Stored XSS in TrueConf Server 5.5.2.10813 on Windows enables authenticated low-privileged users to inject malicious JavaScript via the meeting_room parameter in the conference creation/editing interface. The payload persists server-side and executes in any victim's browser upon visiting the Conference Info page, enabling full Account Takeover (ATO). A publicly available proof-of-concept exploit exists; the CVE is not listed in CISA KEV at time of analysis.
Command injection in Serverless Framework versions 4.29.0 through 4.29.2 allows remote code execution through the experimental MCP server feature (@serverless/mcp package). Attackers can inject arbitrary shell commands via unsanitized input parameters passed to child_process.exec, achieving RCE under server process privileges. Publicly available exploit code exists (GHSA-rwc2-f344-q6w6). Impact is limited to less than 0.1% of users utilizing the experimental serverless mcp feature. EPSS probability is low at 0.05% (16th percentile).
CSV formula injection in TrueConf Server 5.5.2.10813 on Windows allows an authenticated low-privileged user to embed malicious spreadsheet formulas into exported chat logs by setting a crafted Display Name. When an administrator or privileged user exports those chat logs to CSV and opens the file in spreadsheet software such as Microsoft Excel or LibreOffice Calc, the injected formula executes in the context of the victim's workstation, potentially enabling OS command execution or data exfiltration. A publicly available proof-of-concept exists; EPSS probability is low at 0.27% (20th percentile), and the vulnerability is not currently listed in the CISA KEV catalog.
Local code execution in TrueConf Client 8.5.2 lets an already-authenticated local user run arbitrary code in the context of the victim user by planting a malicious wfapi.dll that the application loads insecurely (CWE-427). Publicly available exploit code exists, but there is no public exploit identified in the sense of active exploitation - it is not listed in CISA KEV and EPSS is low (0.17%, 6th percentile), indicating little observed real-world exploitation activity. The impact is confined to the current user's context (no privilege escalation to SYSTEM claimed).
Remote command execution in JD Cloud NAS-series routers (AX1800, AX3000, AX6600, BE6500, ER1 and ER2 firmware) allows unauthenticated network attackers to inject and run arbitrary OS commands on the device. The flaw is rated CVSS 9.8 with an unauthenticated network vector, and while no public exploit has been identified, its EPSS of 1.01% (59th percentile) reflects moderate near-term exploitation likelihood. Successful abuse yields full control of the router, making it a pivot point into the internal network.
Command injection in the Edimax BR-6208AC V2 web-based configuration interface exposes unauthenticated remote attackers to arbitrary OS command execution by manipulating the `rootAPmac` parameter submitted to the `/goform/formStaDrvSetup` handler. Firmware versions 1.02 and 1.03 are confirmed affected, and Edimax has explicitly stated the device has reached End of Life with no firmware patch forthcoming - making this a permanent, unmitigable vulnerability for any unit still in service. A public proof-of-concept is available, and no public exploit identified at time of analysis in CISA KEV, though the 67th-percentile EPSS score suggests elevated risk relative to the broader CVE population.
CSRF vulnerability in WING WordPress Migrator plugin through version 1.2.0 permits unauthenticated attackers to upload web shells to affected WordPress sites by tricking site administrators into visiting a malicious webpage. The vulnerability exploits missing nonce verification in file upload functionality, enabling arbitrary code execution with web server privileges. No public exploit code or active exploitation confirmed at time of analysis.
Command injection in the Edimax BR-6208AC V2 web-based configuration interface (firmware 1.02 and 1.03) allows remote attackers to execute arbitrary OS commands by manipulating routing parameters in the formRoute handler, with no authentication or user interaction indicated as required per the CVSS 4.0 vector. The vendor has confirmed the device is End of Life and has explicitly declined to release any remediation, making hardware replacement the only definitive fix. A public proof-of-concept exploit exists; no CISA KEV listing was identified at time of analysis, and the EPSS score of 0.39% at the 60th percentile suggests limited observed exploitation to date despite PoC availability.
SQL injection in itsourcecode Society Management System 1.0 exposes the /admin/add_admin.php endpoint to unauthenticated remote attackers who can manipulate the Username parameter to execute arbitrary SQL queries against the backend database. The vulnerability is classified under CWE-74 (Injection) and a publicly available proof-of-concept has been published on GitHub, though EPSS sits at a low 0.04% (11th percentile) and it is not listed in CISA KEV, indicating no confirmed widespread exploitation. Given the product's hobbyist/academic PHP codebase and limited deployment footprint, real-world impact is likely narrow but trivially exploitable wherever the system is running.
