Command injection in the NTPSyncWithHost.cgi endpoint of TRENDnet TEW-800MB firmware 1.0.1.0 allows an authenticated remote attacker to execute arbitrary operating-system commands on the router by manipulating input processed by the sub_F934 function. The CVSS vector specifies PR:L, so the attacker must first hold a valid low-privilege account or an established management session against the device; exploitation is not fully unauthenticated. Publicly available exploit code exists (linked from NVD via a third-party write-up), but the flaw is not confirmed actively exploited (CISA KEV), and exposure is bounded by the single firmware/model combination and the usual LAN-side reachability of a consumer router's management interface.
Command injection in TRENDnet TEW-800MB firmware 1.0.1.0 allows an authenticated low-privilege attacker who can reach the web Management Interface to execute arbitrary operating-system commands through a crafted WizardConfigured parameter in a request to /goform/wizardset. Publicly available exploit code exists, and exploitation is bounded by the need for valid credentials and reachability of the management interface; no CISA KEV entry is provided in the available intelligence. The device is at sharply higher risk if WAN-side remote management is enabled, otherwise exposure is typically limited to the LAN.
A stack-based buffer overflow in the Tenda WH450 router (firmware version 1.0.0.18) can be triggered by sending a crafted 'delno' argument to the /goform/PPTPUserSetting configuration endpoint, allowing memory corruption that can be leveraged for code execution or denial of service. Exploitation requires authenticated administrative access to the device's web management interface, since the vulnerable handler is a privileged configuration endpoint (CVSS PR:H), though the attack itself is network-reachable with no user interaction. Publicly available exploit code exists in a GitHub proof-of-concept, and no vendor-released patch has been identified at time of analysis; the affected scope is limited to this specific firmware version, so risk concentrates on devices with exposed or default-credentialed management interfaces.
Stack-based buffer overflow in Tenda WH450 firmware version 1.0.0.18 allows an attacker with administrative access to the router's web management interface to achieve remote code execution by sending an overlong 'ip1' parameter to the /goform/PPTPServer endpoint. The vulnerability requires high privileges (CVSS PR:H) but no user interaction, and publicly available exploit code exists, making it a realistic risk when the admin panel is exposed to untrusted networks or default credentials are used. The CVSS 4.0 score is 7.3, and no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
IP address spoofing in PbootCMS up to and including 3.2.12 lets remote unauthenticated attackers forge their apparent source IP by supplying an arbitrary X-Forwarded-For header, because the get_user_ip() routine in core/function/handle.php treats the client-controlled header as a trusted source. Publicly available exploit code exists and the EPSS score is low at 0.25% (15th percentile), and there is no indication of confirmed active exploitation (no CISA KEV listing). The practical impact is limited to integrity where the deployment consumes the returned IP for access control, rate limiting, geolocation, or audit logging; systems that merely display or ignore the value are effectively unaffected, and there is no code execution, data read, or service disruption.
SQL injection in FantasticLBP Hotels_Server allows remote unauthenticated attackers to manipulate the hotelId parameter in the Room.php endpoint, potentially leading to unauthorized database access or manipulation. Public exploit code is available, but EPSS indicates very low exploitation likelihood and it is not listed in CISA KEV.
Unauthenticated remote access to ZKTeco BioTime's /base/safe_setting/ endpoint exposes stored credential material via manipulable backup_encryption_password_decrypt and export_encryption_password_decrypt parameters, affecting versions 9.0.3, 9.0.4, and 9.5.2. The CVSS 4.0 vector (PR:N/UI:N) and an 'Authentication Bypass' tag confirm no credentials or user interaction are required, enabling any network-reachable attacker to retrieve encryption passwords from the application. A public proof-of-concept exploit is available on GitHub, directly lowering the skill barrier for exploitation, though the vulnerability is not yet listed in CISA KEV.
Information disclosure in JeecgBoot through 3.9.0 allows an authenticated user to retrieve department-role data for arbitrary departments by manipulating the departId parameter sent to /sys/sysDepartRole/getDeptRoleByUserId. Publicly available exploit code exists, but there is no indication of confirmed active exploitation (CISA KEV), and EPSS estimates a 0.41% chance of exploitation in the next 30 days (34th percentile). The vendor vector requires high privileges and adjacent access, while the independent assessment rates it network-reachable with low privileges; both agree the issue is authenticated and read-only, with low confidentiality impact.
