We are tasked with synthesizing a comprehensive analysis for CVE-2025-15245. We must output JSON with specific fields. First, gather data: - CVE ID: CVE-2025-15245 - Description: D-Link DCS-850L firmware 1.02.09, uploadfirmware function in Firmware Update Service, path traversal via DownloadFile argument. Attack from local network. Exploit public. Product unsupported. - CVSS: provided as 4.0 vector: AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. So base score 2.0 (low) with public exploit. - EPSS: 0.09% (25th percentile), low - KEV: Not mentioned, so not in CISA KEV. So exploitation status: no public exploit identified? But POC/Exploit says "Publicly available". The description says "The exploit has been made public and could be used." So POC exists. No KEV. So exploitation status: "publicly available exploit code exists". No evidence of active exploitation. - CWE-22: Path traversal. - Tags: D-Link, Path Traversal, Dcs 850L Firmware - References: nvd links include exploit writeup, vuldb, dlink homepage. - CPE: cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09:*:*:*:*:*:*:* (firmware only). Product: D-Link DCS-850L (IP camera). Firmware version 1.02.09. - CVSS vector analysis: Attack vector Adjacent (AV:A), so local network required. Attack Complexity Low (AC:L), Attack Requirements None (AT:N). Privileges Required Low (PR:L) – so some authentication. User Interaction None (UI:N). Vulnerable System Confidentiality Impact Low (VC:L), Integrity None, Availability None. No scope change. So impact limited confidentiality loss (path traversal could allow reading files). Exploit maturity: P (Proof-of-Concept). So overall score is low due to low impact and adjacent network requirement. - The product is no longer supported, so no official patch. That means remediation should suggest specific compensating controls. Now, we need to write each field as a plain text string, a coherent paragraph. product_name: just the product. "D-Link DCS-850L" is good. summary: 2-3 sentences. Must not start with "A vulnerability". Start with impactful verb: "Path traversal in firmware update service of D-Link DCS-850L allows..." Mention affected version, unauthenticated? CVSS says PR:L so requires low privileges. Attack from local network. Public exploit exists. Not actively exploited, EPSS low. Since unsupported, no patch. Use the phrases: "publicly available exploit code exists". It's a low-risk vulnerability overall. So summary: "Path traversal in the Firmware Update Service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." technical_context: Need to explain underlying tech: Firmware update service likely uses a download mechanism that doesn't sanitize user-supplied path, leading to CWE-22 path traversal. Mention the CPE for exact product. So: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09." risk_assessment: Assess using all signals. CVSS: AV:A, AC:L, PR:L, UI:N, scope unchanged, VC:L, VI:N, VA:N. Exploit maturity P. So attack must be from local network, requires low privileges (like authenticated user or someone on the LAN with credentials?), impact is only low confidentiality (file read). EPSS 0.09% indicates low exploitation likelihood. No KEV, so not actively exploited. POC exists but low real-world risk due to adjacent vector and low impact. Product unsupported, so risk is for legacy devices still in use. Mention contrast: "While a public exploit exists, the CVSS score is low (2.0) due to the adjacent network requirement, required low privileges, and limited confidentiality impact (no integrity or availability loss). EPSS score of 0.09% further suggests low exploitation probability. Not listed in CISA KEV, so no active exploitation. The risk is largely limited to environments where unsupported DCS-850L cameras are still deployed and exposed to untrusted local networks." affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/." remediation: No patch available, so suggest compensating controls. Start with "The D-Link DCS-850L is no longer supported, and no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with other known vulnerabilities, so replacement is strongly recommended." Mention advisory URLs: vuldb references. exploit_scenario: "An attacker who has gained access to the local network (e.g., via compromised Wi-Fi credentials) can send a crafted request to the camera's firmware update endpoint with a path traversal payload in the DownloadFile parameter, allowing them to read arbitrary files from the device's filesystem, such