Deserialization of untrusted data in Hugging Face Accelerate's checkpoint parsing allows arbitrary code execution in the context of the current process when a user or automated pipeline loads a malicious checkpoint file. The CVSS:3.0 vector (AV:L/AC:L/PR:N/UI:R) means the attacker must get the file to the target locally and the victim must actively load it - there is no remote network-service trigger - so environments that only load self-produced, trusted checkpoints are not at risk. No public exploit code or active exploitation is identified in the available intelligence, and EPSS is low at 0.37% (29th percentile); risk is genuine but conditional on loading third-party or untrusted checkpoints.
Deserialization of untrusted data in Hugging Face Diffusers' CogView4 checkpoint-parsing path lets an attacker who supplies a crafted serialized checkpoint execute arbitrary code in the context of the current process when the victim loads it. The attack is local in vector (AV:L) and requires user interaction (UI:R) - the target must open a malicious file or visit a malicious page that triggers the CogView4 loader - so exposure is concentrated in workflows that routinely ingest third-party or community-sourced model weights rather than in internet-facing services. Severity is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with an EPSS of only 0.37% (29th percentile); no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and reported signals are consistent with a genuine but condition-gated code-execution risk rather than an internet-wormable emergency.
Deserialization of untrusted data in Hugging Face Transformers' Perceiver model file parsing path allows code execution in the context of the user who loads a malicious model, tracked as ZDI-CAN-25423 / ZDI-25-1150. Per the assessed CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the flaw is not network-triggerable and requires user interaction - a victim must be induced to open or load an attacker-controlled model file - and any code that runs is bounded by that user's privileges rather than elevating them. The CPE for this advisory enumerates Transformers 4.54.1, EPSS is low at 0.36% (28th percentile), and no public exploit code was identified at time of analysis; the vendor advisory is available at https://www.zerodayinitiative.com/advisories/ZDI-25-1150/.
Integer overflow in NSF Unidata NetCDF-C during parsing of NC variable definitions can lead to arbitrary code execution when a user opens or processes a crafted NetCDF file. The CWE-190 flaw stems from insufficient validation of user-supplied data before buffer allocation, allowing code execution with the privileges of the user who opens the file (CVSS 7.8, AV:L/UI:R/PR:N). No public exploit or CISA KEV entry is currently identified, and EPSS is 0.36% (28th percentile), indicating modest real-world urgency despite the high severity.
Code execution in NSF Unidata NetCDF-C can be triggered when a user opens or processes a crafted NetCDF file containing an oversized attribute name; the flaw is a stack-based buffer overflow (CWE-121) in attribute-name parsing. The assessed CVSS 3.0 score is 7.8 with AV:L/PR:N/UI:R, so attack delivery is local and requires user interaction, and no public exploit code or CISA KEV entry was identified at time of analysis (EPSS 0.35%).
Heap-based buffer overflow in NSF Unidata NetCDF-C's dimension-name parsing allows code execution in the context of the current user when a victim opens a crafted NetCDF file or a page that serves one. The CVSS 7.8 vector is local (AV:L) with mandatory user interaction (UI:R) and no scope change (S:U), so exposure is concentrated in workflows that routinely parse untrusted scientific data rather than network services. No public exploit was identified at the time of analysis, and EPSS is low at 0.35% (27th percentile); the CPE has no version restriction, so NetCDF-C installations should be treated as potentially affected until a fixed release is confirmed.
A stack-based buffer overflow in NSF Unidata NetCDF-C occurs when parsing a variable name longer than the library's fixed-length stack buffer, allowing arbitrary code execution in the context of the user running the affected application. The flaw is rated CVSS 7.8 but requires the victim to open a malicious NetCDF file (or visit a page that delivers one) in an application built on the library - the vector is local with mandatory user interaction (AV:L/AC:L/PR:N/UI:R/S:U), so there is no server-side or autonomous network path, and no authentication is required. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at roughly 0.35% (27th percentile), making this a genuine code-execution risk gated by social engineering rather than an urgent widespread-threat priority.