A stack-based buffer overflow in PX4-Autopilot (PX4 drone autopilot firmware) up to and including version 1.16.0 allows a locally positioned attacker to corrupt memory in the MAVLink log handler. The flaw lies in MavlinkLogHandler::state_listing() and MavlinkLogHandler::log_entry_from_id(), where log-index lines are parsed with sscanf(line, "%u %u %s", ...) using an unbounded %s conversion that writes an attacker-influenced filepath token into fixed-size stack buffers (filepath[60] in the listing path and LogEntry.filepath in the entry path). Exploitation requires local access and the ability to influence the log directory content that the handler reads, and the assessed impact is limited (low confidentiality, integrity and availability), so this is a genuine but low-to-moderate priority issue. Publicly available exploit code exists (referenced via the upstream issue and pull request) and an upstream fix commit is available, though a tagged patched release was not independently confirmed from the provided data.
OpenCart versions up to 4.1.0.3 are vulnerable to a race condition in the Single-Use Coupon Handler component that allows remote attackers to perform unauthorized manipulation resulting in information disclosure. The attack requires high complexity and no authentication, with a CVSS score of 2.9 indicating low impact. Publicly available exploit code exists, though the vendor did not respond to early disclosure notification.
Information disclosure in PbootCMS up to 3.2.12 allows remote attackers to directly request and download the SQLite database file /data/pbootcms.db, potentially exposing sensitive data. A public exploit is available, but exploitation is difficult and EPSS (0.06%) indicates very low probability of widespread exploitation. No active exploitation has been confirmed.
Command injection in TRENDnet TEW-822DRE firmware versions 1.00B21 and 1.01B06 allows authenticated remote attackers with low privileges to execute arbitrary commands on the device. The vulnerability exists in the /boafrm/formWsc endpoint via the peerPin parameter. A publicly available proof-of-concept exploit exists, but no active exploitation has been reported to date (not listed in CISA KEV).
Command injection in ZSPACE Z4Pro+ firmware 1.0.0440024 allows an authenticated remote attacker to execute arbitrary OS commands by sending a crafted HTTP POST request to the `/v2/file/safe/close` endpoint, processed by the `zfilev2_api_CloseSafe` function without adequate input sanitization. The attack requires low-level authentication (PR:L per the CVSS 4.0 vector) but no user interaction, and a public proof-of-concept is available on GitHub. No public exploit is actively weaponized and no KEV listing exists, though the PoC lowers the bar for adversaries with network access to the device.
Command injection in ZSPACE Z4Pro+ 1.0.0440024 via the /v2/file/safe/open HTTP POST endpoint allows authenticated remote attackers to execute arbitrary commands with limited impact on confidentiality, integrity, and availability. The vulnerability affects the zfilev2_api_open function and has been publicly disclosed with exploit code available; however, the EPSS score of 0.38% (59th percentile) and CVSS scope constraint (SC:N) suggest limited real-world exploitation risk despite authenticated remote access capability.
Public command injection in ZSPACE Z4Pro+ firmware allows authenticated remote attackers to execute arbitrary commands via the zfilev2_api_SafeStatus function in the /v2/file/safe/status endpoint. Low CVSS base score (2.1) and EPSS (0.38%) reflect limited impact and low exploitation probability, but public POC code exists, increasing risk for targeted attacks. No evidence of active exploitation in the wild.
Cross-site scripting (XSS) in dayrui XunRuiCMS up to version 4.7.1 via the JSONP callback argument allows remote attackers to execute arbitrary JavaScript in the context of a victim's browser. Public exploit code is available, but the vulnerability requires user interaction and has low CVSS score (2.1) with minimal EPSS (0.05%), indicating limited real-world exploitation risk. No vendor patch exists; the vendor was unresponsive to disclosure.
Improper authorization in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to modify member address information via the /member/address/update/ endpoint, resulting in unauthorized data manipulation. The vulnerability affects the Member Endpoint component and has publicly available exploit code, though real-world exploitation risk is low based on EPSS scoring (0.05%, 14th percentile) and the requirement for prior authentication.
Path traversal in Tiny File Manager up to 2.6 allows authenticated attackers with high privileges to manipulate the fullpath parameter in tinyfilemanager.php, potentially reading, writing, or deleting files outside the web root. Public exploit code is available, but no active exploitation (CISA KEV) has been confirmed.
Code injection in CmsEasy up to 7.7.7 allows remote attackers with administrative access to execute arbitrary code through the template management feature. The vulnerability exists in the savetemp_action function, which improperly handles the 'content' and 'tempdata' parameters, and a public exploit is available. Exploitation requires high privileges, no active exploitation has been reported, and EPSS indicates very low exploitation probability.