SQL injection in itsourcecode Society Management System 1.0 allows remote attackers to manipulate database queries via the Username parameter in the edit_admin_query function at /admin/edit_admin_query.php. The affected product is a free PHP-based web application distributed by itsourcecode.com, pinned at version 1.0 with no patch released. Publicly available exploit code exists per the GitHub PoC reference, though EPSS sits at 0.04% (11th percentile), indicating limited observed exploitation activity in the wild despite disclosure.
SQL injection in BiggiDroid Simple PHP CMS 1.0 exposes the admin login endpoint to remote, unauthenticated database manipulation via the Username parameter at /admin/login.php. A public proof-of-concept exploit is available on Gitee, enabling authentication bypass or database exfiltration with no prior credentials required. No vendor patch has been released, and the product is not listed in CISA KEV; however, the public PoC materially lowers the bar for opportunistic exploitation against any internet-exposed installation.
SQL injection in Simple Stock System 1.0’s login page allows unauthenticated remote attackers to manipulate database queries via the Username field. Exploit code is publicly available, but the vulnerability has not been reported as actively exploited (EPSS 0.04%). Successful exploitation could enable limited data exposure, tampering, or disruption, as reflected by low impact scores in the CVSS vector.
Stored HTML injection (CWE-79) in TrueConf Server 5.5.2.10813 on Windows enables an authenticated attacker to embed arbitrary HTML into a conference's description field, which executes in the browser of any user who visits the Conference Info page at [conference_url]/info. The CVSS Scope Change (S:C) reflects cross-context impact - payloads escape the originating session and execute within victims' browser contexts, enabling session hijacking or phishing. A public proof-of-concept is confirmed on GitHub; however, EPSS at 0.17% (7th percentile) and absence from CISA KEV indicate no known widespread exploitation at time of analysis.
Blind SQL injection in BWL Pro Voting Manager WordPress plugin (≤1.4.9) allows authenticated attackers (e.g., subscriber) to extract sensitive information from the database by crafting malicious SQL statements. Exploitation requires a low-privilege user account and no user interaction. No active exploitation or public proof-of-concept is currently known, and EPSS indicates a low probability of widespread exploitation.
We need to produce a JSON with specific fields about CVE-2025-69034. Input data: CVE ID, description, CVSS score 8.1, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')), EPSS 0.06% (20% percentile), reported by audit@patchstack.com, CPE: cpe:2.3:a:qodeinteractive:lekker:*:*:*:*:*:wordpress:*:*, tags: Information Disclosure, PHP, LFI, Lekker, references: nvd link but it says (None) and then a patchstack URL. Actually, the references say: [nvd] (None) https://patchstack.com/database/Wordpress/Theme/lekker/vulnerability/wordpress-lekker-theme-1-8-local-file-inclusion-vulnerability?_s_id=cve. That seems to be a single reference from Patchstack. No indication of KEV status, POC availability, patch availability, etc. So we must synthesize based on given data. We'll need to infer from description: "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Lekker lekker allows PHP Local File Inclusion. This issue affects Lekker: from n/a through <= 1.8." Mikado-Themes? Actually the vendor in CPE is qodeinteractive, that might be the parent. So product name: Lekker (WordPress theme). "Lekker" appears twice. Fields: product_name: "Lekker" (1-3 words, specific product). Could say "Lekker WordPress Theme". I'll do "Lekker Theme" or "Lekker (WordPress)". Rules: 1-3 words. I'll go with "Lekker Theme". summary: Avoid starting with "A vulnerability...". Start with impact verb and product: "Local file inclusion in the Lekker WordPress theme (versions ≤ 1.8) allows unauthenticated remote attackers to read arbitrary files on the server, potentially leading to sensitive data exposure and code execution." The description says "PHP Remote File Inclusion" but then says "allows PHP Local File Inclusion". So it's LFI. Exploitation status: no public exploit identified. EPSS is very low (0.06%), 20t
Blind SQL Injection in Appointify WordPress plugin version 1.0.8 and earlier allows unauthenticated remote attackers to execute arbitrary SQL commands against the underlying database. The vulnerability enables data extraction and manipulation through time-based or error-based inference techniques without requiring valid credentials or authentication. EPSS score of 0.04% indicates low statistical likelihood of exploitation despite the technical severity of SQL injection.
