Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 allow anyone who can reach the database port to authenticate with full read/write access to the backend datastore. Publicly available exploit code exists, though EPSS remains low (0.81%) and the vendor states the database port is not network-exposed by default in 1.0.1 and later, limiting realistic reach. There is no public exploit identified as actively used in the wild (not in CISA KEV).
Unrestricted file upload in WordPress Contact Form 7 PDF plugin through 3.0.0 allows authenticated attackers to upload malicious files, achieving remote code execution with full server compromise (CVSS 9.9). No active exploitation confirmed by CISA KEV, and EPSS indicates low exploitation probability (0.08%).
Authentication bypass in AmentoTech Tuturn plugin for WordPress versions before 3.6 allows remote, unauthenticated attackers to abuse authentication mechanisms and gain privileged access to plugin functionality and potentially the entire WordPress site. No public exploit or active exploitation is identified at this time, and the likelihood of exploitation is rated low according to EPSS (0.12%).
Remote code execution in Mozilla Firefox via use-after-free in Disability Access APIs allows unauthenticated network attackers to compromise browser integrity with high impact. The vulnerability (CWE-416) affects Firefox versions prior to 146.0.1 and requires no user interaction or special privileges. With CVSS 9.8 (Critical) but low EPSS (0.07%, 21st percentile), real-world exploitation probability remains limited despite theoretical severity. No public exploit identified at time of analysis, and vendor-released patch 146.0.1 available.
Unauthenticated SQL injection in the WordPress tPlayer plugin (HTML5 audio player with playlist) versions up to 1.2.1.6 allows remote attackers to extract sensitive data from the database via crafted requests, with limited availability impact. The vulnerability has a CVSS score of 9.3, requires no user interaction, and is classified as CWE-89. At the time of analysis, no public exploit code or active exploitation is known, and EPSS probability is low (0.06%).
SQL injection in the Advance Seat Reservation Management for WooCommerce plugin <=3.1 allows unauthenticated attackers to extract sensitive database contents. The vulnerability carries a CVSS 9.3 score, with network vector, no privileges, and scope change leading to high confidentiality impact and minor availability disruption. No active exploitation or public POC has been confirmed, and EPSS indicates a very low exploitation probability (0.05%).
Remote code execution in Hotel Booking Lite (motopress-hotel-booking-lite) for WordPress allows authenticated attackers with high privileges to inject and execute arbitrary code on the server via remote file inclusion. The flaw affects versions up to and including 5.2.3. No active exploitation or public proof-of-concept is reported, but the high CVSS score highlights severe impact if exploited by a compromised admin account.
Remote unauthenticated arbitrary file upload with path traversal in WP Webhooks plugin up to version 3.3.8 allows full site compromise. Attackers can upload malicious files to arbitrary directories, leading to code execution and data theft. No user interaction required, but exploitation is of high complexity.