Authorization Bypass in Crocoblock JetPopup WordPress plugin through version 2.0.20.1 allows attackers to exploit incorrectly configured access control security levels via user-controlled keys, enabling unauthorized access to protected popup content and functionality. EPSS score of 0.04% indicates low exploitation probability despite the authorization flaw; no public exploit code or active exploitation has been identified.
Unrestricted file upload in code-projects College Notes Uploading System 1.0 allows authenticated low-privilege attackers to upload arbitrary files via the profile image function. A publicly available exploit exists, but EPSS exploitation probability is very low (0.05%, 15th percentile). Impact is limited to file manipulation without confirmed remote code execution.