Local file inclusion in Edge-Themes Cinerama WordPress theme versions ≤2.9 enables unauthenticated remote attackers to read arbitrary server files through PHP file inclusion weaknesses. Despite the CVSS critical rating of 9.8, EPSS probability is low (0.17%, 38th percentile) with no public exploit identified at time of analysis. The vulnerability allows server-side file reading which could expose configuration files, credentials, and sensitive data without authentication requirements.
Local file inclusion in the Aora WordPress theme (<=1.3.15) allows authenticated attackers with low privileges to read arbitrary files on the server. The high attack complexity and lack of known public exploit code currently limit widespread abuse, but the high CVSS impact scores indicate a potential to escalate to code execution if combined with other techniques. This vulnerability is not listed in CISA KEV and has a very low EPSS (0.17%), suggesting it is not currently a priority target for mass exploitation.
Local file inclusion in the Puca WordPress theme (versions ≤2.6.39) allows authenticated attackers with low-privilege access to include arbitrary local PHP files. Successful exploitation can lead to sensitive data exposure or code execution, but requires high attack complexity. No public exploit or active exploitation has been reported.
Local File Inclusion vulnerability in Greenmart WordPress theme versions up to and including 4.2.11 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation nor public exploit code has been identified, and EPSS predicts a low likelihood of widespread exploitation (0.17%).
Local file inclusion vulnerability in MadrasThemes MAS Videos WordPress plugin versions up to 1.3.4 allows unauthenticated attackers to read arbitrary files from the affected server through improper control of filename parameters in PHP include/require statements. The vulnerability affects the masvideos plugin and has been tracked by Patchstack with an EPSS score of 0.17% (38th percentile), indicating low exploitation probability despite the presence of information disclosure risk.
Local file inclusion in WebCodingPlace Responsive Posts Carousel Pro plugin for WordPress allows authenticated attackers to read arbitrary files on the server, potentially leading to remote code execution. The vulnerability affects versions <= 15.1 and requires low-privilege user authentication. At time of analysis, no public exploit code is known and exploitation probability is low based on EPSS (0.12%).
CubeWP framework plugin through version 1.1.27 fails to enforce proper access control checks, allowing attackers to access functionality that should be restricted by access control lists. This authentication bypass vulnerability has low real-world exploitation probability (EPSS 0.05%) but represents a fundamental authorization flaw in the plugin's architecture that could enable privilege escalation or unauthorized feature access depending on implementation context.
Reflected cross-site scripting (XSS) in the Off Page SEO WordPress plugin through version 3.0.3 allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper input neutralization during page generation, enabling attackers to steal session cookies, redirect users, or perform actions on behalf of victims through crafted URLs. No public exploit code has been identified, and the low EPSS score (0.04%) suggests minimal real-world exploitation likelihood despite the moderate theoretical attack surface.
Reflected cross-site scripting (XSS) in the Product Puller WordPress plugin through version 1.5.1 allows unauthenticated attackers to inject malicious JavaScript into web pages viewed by other users. The vulnerability stems from improper input sanitization in the plugin's request handling, enabling attackers to craft malicious URLs that execute arbitrary scripts in victim browsers. No public exploit code has been identified, and the EPSS score of 0.04% indicates low exploitation probability in the wild, though the vulnerability remains remotely exploitable without authentication.
Reflected XSS in Sleekplan WordPress plugin through version 0.2.0 allows unauthenticated remote attackers to inject malicious scripts into web pages viewed by users. The vulnerability exists in the plugin's input handling during web page generation, enabling attackers to steal session cookies, perform unauthorized actions on behalf of victims, or redirect users to malicious sites. No active exploitation has been confirmed, but the attack vector is network-based with low complexity.
Reflected cross-site scripting (XSS) in the Rakessh Ads24 Lite WordPress plugin (wp-ad-management) up to version 1.0 allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper input neutralization during web page generation, enabling attackers to craft malicious URLs that execute arbitrary JavaScript in victims' browsers when visited, potentially compromising user sessions, stealing credentials, or defacing content. No public exploit code or active exploitation has been confirmed at the time of analysis, though the low EPSS score (0.04%) suggests limited real-world exploitation likelihood despite the straightforward attack vector.
WP-CalDav2ICS WordPress plugin through version 1.3.4 contains a Cross-Site Request Forgery (CSRF) vulnerability that enables Stored XSS attacks. The vulnerability allows unauthenticated attackers to craft malicious requests that, when executed by a logged-in administrator or user, inject persistent malicious scripts into the plugin's stored data. This combined CSRF+XSS chain can lead to persistent compromise of the WordPress site through script injection.
