Command injection in D-Link DWR-M920 firmware up to version 1.1.50 allows authenticated remote attackers to execute arbitrary commands via the fota_url parameter in the /boafrm/formLtefotaUpgradeQuectel endpoint. Public exploit code is available, though EPSS exploitation probability remains low at 0.20% percentile, suggesting limited real-world exploitation despite proof-of-concept availability.
Remote command injection in D-Link DWR-M920 routers allows authenticated attackers with low privileges to execute arbitrary commands on the device. The flaw exists in the fota_url parameter of the formLtefotaUpgradeFibocom handler in firmware versions up to 1.1.50. Exploit code is publicly available, but no evidence of active exploitation exists, and EPSS suggests low exploitation probability.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via manipulated a/b/c/d arguments in /home/editfood.php, affecting confidentiality and integrity of stored data. The vulnerability has a public exploit available but carries low real-world risk due to authentication requirement and minimal scope (CVSS 2.1, EPSS 0.05%). Active exploitation is not confirmed in CISA KEV despite public POC availability.
Reflected cross-site scripting (XSS) in Advaya Softech GEMS ERP Portal versions up to 2.1 allows remote attackers to inject malicious scripts via the Message parameter in /home.jsp?isError=true, exploitable without authentication or user interaction beyond viewing a crafted link. Public exploit code is available, though the CVSS score of 2.1 reflects limited integrity impact and requirement for user interaction; the vulnerability is unlikely to see widespread exploitation despite public disclosure due to low EPSS score (0.05%).
SQL injection in Student File Management System 1.0 via the istore_id parameter in /download.php allows authenticated remote attackers to execute arbitrary SQL queries with limited information disclosure impact. The vulnerability requires valid user credentials (PR:L) and has a CVSS score of 2.1 with EPSS exploitation probability of 0.04%, indicating low real-world risk despite public exploit availability.
Remote path traversal in GreenCMS up to version 2.3 allows authenticated high-privilege attackers to manipulate the sqlFiles/zipFiles parameters in the File Handler component, leading to unauthorized file access or modification. The vulnerability is exploitable over the network but requires administrative access; public exploit code exists, yet no active exploitation is confirmed. GreenCMS is end-of-life and no longer supported.
Unrestricted file upload vulnerability in News-Buzz 1.0 (part of the code-projects/anirbandutta9 Content Management System) allows authenticated administrators to upload arbitrary files via the image parameter of /admin/editposts.php. Public exploit code exists, but the EPSS exploitation probability is very low (0.05%), and no active exploitation has been confirmed. Successful exploitation could lead to remote code execution if combined with other weaknesses.
Cross-site scripting in SohuTV CacheCloud up to version 3.2.0 allows remote authenticated attackers with low privileges to inject arbitrary web script or HTML via the doAppAuditList function. A victim must visit a crafted audit listing page for the script to execute, which can lead to session hijacking or page defacement. Public exploit code is available but EPSS indicates a low probability of widespread exploitation.
Cross-site scripting (XSS) in SohuTV
Cross-site scripting in SohuTV CacheCloud version 3.2.0 and earlier allows remote authenticated attackers with low privileges to inject arbitrary scripts via the preview function of the RedisConfigTemplateController. Public exploit code exists, but the project has not yet released a fix. The EPSS score is very low (0.03%) and no active exploitation is confirmed.
Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows authenticated remote attackers to inject malicious scripts via the index function in ServerController.java, requiring user interaction to execute. The exploit is publicly available on GitHub, though the project maintainers have not responded to early disclosure reports. With an EPSS score of 0.03% and CVSS 2.0 severity, real-world exploitation risk is minimal despite public POC availability.
Cross-site scripting in SohuTV CacheCloud up to 3.2.0 allows remote attackers to inject arbitrary web scripts or HTML via the redirectNoPower function in WebResourceController.java. The flaw requires a low-privileged authenticated user to interact with a crafted link. Public exploit code exists, but no active exploitation has been confirmed.
Cross-site scripting in SohuTV CacheCloud up to version 3.2.0 permits a low‑privileged attacker to inject arbitrary JavaScript through the app management controller. An authenticated user can craft a malicious request to doAppList or appCommandAnalysis that, when viewed by another user (likely an administrator), executes script in the victim’s browser. Exploitation requires user interaction and is not yet seen in the wild, and EPSS indicates very low likelihood of widespread targeting.
SQL injection in BiggiDroid Simple PHP CMS 1.0 allows authenticated attackers with high privileges to manipulate database queries via the ID parameter in /admin/editsite.php. The vulnerability is remotely exploitable, and publicly available exploit code exists, though there is no evidence of active exploitation. The impact is limited due to the admin privilege requirement, and the EPSS score is extremely low (0.01%), indicating minimal real-world risk.
Stored/reflected cross-site scripting in SohuTV CacheCloud up to 3.2.0 enables authenticated administrators to inject web scripts via statistics endpoints. Exploit code is publicly available, but high privileges and user interaction severely limit impact.
Cross-site scripting in Campcodes Complete Online Beauty Parlor Management System 1.0 allows authenticated administrators to inject arbitrary JavaScript via the 'searchdata' parameter in the admin invoice search page. An attacker with high privileges can craft a request that, when viewed by another admin, executes malicious scripts, potentially leading to session hijacking or defacement. The vulnerability has a publicly available exploit but requires user interaction and administrative access.
Stored cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows high-privileged authenticated users to inject malicious scripts via the doQuartzList function in QuartzManageController.java, affecting users who interact with crafted content. The vulnerability requires high privileges (PR:H) and user interaction (UI:P), limiting real-world impact despite remote network accessibility. Public exploit code is available, but EPSS exploitation probability is exceptionally low at 0.04% (11th percentile), suggesting the attack requires substantial prerequisites unlikely to occur in typical deployments.
Cross-site scripting (XSS) vulnerability in CacheCloud's ResourceController index endpoint permits authenticated administrators to inject arbitrary web scripts. Attackers with high privileges can exploit this remotely, though user interaction is required. Exploit code is publicly available, but no active exploitation has been confirmed.
Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows authenticated high-privilege users to inject malicious scripts via the taskQueueList function in TaskController.java, requiring user interaction for exploitation. The vulnerability has publicly available exploit details and a low EPSS score of 0.04%, indicating minimal real-world exploitation risk despite the public disclosure.
Unrestricted file upload in code-projects College Notes Uploading System 1.0 allows authenticated low-privilege attackers to upload arbitrary files via the profile image function. A publicly available exploit exists, but EPSS exploitation probability is very low (0.05%, 15th percentile). Impact is limited to file manipulation without confirmed remote code execution.