as configuration files containing sensitive information. A public proof-of-concept is available." exploitation_conditions: Need specific prerequisites. From description: "The attack must originate from the local network." So adjacent network access. CVSS PR:L means low privileges, implying that the attacker needs some level of authentication (like a valid user account on the camera, or maybe the service is only accessible after login). So conditions: "Exploitation requires an attacker to have network adjacency to the target device, such as being on the same local network segment, and to possess low-privileged credentials to authenticate to the firmware update service. The vulnerability is not exploitable remotely over the internet without SSDP/UPnP misconfigurations. The product is end-of-life and no longer supported, so no patch is forthcoming." No specific configuration required beyond default. attack_chain: "Obtain local network access (e.g., via Wi-Fi) → Authenticate to camera web interface with low-privilege credentials → Craft HTTP request to firmware update service with path traversal in DownloadFile parameter → Camera parses malicious path, traverses directory → Read sensitive file contents, exfiltrate data." That's a chain. confidence_notes: "All data from VulDB via CNA@vuldb.com. EPSS score and CPE from NVD are as provided. No vendor advisory from D-Link confirms unsupported status. POC is publicly available at the referenced Notion page; no independent verification of exploit success. CVSS vector suggests low privileges and adjacent network, but the actual authentication requirement (e.g., whether default credentials may be sufficient) is not fully detailed. Impact appears limited to reading files only, no integrity or availability compromise." prevalence: The product is a D-Link IP camera model DCS-850L. It's an older model, unsupported. Likely low deployment footprint. So "low". prevalence_basis: "unsupported legacy IP camera, low remaining enterprise footprint" assessed_cvss_vector: We need to independently assess. The CVSS 4.0 vector from VulDB is given, but we can assess a 3.1 vector. The vector characteristics: Attack Vector is Adjacent (AV:A) because local network. Attack Complexity Low (AC:L). Privileges Required Low (PR:L). User Interaction None (UI:N). Scope Unchanged (S:U). Confidentiality Low (C:L), Integrity None (I:N), Availability None (A:N). So 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. That matches the given 4.0 vector's mapping. So we'll output that. assessed_cvss_rationale: "Adjacent network access and low privileges are required, leading to AV:A and PR:L; only file read impact, so C:L/I:N/A:N." assessed_cvss40_vector: We can output the given CVSS 4.0 vector or a consistent one: the provided one is already there, but we need to produce our own. Given the same assessment, the 4.0 vector would be: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. No exploit maturity or environmental modifiers, just base. So output that. Now compile all into JSON. Ensure no arrays, only strings. Check each field: - product_name: "D-Link DCS-850L" - summary: A single paragraph. Must not start with "A vulnerability". So: "Path traversal in the firmware update service of D-Link DCS-850L firmware version 1.02.09 allows an attacker on the local network with low privileges to read arbitrary files via the DownloadFile parameter. The vulnerability is publicly known with a proof-of-concept exploit available, but EPSS indicates low exploitation probability and the product is end-of-life with no patch planned. Exploitation is not confirmed in the wild." That's three sentences. Good. - technical_context: "The vulnerability resides in the uploadfirmware function of the firmware update service on the D-Link DCS-850L IP camera. The DownloadFile argument is not properly validated against directory traversal sequences, leading to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. This allows an attacker to read files outside the intended firmware directory. The affected product is identified by CPE cpe:2.3:o:dlink:dcs-850l_firmware:1.02.09." - risk_assessment: "While a public exploit exists, the CVSS score is low (2.0/4.0 or calculated 3.1 base score 3.5?) Actually recalc: AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N gives score 3.5/6.9? Wait, base score: AV:A, AC:L, PR:L, UI:N, S:U, C:L, I:N, A:N. Score: 3.5 (Medium). But the provided CVSS 4.0 score is 2.0, maybe they used different impact. We'll stick with