Race condition in the Purchase Request Handler of PHPEMS up to version 11.0 allows remote attackers to corrupt purchase data integrity under precise timing conditions. Exploitation requires high complexity and many attempts, with limited impact on information disclosure. A public proof-of-concept is available, but no active exploitation has been confirmed.
Local file inclusion in miniOrange Social Login and Register plugin for WordPress allows authenticated attackers with administrative privileges to read arbitrary files on the server, potentially leading to full site compromise. The vulnerability affects all plugin versions up to 7.7.0, and while no active exploitation or public exploit has been identified, EPSS data indicates a low probability of exploitation. High attack complexity and the requirement for administrative access limit immediate urgency but still pose a risk in environments where admin credentials could be abused.
WP Project Manager plugin through version 3.0.1 exposes sensitive information in sent data due to improper information handling, allowing attackers to retrieve embedded sensitive data without authentication. The vulnerability affects all installations of the weDevs plugin and has been identified with an extremely low EPSS score (0.05%, 14th percentile), suggesting minimal practical exploitation likelihood despite the information disclosure classification.
DOM-based cross-site scripting (XSS) in WPCal.io WordPress plugin versions 0.9.5.9 and earlier allows attackers to inject malicious scripts into web pages viewed by users. The vulnerability stems from improper neutralization of user input during web page generation, enabling attackers to execute arbitrary JavaScript in the context of affected websites. No CVSS score is available, but the EPSS score of 0.04% (14th percentile) indicates low practical exploitation likelihood despite the XSS vector being a common attack class.
Stored cross-site scripting (XSS) in Yada Wiki WordPress plugin through version 3.5 allows authenticated users to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability stems from improper input sanitization during web page generation, enabling persistent XSS attacks that could compromise site integrity, steal credentials, or perform actions on behalf of administrators. EPSS exploitation probability is very low at 0.04%, but the stored nature of the vulnerability means injected payloads persist across sessions.
DOM-based cross-site scripting (XSS) in 8theme XStore Core plugin (et-core-plugin) versions below 5.6 allows attackers to inject malicious scripts that execute in users' browsers during web page generation. The vulnerability affects WordPress installations using the vulnerable plugin, and while no CVSS score was assigned, the extremely low EPSS score (0.04%) suggests minimal real-world exploitation likelihood despite the XSS classification.
Stored cross-site scripting (XSS) in webcreations907 WBC907 Core WordPress plugin versions up to 3.4.1 allows attackers to inject and execute malicious JavaScript that persists in the application, potentially compromising users who view affected pages. The vulnerability stems from improper input neutralization during web page generation. No public exploit code or active exploitation has been identified at the time of analysis, though the attack vector and complexity depend on the specific injection point within the plugin.
Stored cross-site scripting (XSS) in CodeFlavors Featured Video for WordPress (VideographyWP) plugin version 1.0.18 and earlier allows authenticated attackers to inject malicious scripts that execute in the browsers of other site users, potentially compromising administrator accounts and site integrity. The vulnerability stems from improper input sanitization during web page generation, and no public exploit code has been identified at the time of analysis.
Stored Cross-Site Scripting (XSS) in Magnigenie RestroPress WordPress plugin through version 3.2.8.4 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or defacing content. The vulnerability requires user interaction (UI:R) and affects only authenticated attackers (PR:L), limiting immediate exploitation risk despite the moderate CVSS score of 6.5. No public exploit code or active exploitation has been confirmed at time of analysis.
DOM-based cross-site scripting (XSS) in Crocoblock JetTabs WordPress plugin versions up to 2.2.12 allows attackers to inject malicious scripts that execute in users' browsers when viewing affected pages. The vulnerability stems from improper input neutralization during web page generation, enabling stored or reflected XSS attacks without requiring authentication. With an EPSS score of 0.04% (14th percentile), exploitation likelihood is very low despite the publicly documented vulnerability.
Missing authorization in Crocoblock JetTabs WordPress plugin version 2.2.12 and earlier allows unauthenticated or low-privileged attackers to bypass access control restrictions and exploit misconfigured security levels. The vulnerability stems from improper validation of user permissions before executing sensitive operations, potentially enabling unauthorized access to restricted plugin functionality or data.