Stack-based buffer overflow in NSF Unidata NetCDF-C's time-unit parsing routine allows arbitrary code execution at the privilege of the current user when a victim opens a crafted NetCDF file. Exploitation is gated by user interaction (UI:R) and a local attack vector (AV:L): the attacker must deliver a malicious file or page that the target then parses, there is no network-service exposure and no automatic trigger, though no privileges are required (PR:N) and no non-default configuration is indicated. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low (0.35%, 27th percentile), consistent with a moderate-priority issue rather than a mass-exploitation threat; the ZDI advisory ZDI-25-1153 (ZDI-CAN-27273) documents the disclosure.
Code injection in Hugging Face Transformers 4.57.0 lets an attacker who supplies a crafted HuBERT checkpoint execute arbitrary Python in the victim's user context when that checkpoint is run through the convert_config conversion path. Exploitation is local and requires user interaction - the victim must deliberately convert the malicious file - so there is no remote, unauthenticated network-triggered path and no mass-exploitation vector; EPSS is 0.34% (26th percentile) and no public exploit code has been identified at time of analysis. Impact is bounded by the privileges of the converting user, but a successful trigger yields full confidentiality, integrity and availability loss within that context.
Code injection in Hugging Face Transformers' SEW-D convert_config path allows arbitrary Python execution when a user converts an attacker-supplied model checkpoint, but only with the privileges of the current user. The assessed vector is local (AV:L) with required user interaction (UI:R) - the victim must deliberately invoke the conversion on a malicious checkpoint - and no public exploit code or CISA KEV activity has been identified at time of analysis, with EPSS around 0.34% (26th percentile). Risk is moderate rather than urgent: environments that only convert trusted first-party checkpoints are not realistically exposed.
Code injection in Hugging Face Transformers 4.57.0 allows arbitrary Python execution when a user converts a malicious SEW checkpoint through convert_config, running with the converting user's privileges. The assessed CVSS 3.1 vector is local with low complexity and no privileges, but requires user interaction (AV:L/AC:L/PR:N/UI:R), so attackers cannot trigger it over the network and must persuade a target to process an untrusted checkpoint. No public exploit identified at time of analysis and EPSS is 0.34%, making this a conditional risk concentrated in pipelines that ingest third-party model checkpoints.
Deserialization of crafted GLM4 model weights in Hugging Face Transformers 4.57.1 can execute arbitrary code in the context of the loading process when a victim opens or loads an attacker-supplied model file. The issue is high severity (CVSS 7.8) but local and user-interaction dependent (AV:L/UI:R), not a remotely reachable service vulnerability, and exploitation requires workflows that ingest untrusted or third-party model artifacts. No public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is 0.33% (25th percentile), consistent with opportunistic rather than mass exploitation.
Arbitrary code execution in Hugging Face Transformers 4.55.0 occurs when the library parses an attacker-supplied megatron_gpt2 model checkpoint, because checkpoint data is deserialized without adequate validation (CWE-502). The attack is not remotely triggerable on its own: the CVSS vector is AV:L with UI:R, so a victim must actively open a malicious file or visit a page that causes the crafted checkpoint to be loaded, and any code then runs with the privileges of the loading process or user. This is a genuine but second-tier priority - the EPSS score is only 0.33% (25th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis; realistic exposure is confined to workflows that ingest third-party or otherwise untrusted checkpoints. The issue was reported through Trend Micro ZDI as ZDI-CAN-27984 / ZDI-25-1141.
Deserialization of attacker-supplied model data in Hugging Face Transformers 4.54.1 allows an attacker to execute arbitrary code with the victim's privileges when a user is convinced to load a crafted Transformer-XL model file, for example by opening a malicious file or visiting a page that triggers model loading. The flaw is a CWE-502 validation failure in the model-file parsing path, scored 7.8 under CVSS 3.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning there is no direct network attack surface, user interaction is required, and execution is confined to the current user's context rather than escalated. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.33% (25th percentile), consistent with a conditional, user-interaction-driven risk rather than a mass-exploitation emergency.