the provided one. But our risk assessment should note the low severity. "The vulnerability presents low confidentiality impact only, and exploitation requires local network access and low privileges. EPSS score of 0.09% suggests limited real-world exploitation activity, and it is not listed in CISA KEV. The combined signals indicate this is a low-priority issue, primarily a concern only if unsupported legacy cameras remain in use on flat, untrusted networks." That's good. - affected_products: "D-Link DCS-850L firmware version 1.02.09 is the confirmed affected version. No other versions are listed. The vendor advisory or CPE does not indicate a range; this specific firmware is vulnerable. The product is end-of-life, and no further firmware updates are expected. Refer to D-Link support page for end-of-life notice: https://www.dlink.com/." - remediation: "The D-Link DCS-850L is no longer supported, so no official patch will be released. Replace the device with a supported model as the primary remediation. If immediate replacement is not possible, apply these specific mitigations: disable the firmware update service if not needed (may prevent legitimate updates), restrict access to the device's admin interface to trusted IP addresses only via network segmentation or firewall rules, and isolate the camera on a separate VLAN with no direct internet connectivity. Note that disabling the firmware update service could leave the camera running outdated firmware with
Stored cross-site scripting in SohuTV CacheCloud up to version 3.2.0 allows low-privileged authenticated attackers to inject JavaScript payloads via the doMachineList or doPodList functions. The vulnerability has a publicly available exploit but is not known to be actively exploited, and the EPSS likelihood is very low (0.06%). Affected users should restrict access and apply input sanitization until a vendor patch is released.
Unrestricted file upload in newbee-mall-plus 2.0.0 permits authenticated high-privilege users to submit arbitrary files through the Product Information Edit Page, bypassing server-side file type validation in UploadController.java. The affected CPE is cpe:2.3:a:newbee-ltd:newbee-mall-plus:2.0.0:*:*:*:*:*:*:*, and a public proof-of-concept has been disclosed via GitHub. No patch is available at time of analysis, as the vendor did not respond to responsible disclosure; however, EPSS at 0.05% (17th percentile) and the PR:H CVSS requirement together indicate low observed exploitation probability despite POC existence.
Unrestricted file upload in BiggiDroid Simple PHP CMS 1.0 allows authenticated administrators to upload arbitrary files - including PHP webshells - via the `image` parameter in the `/admin/edit.php` Site Logo Handler. A public proof-of-concept is confirmed available via Gitee (tagged 'exploit' by NVD), though the EPSS score of 0.05% at the 17th percentile reflects negligible opportunistic exploitation activity. The CVSS 4.0 base score of 2.0 is almost entirely driven by the PR:H administrative credential requirement, making this primarily an insider-threat or post-credential-compromise scenario rather than a direct unauthenticated remote attack.
Open redirect vulnerability in Edimax BR-6208AC firmware versions 1.02 and 1.03 allows authenticated remote attackers to redirect users to arbitrary websites via manipulation of the wlan-url parameter in the formALGSetup web interface function. The vulnerability requires user interaction (clicking a malicious link) and authenticated access, resulting in limited integrity impact. Public exploit code is available, but the device has reached end-of-life status with no further firmware updates planned by Edimax.
Cross-site scripting in SohuTV CacheCloud up to version 3.2.0 affects the index function of AppDataMigrateController, allowing remote attackers to inject arbitrary web scripts. Exploit code is publicly available, but no vendor patch has been released. EPSS indicates low exploitation probability (0.03%), and the vulnerability requires authentication and user interaction.
Stored cross-site scripting (XSS) in Campcodes Park Ticketing System 1.0 allows high-privileged users to inject malicious scripts via the name/ride parameter in the save_pricing function of admin_class.php, affecting user sessions with user interaction. Publicly available exploit code exists, though EPSS scoring (0.02%) and high privilege requirement (PR:H) suggest limited real-world exploitation likelihood despite the low CVSS score of 1.9.