Unauthorized information disclosure in BizPrint plugin for WooCommerce allows authenticated attackers with low privileges to read sensitive data via a network request. The vulnerability stems from a missing authorization check (CWE-862) in versions up to and including 4.6.7, exposing data such as order or customer information. No active exploitation or public exploit code has been identified, and EPSS indicates a very low probability (0.04%) of widespread exploitation.
Cross-site scripting (DOM-based) in BWL Pro Voting Manager WordPress plugin allows authenticated users with low privileges to inject malicious scripts that execute in administrators' browsers when viewing voting results. Affected versions through 1.4.9. No active exploitation known (not in CISA KEV) and EPSS score is very low (0.04%), indicating minimal current exploitation risk.
DOM-based cross-site scripting in the DesignThemes Core WordPress plugin (≤1.6) enables authenticated attackers with low privileges to inject arbitrary web scripts. When a higher-privileged victim interacts with the malicious content, the injected script executes in their browser, potentially leading to session hijacking or unauthorized actions. No public exploit or active exploitation has been reported at the time of analysis, and EPSS indicates a low exploitation probability.
Cross-site scripting (XSS) vulnerability in the DesignThemes Portfolio Addon WordPress plugin through version 1.5 allows authenticated users with contributor-level privileges to inject and execute arbitrary web scripts via DOM manipulation. An attacker can craft malicious portfolio content that triggers script execution when another user (such as an admin) views the affected page, potentially leading to session hijacking, credential theft, or site defacement. No active exploitation or public exploit code has been identified at this time.
OS command injection in the Tenda W6-S wireless router firmware 1.0.0.4(510) allows a remote authenticated attacker to execute arbitrary operating system commands by sending crafted input to the TendaAte function via the /goform/ate endpoint of the ATE (Automatic Test Equipment) diagnostic service. A public proof-of-concept exploit exists on GitHub, raising practical risk despite the low official CVSS 4.0 score of 2.1. No active exploitation has been confirmed by CISA KEV, but EPSS places this at the 76th percentile, reflecting non-trivial exploitation likelihood given POC availability.
Command injection in D-Link DI-7400G+ firmware 19.12.25A1 allows a remote low-privileged attacker to execute arbitrary OS-level commands via the `cmd` parameter of the `/msp_info.htm?flag=cmd` web endpoint. A public proof-of-concept exploit is available on GitHub, raising the practical threat level above the low EPSS score suggests. No active exploitation has been confirmed by CISA KEV, and the official CVSS 4.0 score of 2.1 appears to significantly understate the impact of arbitrary command execution on a network device.
SQL injection in code-projects Refugee Food Management System 1.0 allows remote attackers to inject arbitrary SQL via the 'a' parameter in /home/regfood.php, potentially reading or altering database content. A public exploit exists, but the CVSS 4.0 base score is low (2.1) and EPSS exploitation probability is only 0.05%, indicating very limited real-world risk.
Reflected cross-site scripting (XSS) in SohuTV CacheCloud up to version 3.2.0 allows remote attackers to inject malicious scripts via the LoginController initialization function, requiring user interaction to execute. The vulnerability has a public exploit available but represents low real-world risk due to CVSS 2.1 score, minimal EPSS exploitation probability (0.04%), and the requirement for user click-through. The vendor has not responded to early disclosure through a GitHub issue.
SQL injection in Refugee Food Management System 1.0 allows authenticated remote attackers to manipulate refNo, Fname, Lname, sex, age, contact, and nationality_nid parameters in /home/refugee.php, enabling unauthorized database query execution with limited confidentiality and integrity impact. The vulnerability requires login credentials (PR:L), has publicly available exploit code, and carries a low CVSS score (2.1) despite active proof-of-concept publication, indicating minimal real-world risk due to authentication barrier and restricted impact scope.
SQL injection in Refugee Food Management System 1.0 (/home/editrefugee.php) allows authenticated remote attackers to manipulate database queries via unsanitized parameters such as 'a', 'b', 'sex', 'nationality_nid'. Exploitation requires low-level user privileges. A public proof-of-concept is available, but no active exploitation has been confirmed, and EPSS indicates low exploitation probability.
Information disclosure vulnerability in Student File Management System 1.0 allows low-privileged authenticated users to access arbitrary files via the store_id parameter in /download.php. A public proof-of-concept exploit exists, but EPSS is 0.03% (very low exploitation probability) and no active exploitation has been reported. Exploitation requires authentication, limiting the attack surface.