Authenticated command injection in the Yealink SIP-T21P_E2 IP phone (firmware 52.84.0.15) lets a remote user with normal, non-administrative privileges execute arbitrary operating-system commands by sending a crafted request to the ping utility of the diagnostic component. Because the CVSS vector reports PR:L, exploitation requires only a low-privileged authenticated session, and publicly available exploit code exists, though the EPSS probability remains modest at 0.60% (44th percentile) and the flaw is not listed in CISA KEV. Successful exploitation yields full high-impact compromise of confidentiality, integrity, and availability on the device.
Improper authentication in Sim's CRON secret handler allows attackers to bypass authentication on internal APIs and CRON endpoints when required environment secrets are not configured. Publicly available exploit code exists, and the issue affects Sim versions up to 0.5.27. Attackers can remotely access sensitive internal operations by providing an empty or arbitrary secret token.
Directory traversal in Yealink SIP-T21P(E2) IP phone firmware 52.84.0.15 exposes arbitrary files to low-privileged remote attackers via a crafted request to the diagnostic component's result read function. The flaw is confined to confidentiality impact - attackers can exfiltrate sensitive files (credentials, configuration, logs) stored on the device but cannot modify or crash it. A publicly available proof-of-concept exists, though EPSS at 0.62% indicates limited observed exploitation activity and the device is not listed in the CISA KEV catalog.
IBM DS8000 enterprise storage arrays - DS8A00 (R10.0/R10.1) and DS8900F (R9.4) - expose immutable backup infrastructure to destruction by local users holding authorized CCW update permissions, due to missing authorization checks in IBM Safeguarded Copy and GDPS Logical corruption protection mechanisms. The flaw (CWE-862) allows a low-privileged operator to delete or corrupt protected backup snapshots that are specifically designed to survive ransomware and insider attacks. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the strategic risk in ransomware pre-staging scenarios is significant.
Server-side request forgery in YunaiV yudao-cloud through version 2025.11 allows authenticated remote attackers to manipulate HTTP callback and sync request functionality in the Business Process Management component by controlling the URL, headers, and body parameters, enabling attackers to forge arbitrary server-side requests. The vulnerability carries a low CVSS score (2.1) due to the authenticated requirement (PR:L) and limited scope, but publicly available proof-of-concept code exists; the vendor did not respond to early disclosure notification.
Reflected cross-site scripting (XSS) in sunkaifei FlyCMS userLogin function allows unauthenticated remote attackers to inject malicious scripts via the redirectUrl parameter, requiring user interaction to trigger. The vulnerability is publicly available for exploitation with a low CVSS score of 2.1 reflecting limited integrity impact, but active public PoC code exists and the affected project has not responded to disclosure.
Cross-site scripting (XSS) in sunkaifei FlyCMS Admin Login component allows remote attackers to inject malicious scripts via the redirectUrl parameter in IndexAdminController.java. The vulnerability requires user interaction (UI:P) and results in limited integrity impact (VI:L), with a very low CVSS score of 2.1 despite public exploit availability. Active exploitation risk is minimal given the low EPSS score (0.02%, 6th percentile) and requirement for social engineering the admin user.
Authentication bypass in Alteryx Server's Gallery API status endpoint (/gallery/api/status/) allows remote, unauthenticated attackers to access restricted information and perform low-impact modifications. Public exploit code is available, but no active exploitation or CISA KEV listing has been observed. EPSS score of 0.03% indicates low likelihood of widespread attacks.
Cross-site scripting (XSS) vulnerability in postmanlabs httpbin up to version 0.6.1 allows authenticated remote attackers to inject malicious scripts via manipulation of an unknown function in httpbin/core.py, requiring user interaction to execute. Public exploit code is available, and the vendor has not yet responded to early disclosure notification despite a low CVSS score of 2.0 and EPSS exploitation probability of 0.02%, indicating minimal real-world risk despite code availability.