Remote code execution is possible through a heap-based buffer overflow in the S7Client::download function of the gmg137 snap7-rs library. The flaw affects all builds up to git commit 153d3e8c, as the project uses a rolling release model and has not issued a patch. A publicly available exploit allows an attacker who can manipulate PLC responses to potentially execute arbitrary code on the client system.
Server-side request forgery in FeehiCMS 2.1.1 and earlier exposes the bundled TimThumb image-processing script to unauthenticated remote exploitation via a crafted src parameter. An attacker can coerce the application server to issue arbitrary HTTP requests, enabling enumeration of internal network services and cloud metadata endpoints. Exploit code has been publicly disclosed per VulDB submission 718278; EPSS remains very low at 0.04% (14th percentile) and no CISA KEV entry exists, suggesting limited opportunistic exploitation at time of analysis.
Vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery).8.1.1; TheGem (WPBakery): from n/a before 5.8.1.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization in Eagle Booking plugin for WordPress (≤1.3.4.3) allows authenticated attackers to alter booking-related settings or data without proper access controls. This can lead to malicious changes in booking configurations, impacting the integrity and availability of the booking system.
Insecure Direct Object Reference (IDOR) in the FiveStar WordPress theme allows authenticated low-privilege users to modify or delete arbitrary data due to missing authorization checks on user-controlled keys. Versions up to and including 1.7 are affected, and exploitation can lead to integrity and availability impacts without confidentiality loss. No active exploitation or public exploit is currently identified.
Insecure direct object references in the Backpack Traveler WordPress theme (versions <= 2.10.3) allow authenticated attackers with low privileges to modify or disrupt resources belonging to other users by manipulating access control keys. The vulnerability does not permit reading of data, only partial integrity and availability impact. EPSS exploitation probability is very low (0.04%) and no active exploitation or public exploit code is confirmed.
Authorization bypass in the Struktur WordPress theme allows authenticated low-privileged users to circumvent intended access controls by manipulating user-controlled keys. Attackers can modify data or cause availability impacts through IDOR on AJAX endpoints, without needing elevated privileges. No active exploitation or public exploit code is confirmed, and the EPSS score suggests very low wild exploitation likelihood.
HR Management Lite WordPress plugin versions 3.6 and earlier contain a missing authorization vulnerability allowing authenticated users to access or modify resources without proper access control checks. An attacker with low-privilege user credentials can exploit incorrectly configured access control to read or modify sensitive data within the plugin's functionality, though the vulnerability requires prior authentication and does not enable privilege escalation or system-wide impact.
Cross-site request forgery in Ays Pro Popup Box plugin for WordPress up to version 6.0.7 allows an unauthenticated attacker to trick an authenticated administrator into performing unintended actions, such as modifying popup settings, leading to limited integrity and availability impact. EPSS indicates extremely low exploitation probability (0.02%), and no active exploitation or public proof-of-concept is currently identified.
Cross-site request forgery in Heateor Social Login WordPress plugin up to 1.1.39 allows unauthenticated attackers to perform unauthorized actions on authenticated administrators' behalf via crafted links. Exploitation can result in low-impact integrity and availability changes, such as modifying plugin settings. No known public exploit or active exploitation reported.
Missing authorization controls in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (versions up to 4.0.3) allow unauthenticated attackers to exploit incorrectly configured access control security levels, potentially enabling unauthorized modification of cookie consent settings and GDPR compliance configurations. No public exploit code has been identified at time of analysis, though the vulnerability carries a low EPSS score (0.06%, 19th percentile) suggesting minimal real-world exploitation likelihood despite the authorization flaw.
Unauthorized data modification in the HomeFix Elementor Portfolio WordPress plugin (versions ≤1.0.1) allows remote attackers to manipulate portfolio content without authentication. The EPSS score is low (0.06%), indicating minimal exploitation likelihood, and no active exploitation is currently reported. A fix is available in a version beyond 1.0.1; users should upgrade immediately.