Heap-based buffer overflow in the Academy Software Foundation's OpenEXR library allows an attacker to execute arbitrary code in the context of the process that parses a crafted .exr file, but only after the victim opens the file or loads an asset that triggers EXR parsing. The attack vector is local and user interaction is mandatory (CVSS:3.1/AV:L/AC:L/PR:N/UI:R), so there is no server-side or network-automatic path; realistic exposure is limited to VFX, rendering, image-processing, and other workflows that auto-ingest untrusted EXR content. No public exploit code was identified at time of analysis and no CISA KEV entry exists, while EPSS is very low at 0.19% (9th percentile), making this a genuine but not emergency-grade priority.
Heap-based buffer overflow in Academy Software Foundation OpenEXR allows unauthenticated attackers to execute arbitrary code in the context of the parsing process when a victim opens a crafted .exr file, requiring user interaction and local access to the file. The flaw stems from missing validation of user-supplied length data before a heap copy; no public exploit identified at time of analysis, and EPSS is low at 0.19% (9th percentile). Risk concentrates in pipelines that automatically ingest or thumbnail untrusted EXR assets.
Heap-based buffer overflow in Academy Software Foundation OpenEXR's EXR file parser allows code execution in the context of the current process when a victim opens or parses a crafted .exr file. The flaw stems from missing validation of attacker-supplied length data before it is copied into a heap buffer; the CVSS 3.0/3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) reflects that no credentials are needed but the victim must be induced to process a malicious image. Only deployments that link OpenEXR and ingest untrusted EXR input - image viewers, DCC/VFX tools, render farms, thumbnailers, conversion services - are exposed; no public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS is low (0.19%, 9th percentile), making this a credible but not emergency-tier patch priority.
Local privilege escalation in VIPRE Advanced Security for PC allows a low-privileged local attacker to execute arbitrary code as SYSTEM by abusing an incorrectly permissioned folder created by the product installer. The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and independent assessment agree that a prior local foothold is required, but once present the escalation is low-complexity and requires no user interaction. EPSS is 0.14% (3rd percentile), and no public exploit was identified at time of analysis.
Local privilege escalation in TradingView Desktop's Electron framework lets an attacker who already holds low-privileged code execution write a malicious script into an unsecured, attacker-writable search location that the application loads, resulting in arbitrary code execution in the context of the targeted user. The flaw (CWE-427, uncontrolled search path) is rated CVSS 7.8 on a local vector (AV:L/AC:L/PR:L/UI:N), so it is not remotely reachable and requires existing local footing plus write access to the relevant path. No public exploit code or CISA KEV entry was identified at time of analysis, and the ZDI advisory ZDI-25-1070 is the primary reference.
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a low-privileged local attacker to escalate to SYSTEM by invoking an exposed dangerous function in the SAS Core Service. Exploitation requires the attacker to already be able to execute code on the host and the SAS Core Service to be running, which limits the attack surface to local, post-compromise scenarios. With a CVSS score of 7.8 and no CISA KEV listing or public exploit identified at time of analysis, this is a credible but context-limited priority.
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privileged code execution to abuse an exposed dangerous function in the SAS Core Service and run code as SYSTEM. The flaw affects installations with the SAS Core Service running and requires local access plus a pre-existing low-privilege foothold (CVSS 3.x: AV:L/PR:L), with no user interaction. No public exploit identified at time of analysis, and no CISA KEV status is provided.
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker with existing low-privileged code execution to invoke an exposed dangerous function in the SAS Core Service and gain SYSTEM-level code execution. The flaw requires local access and a running SAS Core Service, needs no user interaction, and has no remote or unauthenticated path. No public exploit identified at time of analysis.