SQL injection in EyouCMS through version 1.7.6 allows authenticated administrators to manipulate the 'content' argument in the Backend Template Management component, potentially leading to unauthorized data access or modification. Public exploit code is available, but no active exploitation has been confirmed by CISA KEV. The vendor has not responded to the disclosure.
Cross-site scripting vulnerability in SohuTV CacheCloud up to version 3.2.0 allows authenticated high-privileged remote attackers to inject arbitrary web script via the doUserList function. Exploit code is publicly available, but exploitation requires user interaction and high privileges, and the very low EPSS score (0.04%) indicates limited likelihood of widespread exploitation.
Stored cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows high-privilege authenticated users to inject malicious scripts via the doTotalList function in TotalManageController.java, which are executed in the browsers of users viewing the affected page. The vulnerability requires user interaction (UI:P) and high privileges (PR:H), limiting real-world impact despite network accessibility. Public exploit code is available, but EPSS probability remains very low (0.04%) due to the authentication and interaction requirements.
Stack-based buffer overflow in the sokol graphics library's pipeline descriptor defaults function allows a local attacker with low privileges to trigger memory corruption. The vulnerability affects all versions up to commit 16cbcc864012898793cd2bc57f802499a264ea40, and a public exploit is available, though active exploitation has not been confirmed by CISA KEV.
SQL injection in the open-source PHP exam application onlinemcqexam (by saiftheboss7) allows remote attackers to manipulate database queries via the ans1 and ans2 parameters of the admin question-addition endpoint /admin/quesadd.php. A public exploit has been disclosed via GitHub, meaning exploitation is not theoretical - any internet-exposed instance with an accessible admin panel is at immediate risk of data exfiltration or manipulation. The vendor did not respond to responsible disclosure, and no patch has been released; the product uses a rolling-release model pinned at commit 0e56806.
SQL injection in phpok3w's show.php allows remote attackers to manipulate database queries by injecting through the ID parameter. The vulnerability affects rolling release versions up to commit 901d96a06809fb28b17f3a4362c59e70411c933c, with a publicly available exploit but no known active exploitation. EPSS prediction is low (0.04%), suggesting limited real-world threat despite the network attack vector.
Improper authorization in JeecgBoot's position management API allows authenticated low-privilege users to enumerate personnel assigned to arbitrary organizational positions by manipulating the positionId parameter at the /sys/position/getPositionUserList endpoint. All versions up to and including 3.9.0 are confirmed affected per NVD CPE data. A publicly available proof-of-concept exploit exists on GitHub, though the CVSS 4.0 score of 1.3 and EPSS of 0.04% (11th percentile) indicate this is a limited-impact, difficult-to-exploit information disclosure - no active exploitation has been confirmed.
Improper authorization in JeecgBoot up to 3.9.0 allows low-privileged authenticated attackers to enumerate department permission information via a crafted request to /sys/permission/queryDepartPermission, leading to limited information disclosure. The vulnerability requires high attack complexity, and while a public exploit is available, no active
Improper authorization in Jeecg Boot up to 3.9.0 allows authenticated remote attackers to bypass permission checks and access sensitive information by manipulating the 'departId' parameter in the /sys/sysDepartPermission/list API endpoint. Exploitation requires low privileges and high attack complexity, and a proof-of-concept exploit is publicly available. EPSS indicates a 0.03% probability of exploitation.
Improper authorization in JeecgBoot up to 3.9.0 allows remote attackers with low privileges to access restricted data rule configuration information. The vulnerability resides in the /sys/sysDepartPermission/datarule/ endpoint and requires high attack complexity. A public exploit is available, but no active exploitation has been confirmed; EPSS indicates very low exploitation probability.
Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to manipulate departId and roleId parameters in the /sys/sysDepartRole/datarule/ endpoint to disclose sensitive information. The vulnerability requires legitimate user access and high exploitation complexity, but publicly available exploit code exists and the vendor did not respond to early disclosure attempts.
Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to access unauthorized department role data via manipulation of the departId parameter in the getDeptRoleList endpoint, resulting in information disclosure of sensitive role assignments. The vulnerability requires login credentials and high attack complexity but has publicly available exploit code; however, real-world exploitation risk remains minimal given the 0.03% EPSS score and authentication prerequisite.