Unauthorized remote attackers can retrieve embedded sensitive system information from o2oe E-Invoice App Malaysia plugin versions 1.3.0 and earlier without authentication (CVSS:3.1 AV:N/AC:L/PR:N). The vulnerability exposes confidential data through information disclosure, with EPSS exploitation probability at 0.05% (14th percentile). No public exploit identified at time of analysis, though the low attack complexity and unauthenticated attack vector make exploitation straightforward for adversaries with network access to vulnerable WordPress installations.
Race condition in PHPEMS Coupon Handler component up to version 11.0 allows authenticated remote attackers to manipulate coupon processing logic, potentially resulting in integrity compromise. The vulnerability requires high attack complexity and authenticated access, limiting practical exploitation despite publicly available proof-of-concept code. EPSS score of 0.04% indicates low real-world exploitation probability despite public POC availability.
Missing authorization in the Skywarrior Arcane WordPress theme through version 3.6.6 allows unauthenticated remote attackers to exploit improperly configured access controls, resulting in low availability impact. The vulnerability has a CVSS 3.1 base score of 5.3, an EPSS exploitation probability of only 0.04%, and no evidence of active exploitation or public proof-of-concept code.
Unauthorized information disclosure in the Medicalequipment WordPress theme through version 1.0.9 allows unauthenticated remote attackers to access sensitive data due to a missing authorization check. The EPSS exploitation probability is very low (0.04%) and no active exploitation or public proof-of-concept is known, reducing real-world urgency despite a Medium CVSS score.
Authorization bypass in wpDiscuz WordPress plugin through version 7.6.43 allows unauthenticated remote attackers to access user-controlled data via improperly configured access controls, resulting in limited information disclosure with a CVSS score of 5.3. The vulnerability exploits insecure direct object references (IDOR) where access control checks fail to properly validate object ownership, enabling attackers to enumerate or retrieve comment data they should not access. No public exploit code or active exploitation has been confirmed at this time, though the EPSS score of 0.04% suggests minimal real-world exploitation likelihood despite the relatively accessible attack vector.
Unauthorized information disclosure in XforWooCommerce Product Loops for WooCommerce versions up to 2.1.2 allows remote unauthenticated attackers to access restricted product loop data due to missing authorization checks. No active exploitation or public exploit is known, and EPSS indicates a very low probability of exploitation (0.04%). The vulnerability is classified as a missing authorization issue (CWE-862) with a CVSS 3.1 base score of 5.3 (Medium).
Unauthenticated information disclosure in the Share Print PDF for WooCommerce plugin ≤ 3.1.2 allows remote attackers to access restricted product data via a missing authorization check (CWE-862). The vulnerability carries a CVSS 5.3 (medium) score but has an extremely low EPSS (0.04%), suggesting minimal exploitation likelihood. No active exploitation or public exploit code is known at this time.
Unauthorized data modification in DesignThemes LMS Addon for WordPress up to version 2.6 allows unauthenticated attackers to change LMS content via missing authorization checks. The vulnerability has a Medium CVSS score of 5.3 with low integrity impact and no confidentiality impact. No active exploitation or public exploit code has been identified, and EPSS exploitation probability is low (0.04%).
Missing authorization in WeDesignTech Portfolio plugin for WordPress allows unauthenticated attackers to modify certain data through improperly protected endpoints. All versions up to and including 1.0.2 are affected. There is no evidence of active exploitation or public proof-of-concept, and the low EPSS score indicates a low probability of widespread exploitation.
Information disclosure in SimpleCalendar Google Calendar Events plugin through 3.5.9 allows unauthenticated attackers to read unauthorized calendar event data by exploiting a user-controlled key parameter. The vulnerability arises from a failure to properly verify object ownership, enabling simple direct reference manipulation. No active exploitation or public exploit code has been reported at this time, and EPSS likelihood remains very low (0.04%).