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already has low-privileged code execution call an exposed dangerous function in the SAS Core Service and gain SYSTEM-level code execution. The flaw affects installations with the service running and is a post-compromise escalation primitive, not an initial-access vector; no public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in RealDefense SUPERAntiSpyware Professional lets an attacker who already holds low-privileged code execution on a Windows host abuse a dangerous function exposed by the SAS Core Service to run code as SYSTEM. Only machines running the Professional edition with the SAS Core Service active are exposed, and the attack cannot be launched remotely because it requires a prior local foothold (CVSS 3.0 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-749). No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue was reported through Trend Micro ZDI (ZDI-CAN-27675 / ZDI-25-1170), which remains the primary source of remediation status.
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privileged code execution to abuse an exposed dangerous function in the SAS Core Service and execute arbitrary code as SYSTEM. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires the product to be installed with its core service running, which is default behavior. No public exploit code was identified at time of analysis.
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a standard user who already holds a low-privileged foothold on the host to execute arbitrary code as SYSTEM by abusing an exposed dangerous function in the SAS Core Service (CWE-749, ZDI-CAN-27660). The CVSS 3.0 vector (AV:L/AC:L/PR:L/UI:N, 7.8) confirms the attack is local-only, requires an existing local account or process, and needs no user interaction once that prerequisite is met; there is no remote attack surface. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so the flaw should be treated as a post-compromise escalation primitive rather than a self-contained intrusion vector.
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows an attacker who already has low-privileged local code execution to abuse an exposed dangerous function in the SAS Core Service and execute code as SYSTEM (CVSS 7.8). Exploitation requires local interactive access to a Windows endpoint where the product is installed and the SAS Core Service is running, so exposure is limited to hosts with this endpoint protection product deployed; no public exploit was identified at time of analysis.
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a local authenticated low-privileged attacker to invoke an exposed dangerous function in the SAS Core Service and execute arbitrary code as SYSTEM. Affected installations are Professional-edition builds with the SAS Core Service running; the assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), reflecting a mandatory prior local foothold rather than a remote attack path. No public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in RealDefense SUPERAntiSpyware Professional allows a user who already holds low-privileged code execution on the host to invoke a dangerous function exposed by the SAS Core Service and run arbitrary code in the SYSTEM context. The flaw is local-only (AV:L), requires low privileges (PR:L), needs no user interaction (UI:N), and has low attack complexity, giving a base score of 7.8; a standalone local foothold is therefore both the prerequisite and the principal constraint on real-world impact. No public exploit code has been identified at time of analysis and the issue is not tracked as actively exploited (CISA KEV), so risk is highest on multi-user endpoints, VDI/RDP hosts, and systems where unprivileged users routinely run code alongside an active SAS Core Service.
Heap-based buffer overflow in GIMP 3.0.6's JPEG 2000 (JP2) file parser enables arbitrary code execution in the context of the current process when a victim opens a crafted JP2 file; the attack is file-based (AV:L) and requires user interaction (UI:R), and no public exploit code was identified at time of analysis. This is a moderate-priority, user-interaction-dependent code execution flaw rather than a mass-exploitation emergency.
Use-after-free in GIMP 3.0.6's XCF file parser allows an attacker to execute arbitrary code in the context of the current user when a crafted XCF file is opened. The flaw is a client-side memory-corruption issue requiring user interaction to load the malicious file; no privileges are required, but exploitation is not possible against a listening network service. A vendor patch is referenced upstream, and no public exploit was identified at time of analysis.
Stack-based buffer overflow in GIMP 3.0.6's LBM (Interleaved Bitmap/Deluxe Paint) importer allows an attacker to execute arbitrary code with the privileges of the user who opens a crafted image. The parser copies attacker-supplied data into a fixed-size stack buffer without first validating its length (CWE-121); the assessed CVSS 3.1 vector is 7.8 with PR:N/UI:R, so the attacker needs no credentials but must convince the victim to open or import the malicious file. No public exploit code or CISA KEV entry was identified at time of analysis, and this is a genuine, patch-worthy memory-safety flaw but not a drop-everything emergency because exploitation depends on user interaction and yields only local-user code execution.
