering cross-site impact.
Authorization bypass in Essential Real Estate WordPress plugin versions through 5.2.9 allows authenticated users to access sensitive real estate data they should not have permission to view through user-controlled key manipulation. The vulnerability exploits incorrectly configured access control at the application level, enabling privilege escalation from a standard user account to view confidential information such as property details or pricing. No public exploit code has been identified, and the EPSS score of 0.04% indicates low exploitation probability despite the CVSS 6.5 severity rating.
Improper authentication in Ningyuanda TC155 firmware version 57.0.2.0 allows unauthenticated RTSP Live Video Stream access from within the local network. The vulnerability, classified as an authentication bypass (CWE-287), requires no user interaction and can be exploited with low complexity. Publicly available exploit code exists, though active exploitation has not been confirmed via CISA KEV. EPSS score of 0.16% indicates low real-world exploitation likelihood despite the disclosure and POC availability, suggesting limited attacker interest or access constraints.
Improper access controls in Ningyuanda TC155 firmware 57.0.2.0 ONVIF Device Management Service allows unauthenticated local network attackers to trigger a factory reset by manipulating the FactoryDefault argument with 'Hard' input, resulting in information disclosure and configuration loss. Publicly available exploit code exists; vendor has not responded to disclosure attempts.
Denial of service in Ningyuanda TC155 firmware 57.0.2.0 via malformed RTSP requests to an unauthenticated RTSP service allows local network attackers to crash or degrade the device without authentication. Publicly available exploit code exists; the vendor did not respond to early disclosure notification. CVSS score of 2.1 reflects the low severity due to limited attack surface (local network only) and availability impact alone, but real-world risk depends on device deployment context and exposure to untrusted local networks.
Template injection in CTCMS up to version 2.1.2 allows authenticated remote attackers to bypass template engine protections via improper neutralization of special elements in the Frontend/Template Management Module. The vulnerability affects the CT_Parser.php library and enables information disclosure with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS exploitation probability remains low at 0.09% (26th percentile), suggesting limited real-world weaponization despite POC availability.
Improper access controls in Ningyuanda TC155 firmware 57.0.2.0 ONVIF PTZ Control Interface (/onvif/device_service) allow unauthenticated local network attackers to gain unauthorized access with low confidentiality, integrity, and availability impact. Publicly available exploit code exists; the vendor has not responded to disclosure efforts despite early contact.
Keycloak's admin API endpoints for authorization resource management contain an IDOR vulnerability allowing authenticated administrators with fine-grained permissions for one client to delete or modify resources belonging to other clients within the same realm. The flaw exists in ResourceSetService and PermissionTicketService where authorization checks validate the resourceServer (client) ID from the API request, but backend database operations use only the resourceId, creating a permission bypass. Affected administrators can exploit this with standard HTTP requests to cross-client resource boundaries; no public exploit code identified at time of analysis.
DOM-based cross-site scripting in the Document Library Lite WordPress plugin (versions <=1.1.7) allows authenticated attackers with high privileges to execute arbitrary JavaScript in the browser of an administrator who visits a crafted page. This could lead to account compromise or malicious actions within the WordPress admin.
Server-side request forgery in LMPixels Kerge WordPress theme 4.1.3 and earlier allows unauthenticated attackers to coerce the theme into making server-side requests to arbitrary destinations. Successful exploitation can lead to limited information disclosure or interaction with internal services. No active exploitation or public exploit code is currently known, and the EPSS probability is very low (0.05%), suggesting a low immediate risk.
Authenticated users with limited privileges can modify plugin settings and access functionality they should not have access to via missing authorization checks in Buttoner for Elementor through version 1.0.6. The vulnerability requires valid WordPress user credentials but no administrative role, allowing privilege escalation within the plugin's configuration interface. EPSS score of 0.05% indicates low exploitation probability despite network accessibility.
Broken access controls in Ultimate Auction plugin for WordPress up to version 4.3.3 allow low-privileged attackers to modify or disrupt auction operations. The missing authorization checks (CWE-862) enable unauthorized changes without user interaction, impacting integrity and availability but not confidentiality. No active exploitation or public exploit code has been reported; EPSS indicates a low exploitation probability.