Unauthenticated attackers can modify product delivery date settings in the Product Delivery Date for WooCommerce - Lite plugin up to version 3.2.0 due to missing authorization checks, resulting in low-impact integrity tampering. EPSS indicates a very low exploitation probability (0.04%) and no active exploitation or public exploit code is known at this time.
Server-Side Request Forgery (SSRF) in Youzify WordPress plugin through version 1.3.7 allows authenticated high-privilege users to make arbitrary network requests from the server, exposing internal resources and services. The vulnerability requires administrative credentials (PR:H) but carries high confidentiality impact with EPSS score of 0.04% indicating minimal real-world exploitation likelihood despite the moderate CVSS score of 4.9.
Missing authorization in SiteLock Security WordPress plugin versions through 5.0.1 allows attackers to exploit incorrectly configured access control to bypass security restrictions. Unauthenticated remote attackers can leverage this CWE-862 vulnerability to gain unauthorized access to protected functionality or resources without proper privilege validation. The issue is tagged as an authentication bypass with low EPSS exploitation probability (0.05%, 17th percentile), indicating limited real-world attack likelihood despite the authorization flaw.
Sensitive data exposure in Contact Form 7 Mailchimp Extension plugin for WordPress (versions ≤0.9.68) allows unauthenticated remote attackers to retrieve embedded sensitive information through network-accessible endpoints. The vulnerability enables unauthorized access to confidential data with low attack complexity and no user interaction required. EPSS score of 0.05% (14th percentile) indicates low observed exploitation probability, and no public exploit identified at time of analysis.
Insecure direct object reference (IDOR) in the Eagle Booking WordPress plugin (≤1.3.4.3) enables authenticated users with low privileges to manipulate booking parameters and cancel or disrupt bookings of other users, causing a low availability impact. No active exploitation or public exploit is reported, and EPSS probability is very low (0.04%).
Roxnor PopupKit popup-builder-block plugin through version 2.2.4 exposes sensitive system information to authenticated users via an information disclosure vulnerability. An authenticated attacker can retrieve embedded sensitive data that should not be accessible, potentially gaining insight into system configuration or other restricted information. The CVSS 4.3 score reflects low real-world impact (confidentiality only, low privileges required), and EPSS exploitation probability is minimal at 0.04%, indicating this is a lower-priority vulnerability despite affecting a WordPress plugin.
Aethonic Poptics WordPress plugin through version 1.0.20 exposes sensitive system information to authenticated users through an information disclosure vulnerability. Authenticated attackers with low-level privileges can retrieve embedded sensitive data without user interaction, though exploitation requires valid login credentials. The issue carries a modest CVSS score of 4.3 and extremely low EPSS probability (0.04th percentile), indicating real-world exploitation risk is minimal despite the confirmed vulnerability.
Authenticated users without proper authorization can modify content in the auxin-elements WordPress plugin (versions up to 2.17.15) due to missing access control checks on shortcode functionality. The vulnerability requires an authenticated account with low privileges and allows integrity compromise through shortcode manipulation, with an EPSS score of 0.04% indicating low real-world exploitation likelihood despite confirmed access control weakness.
Information disclosure in Event Organiser plugin for WordPress (versions ≤3.12.8) allows authenticated attackers with low privileges to access restricted event-related data without proper authorization. The vulnerability has a low CVSS score (4.3), no known public exploit or active exploitation, and EPSS predicts very low exploitation probability (0.04%).
Missing authorization in Premio My Sticky Elements plugin (version 2.3.3 and earlier) allows authenticated users to modify data they should not have access to due to incorrectly configured access control security levels. The vulnerability requires an authenticated attacker with low privileges and carries a CVSS score of 4.3 with low real-world exploitation probability (EPSS 0.04%). No public exploit code or active exploitation has been identified.