Integer overflow in GIMP's PNM file parser allows an attacker to execute arbitrary code in the context of the user who opens a crafted PNM image. The confirmed affected version is GIMP 3.0.6; exploitation requires user interaction (opening a malicious PBM/PGM/PPM/PNM file or causing one to open), and code runs only with the privileges of the GIMP process. No public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data, and a vendor fix is available, making this a credible but not emergency-level priority.
Directory traversal in pdfforge PDF Architect 9.1.74.23030 allows unauthenticated attackers to execute arbitrary code by crafting a malicious CBZ archive that writes files outside the intended extraction directory. Exploitation requires the victim to open the crafted file (UI:R) and is limited to a local attack vector (AV:L), with code running at the current user's privileges. No public exploit code or active exploitation has been identified at time of analysis.
Memory corruption during PDF file parsing in pdfforge PDF Architect (confirmed affected build 9.1.74.23030) allows an attacker to execute arbitrary code in the context of the user who opens a crafted PDF, yielding high confidentiality, integrity, and availability impact for that process. The decisive limiting factor is the mandatory user interaction combined with a local attack vector: exploitation requires the target to open a malicious document (or visit a page that delivers one), and there is no remote network-service exposure, with code running only at the privileges of the invoking user. No public exploit code and no confirmed active exploitation were identified at time of analysis; the risk is conditional but real, and the vendor/ZDI advisory (ZDI-25-1076) is the primary reference.
PDF Architect version 9.1.74.23030 executes embedded PDF Launch actions without first warning the user, so a crafted document can run arbitrary script in the victim's security context when opened. The flaw is local and requires user interaction, and no public exploit code has been identified at time of analysis; successful exploitation gives the attacker the same privileges as the current user.
Soda PDF Desktop 14.0.509.23030 executes content reached through a PDF Launch action without surfacing the security warning users would normally have to approve, letting a crafted document run code in the victim's own security context. Exploitation is gated by mandatory user interaction: the target must open the malicious PDF (or a page that serves it), and because the CVSS vector carries PR:N with no scope change, no prior privileges are needed but the resulting code runs only with the victim's existing rights. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a targeted, file-delivery-dependent client-side risk rather than a drive-by network threat.
Code execution in Soda PDF Desktop 14.0.509.23030 is possible when a user opens an attacker-crafted Word file, because the application runs dangerous embedded script without the expected UI warning. The attack is client-side and requires user interaction (UI:R), and any code runs only with the current user's privileges rather than elevated or system-level rights. No public exploit code or confirmed active exploitation was identified at time of analysis.
Directory traversal in Soda PDF Desktop 14.0.509.23030's CBZ parser can lead to arbitrary code execution when a user opens a crafted comic-book archive, with impact limited to that user's privileges. The flaw requires user interaction and no special privileges, making it a genuine but second-tier risk rather than an automatically exploitable remote compromise; the provided intelligence contains no public exploit code or CISA KEV confirmation.
Remote code execution in Soda PDF Desktop 14.0.509.23030 is triggered when a user opens a crafted XLS file that causes embedded dangerous script to run without the application's normal security warning. The attack is local and user-interaction-dependent (AV:L/UI:R), executes only at the current user's privilege level, and does not provide an unauthenticated network path. No public exploit code or CISA KEV active-exploitation confirmation was identified in the supplied intelligence at time of analysis.
Out-of-bounds write in Soda PDF Desktop's PDF parser can let attackers execute arbitrary code in the context of the current process when a user opens a crafted PDF, with affected build 14.0.509.23030 identified by CPE. Exploitation requires user interaction and local file delivery or opening rather than a remotely reachable service (CVSS 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and no public exploit code or confirmed active exploitation was identified in the available data.