Missing authorization in NinjaTeam FileBird Pro WordPress plugin versions up to 6.5.1 allows authenticated users to access and modify files they should not have permission to view or edit due to incorrectly configured access control security levels. The vulnerability requires valid user credentials but can lead to disclosure and modification of sensitive files within the plugin's file management interface. EPSS exploitation probability is low at 0.04%, and no public exploit code has been identified at the time of analysis.
Cross-site request forgery in the Meks Quick Plugin Disabler WordPress plugin (≤1.0) allows an attacker to trick a logged-in administrator into disabling plugins, leading to potential service disruption. No active exploitation or public exploit code is known; EPSS probability is 0.03%.
Cross-Site Request Forgery in the Semrush Content Toolkit WordPress plugin allows attackers to trick authenticated users into performing unauthorized actions. All versions up to 1.1.32 are vulnerable. No active exploitation or public exploit code has been reported, and EPSS score indicates very low likelihood of widespread exploitation.
Broken access control in ThemeFusion Avada WordPress theme through version 7.13.2 allows authenticated attackers with low privileges to access functionality improperly constrained by access control lists, potentially achieving full site compromise. With CVSS 8.8 (High) due to network-based access requiring only low-privilege authentication, attackers can achieve high confidentiality, integrity, and availability impact. EPSS probability remains low at 0.06% (18th percentile), and no public exploit identified at time of analysis, suggesting limited immediate exploitation risk despite the critical CVSS rating.
Information disclosure in wowpress.host Fix Media Library up to version 2.0 allows unauthenticated attackers to retrieve sensitive data embedded in sent data. The vulnerability, disclosed by Patchstack, has a CVSS 5.3 (medium) and a low EPSS exploitation probability (0.05%), with no known public exploits at this time.
Insecure direct object reference in Barn2 Document Library Lite plugin for WordPress allows unauthenticated remote attackers to read arbitrary documents by manipulating a user-controlled key parameter. Affected versions include all releases up to and including 1.1.7, with low confidentiality impact and no integrity or availability loss.
Remote unauthenticated attackers can exploit missing authorization checks in the Homey Core plugin (versions ≤ 2.4.3) to degrade service availability. The vulnerability stems from a missing authorization flaw (CWE-862) that permits unauthorized interaction with vulnerable endpoints. No public exploit code has been identified and active exploitation is not confirmed at the time of analysis.
Missing authorization in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin versions up to 4.0.7 allows unauthenticated attackers to modify cookie consent settings, potentially undermining the site’s compliance posture. No active exploitation or public proof-of-concept has been identified, and the EPSS score (0.05%) indicates very low exploitation probability.
Missing authorization in Sendinblue for WooCommerce plugin versions up to 4.0.49 allows unauthenticated attackers to modify newsletter subscription settings with low integrity impact. The vulnerability (CVE-2025-66128) has a CVSS 5.3 but a very low EPSS exploitation probability (0.05%) and no known active exploitation or public exploit code.
Missing authorization in the SiteGround Security plugin for WordPress (≤1.5.8) allows unauthenticated remote attackers to trigger availability disruptions by exploiting incorrectly configured access controls. The vulnerability has a CVSS 5.3 (Medium) but EPSS scores only 0.05%, indicating minimal predicted exploitation; no active attacks or public exploit code have been observed.
Unauthenticated information disclosure in the CatFolders WordPress plugin up to version 2.5.3 allows remote attackers to access restricted data via a missing authorization check. No public exploit is known, and EPSS indicates a low exploitation probability (0.05%).
Unauthenticated modification of plugin data in OnPay.io for WooCommerce through version 1.0.47 allows remote attackers to alter plugin settings via missing authorization checks. The WordPress plugin lacks proper capability verification, enabling attackers with no privileges to perform actions that should require authentication. Exploitation probability is negligible per EPSS, and no active attacks or public exploit code have been identified.