Authenticated users with low privileges in WordPress can exploit missing authorization in the Stratum plugin (≤1.6.1) to perform unauthorized data modifications. The vulnerability has a CVSS score of 4.3 and a low EPSS likelihood, with no known active exploits or public proof-of-concept available.
Cross-site request forgery (CSRF) vulnerability in the Easy Property Listings XML/CSV Import plugin for WordPress (versions <= 2.2.1) allows attackers to perform unauthorized actions on behalf of authenticated administrators without their knowledge or consent. The vulnerability affects the import functionality and carries minimal real-world exploitation risk based on EPSS scoring (0.02%, 5th percentile), indicating low likelihood of automated exploitation despite the CSRF vector requiring no special privileges or authentication from the attacker's perspective.
Authenticated high-privilege users can exploit missing authorization checks in the Automattic Crowdsignal Forms plugin for WordPress (versions <= 1.7.2) to perform unauthorized data modifications or service disruptions, leading to low integrity and availability impacts. The vulnerability carries a CVSS base score of 3.8, a very low EPSS exploitation probability (0.03%), and there is no evidence of active exploitation or public exploit code.
Deserialization vulnerability in aizuda snail-job up to version 1.7.0 on macOS allows remote attackers with low privileges to execute arbitrary code by supplying malicious serialized data to the argsStr argument of the FurySerializer.deserialize function. Public exploit code is available, though no active exploitation has been confirmed at the time of analysis.
Credential leakage in the Ruby URI gem's `+` operator allows sensitive userinfo (username and password embedded in URIs) to persist when the host portion of a URI is replaced, violating RFC3986. This flaw affects URI gem versions bundled across the Ruby 3.2, 3.3, and 3.4 release series and represents a bypass of the prior fix for CVE-2025-27221, which patched equivalent behavior in `URI#join` and `URI#merge` but left `URI#+` unaddressed. No public exploit code has been identified and EPSS is 0.01%, but applications that embed credentials in URIs and dynamically combine them using `+` are concretely at risk of sending those credentials to attacker-controlled hosts.
Code injection in 08CMS Novel System (versions up to 3.4) allows remote authenticated administrators to inject and execute arbitrary code via the Template Handler component (admina/mtpls.inc.php). The vulnerability requires high privileges to exploit, limiting its scope to users with admin-level access to the CMS. A public proof-of-concept exploit has been disclosed, though EPSS stands at 0.06% (17th percentile), indicating no widespread opportunistic exploitation has been observed. No CISA KEV listing confirms active exploitation at time of analysis.
Open redirect vulnerability in CloudPanel Community Edition up to version 2.5.1 allows authenticated attackers with user interaction to redirect users to arbitrary external websites via a malicious Referer header in the /admin/users endpoint. The vulnerability carries a CVSS 2.0 score with low severity impact, EPSS exploitation probability of 0.04%, publicly available exploit code, and vendor-confirmed patch in version 2.5.2.
Stored or reflected cross-site scripting in sunhailin12315/product-review allows authenticated users to inject malicious JavaScript via the content parameter in the Write a Review component, which executes in other users' browsers when they view the review. Exploitation requires valid user credentials and victim interaction with the malicious review content. Public proof-of-concept code exists, but EPSS exploitation probability remains at 0.04%, indicating minimal real-world targeting despite the attack surface.
Remote deserialization in Dromara Sa-Token up to version 1.44.0 allows low-privileged authenticated attackers to transmit maliciously crafted serialized Java objects, potentially leading to limited data tampering or availability impacts. Exploitation is difficult (high complexity), and public exploit code exists, but EPSS score of 0.06% indicates low real-world exploitation likelihood. No active exploitation or CISA KEV listing has been confirmed.
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init blk-iocost sometimes causes the following crash:. No vendor patch available.
In the Linux kernel, the following vulnerability has been resolved: arm64: set __exception_irq_entry with __irq_entry as a default filter_irq_stacks() is supposed to cut entries which are related irq. No vendor patch available.