Information disclosure in Jeecg Boot up to version 3.9.0 allows authenticated low-privilege users to access department role data by manipulating the deptId parameter in the /sys/sysDepartRole/list endpoint. The vulnerability has high attack complexity and publicly available exploit code exists, though no active exploitation has been confirmed by CISA KEV. Impact is limited to low confidentiality loss with no integrity or availability impact.
Unrestricted file upload in the h-moses moga-mall Java/Spring e-commerce application lets an authenticated attacker who can reach the addProduct handler in PmsProductController.java upload files of attacker-chosen type and name by manipulating the objectName argument. Exploitation requires a valid low-privileged session (CVSS PR:L) on a remote, network-reachable deployment; it is not a pre-authentication flaw despite the 'Authentication Bypass' tag applied by the reporting source. The assessed impact is Low across confidentiality, integrity and availability (CVSS 3.1 5.3), so the issue does not inherently yield arbitrary code execution, and no public exploit identified at time of analysis - a public technical writeup of the upload path is linked in the references, but no weaponized exploit or CISA KEV entry exists for this CVE.
Authentication bypass in TaleLin Lin-CMS up to version 0.6.0 allows remote attackers to manipulate username and password arguments in the /tests/config.py Tests Folder component, potentially exposing credentials stored in the configuration file. The attack requires high complexity and has been publicly disclosed, but exploitation is considered difficult with an EPSS score of 0.04% indicating very low real-world exploitation probability.
Deserialization weakness in Dromara Sa-Token through version 1.44.0 allows a low-privileged authenticated remote attacker to trigger unsafe object deserialization through the SaJdkSerializer component's ObjectInputStream.readObject call, but only under a narrow set of preconditions. Exploitation requires an application that has explicitly enabled Sa-Token's JDK serialization backend and exposes a code path where attacker-controlled bytes reach readObject; per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) the impact is limited to availability with no confidentiality or integrity effect, and high attack complexity plus vendor-described difficult exploitability mean this is a low real-world risk despite the deserialization tag. No public exploit has been identified at time of analysis, the issue does not appear in CISA KEV, and the maintainers did not respond to early disclosure, so no vendor patch is confirmed.
Improper authentication bypass in xiaozhi-esp32-server-java up to version 3.0.0 allows remote attackers with low-privilege access to bypass cookie-based authentication via crafted requests. A public exploit exists, but no active exploitation has been confirmed, and the exploitation probability is low (EPSS 0.10%). The vulnerability affects the tryAuthenticateWithCookies method in the AuthenticationInterceptor component.
Denial of service in OMEC UPF v2.1.3-dev and earlier allows remote attackers with low privileges to crash the user plane function via a crafted PFCP Session Establishment Request. Public exploit code exists, but the low EPSS score (0.06%) and required authentication limit immediate risk. No active exploitation has been confirmed.
Code injection in ChenJinchuang Lin-CMS-TP5 up to 0.3.3 allows authenticated low-privileged attackers to execute arbitrary code remotely. The flaw resides in the file upload handler
Code injection in the Administrative Panel of SyCms allows remote authenticated administrators to execute arbitrary code. The vulnerability resides in the addPost function of FileManageController.class.php, permitting an attacker with high privileges to inject and run malicious PHP. The product is unmaintained and no patch is available, though public exploit code exists.
Stored cross-site scripting (XSS) in yourmaileyes MOOC up to version 1.17 allows an authenticated attacker to inject malicious scripts via the 'review' parameter of the submission review feature, which executes when another user views the content. The vulnerability has a publicly released exploit, but no patch is available, and EPSS indicates very low exploitation probability (0.04%). This poses a low real-world risk due to limited impact and niche adoption.
Stored cross-site scripting in rawchen ecms allows a high-privileged authenticated attacker to inject persistent JavaScript payloads via the productName parameter on the Add New Product page, which subsequently executes in the browsers of users who view the affected product listings. The vulnerable component is updateProductServlet.java, and the flaw stems from unsanitized input being stored and later rendered without encoding. A public proof-of-concept has been disclosed via GitHub; the vendor has not responded to the disclosure, and no patch is available.
Information disclosure in Halo up to 2.21.10 can be triggered by a remote attacker with low privileges via high-complexity manipulation of the /actuator configuration handler, potentially leaking limited configuration data. Public exploit code exists, but active exploitation has not been confirmed and EPSS indicates a negligible exploitation probability (0.03%). The low CVSS 4.0 score and high attack complexity further reduce the real-world