Local privilege escalation in Soda PDF Desktop 14.0.509.23030 allows an attacker who can already execute low-privileged code on a Windows host to place a malicious OpenSSL configuration file in an unsecured search location, potentially causing a SYSTEM-privileged component to load attacker-controlled settings and execute arbitrary code. The flaw is a local-only CWE-427 uncontrolled search path issue; no public exploit was identified at time of analysis. It requires an existing standard-user foothold and write access to the relevant configuration path, making this a credible local privilege-escalation issue that merits patching but is not an emergency.
Remote code execution in PDFsam Enhanced 7.0.76.15222 is caused by the application's Launch action executing dangerous script without any user warning (CWE-356). An unauthenticated attacker can trigger the flaw by convincing a victim to open a crafted PDF or visit a malicious page, after which code runs with the victim's privileges; user interaction is required and no public exploit was identified at time of analysis.
Out-of-bounds read in PDFsam Enhanced's handling of App objects can lead to arbitrary code execution when a victim opens a crafted PDF containing malformed content. PDFsam Enhanced 7.0.76.15222 is confirmed affected; the CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, so exploitation requires user interaction but no credentials or administrative rights, and code runs in the context of the user who opens the file. No public exploit code or CISA KEV entry is confirmed in the provided intelligence, and the free PDFsam Basic edition is not identified as affected.
Unauthenticated remote attackers can retrieve stored credentials from Senstar Symphony by invoking the FetchStoredLicense method, which returns sensitive license-related data without requiring authentication or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5). The exposure is confidentiality-only but high impact: leaked credentials can be reused to pivot further into the video management deployment and its integrated systems. EPSS is 0.64% (50th percentile), no public exploit code was identified at time of analysis, and the issue is not in CISA KEV; the practical risk driver is whether the Symphony management service is reachable from untrusted networks.
SQL injection in AutomatorWP WordPress plugin through version 5.2.4 allows authenticated attackers to execute arbitrary SQL commands. The vulnerability exists in the plugin's database query handling where user-supplied input is not properly sanitized before being used in SQL statements. While EPSS scoring indicates low exploitation probability (0.04th percentile), the SQL injection vector represents a critical capability if exploited, potentially enabling data exfiltration, modification, or deletion from the affected WordPress database.
Blind SQL injection in WPBulky WordPress plugin through version 1.1.13 allows high-privileged authenticated attackers to extract database contents and potentially cause limited service disruption. The vulnerability exists in the bulk edit functionality where user-supplied input is improperly sanitized before inclusion in SQL queries. With EPSS score of 0.04% (12th percentile) and no public exploit code identified, immediate mass exploitation appears unlikely, though administrator-level compromise could enable data exfiltration from WordPress databases.
Local file inclusion vulnerability in CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin through version 5.10.5.1 allows attackers to read arbitrary files from the server via improper control of filename parameters in PHP include/require statements. The vulnerability carries a low EPSS score of 0.17% (38th percentile), indicating minimal real-world exploitation probability despite being a classic PHP file inclusion flaw affecting an Elementor page builder plugin.
Local File Inclusion in Nika WordPress theme through version 1.2.14 allows authenticated attackers with low-level privileges to read arbitrary files on the server via improper filename validation in PHP include/require statements. EPSS score of 0.17% (38th percentile) indicates low predicted exploitation probability. No public exploit code or active exploitation confirmed at time of analysis, though Patchstack's disclosure suggests vulnerability details are documented.
Local File Inclusion (LFI) vulnerability in the Diza WordPress theme (≤1.3.15) enables low-privileged authenticated attackers to include arbitrary local files, potentially leading to remote code execution, sensitive data exposure, or complete site compromise. The CVSS score of 7.5 reflects high complexity network-based attack requiring authentication. EPSS exploitation probability is low (0.17%, 38th percentile), with no confirmed active exploitation or public proof-of-concept at time of analysis, though the vulnerability has been cataloged by Patchstack's security research team.