Weak password recovery in Badaso's authentication controller (up to v2.9.7) allows remote attackers to exploit a flawed token-handling mechanism in the `forgetPassword` function to compromise victim accounts without prior authentication. The vulnerability, classed as CWE-640, indicates the reset token is either predictable, improperly scoped, or insufficiently protected, enabling account takeover when an attacker can trigger and then exploit the recovery flow. A public proof-of-concept exists documenting step-by-step exploitation; the vendor was notified but did not respond, leaving no official patch available. EPSS is 0.04% (14th percentile), consistent with the high-complexity attack requirement and niche product footprint.
Command injection in the SSDP Request Handler (ssdpcgi_main function) of D-Link DIR-806A firmware 100CNb11 allows remote authenticated attackers to execute arbitrary commands with low integrity and availability impact. Publicly available exploit code exists, but the vulnerability affects only end-of-life firmware with minimal real-world exploitation probability (EPSS 0.11%) due to low privilege requirements and limited scope of impact.
Code injection in KodiCMS (Kohana-based) up to version 13.82.135 exposes the Layout API endpoint to remote authenticated attackers who can manipulate the `content` argument of the `Save` function in `file.php` to inject and potentially execute arbitrary code server-side. A public proof-of-concept has been disclosed via VulDB (submission 718290), though EPSS sits at just 0.06% (19th percentile), indicating limited observed exploitation activity. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving deployed instances with no official remediation path.
PHP deserialization in EyouCMS up to version 1.7.7 allows authenticated remote attackers to pass a malicious serialized payload via the `attstr` argument to the `arcpagelist` handler in `application/api/controller/Ajax.php`, where the application calls PHP's `unserialize()` on unvalidated input. A public proof-of-concept exploit has been published and is available, lowering the barrier for opportunistic attackers. The vendor has acknowledged the flaw and committed to a fix in the upcoming v1.7.8 release; no confirmed active exploitation (KEV) has been recorded, and EPSS remains at 0.06%, indicating low observed in-the-wild activity at time of analysis.
Server-side request forgery (SSRF) in EyouCMS versions up to 1.7.7 allows authenticated remote attackers to manipulate the saveRemote function in application/function.php, enabling arbitrary HTTP requests from the server. The vulnerability carries low confidentiality, integrity, and availability impact but is publicly exploitable with proof-of-concept code available. Vendor has acknowledged the flaw and committed to releasing patched version 1.7.8.
Missing authorization in PHPGurukul Small CRM 4.0's /admin/edit-user.php endpoint allows authenticated users to perform unauthorized administrative actions via remote network access. The vulnerability enables privilege escalation or lateral movement by bypassing access controls on user management functions. While publicly available exploit code exists and CVSS indicates network accessibility, the low EPSS score (0.02%, 4th percentile) and requirement for prior authentication suggest limited real-world exploitation despite proof-of-concept availability.
Cross-site scripting in Philipinho's Simple-PHP-Blog allows remote unauthenticated attackers to inject malicious JavaScript via the Username parameter on /login.php, executing arbitrary script in a victim's browser upon interaction with a crafted request. All commits up to 94b5d3e57308bce5dfbc44c3edafa9811893d958 are affected, with no fixed version available due to a rolling release model. A public proof-of-concept exploit exists (EPSS: 0.01%, 3rd percentile), though real-world impact is substantially limited by the vendor's own characterization of the product as intended for educational purposes only.
Code injection in iCMS up to version 8.0.0 allows remote attackers with high privileges to inject arbitrary code via the config POST parameter in the ConfigAdmincp.php component. The vulnerability affects the Save function's parameter handling and has publicly available exploit code, though the extremely low CVSS score (2.0) reflects the requirement for high-privileged authenticated access, limiting real-world risk despite public exploit availability.
Cross-site scripting in EyouCMS up to version 1.7.7 allows a low-privileged remote attacker to inject malicious script content via the `content` argument in the Ask Module (`application/home/model/Ask.php`), which executes in the browser of any user who subsequently views the injected submission. A public proof-of-concept is available, though EPSS at 0.04% (11th percentile) and absence from CISA KEV indicate minimal observed exploitation despite the public PoC. The vendor has acknowledged the flaw and committed to releasing v1.7.8 as the fix, though that release has not been independently confirmed as available at time of analysis.
Cross-site scripting in youlaitech vue3-element-admin through version 3.4.0 allows a remote attacker with high privileges to inject malicious JavaScript via the Notice Handler component (`src/views/system/notice/index.vue`). Successful exploitation requires a privileged account to craft the payload and a separate user interaction to trigger script execution in the victim's browser. A public proof-of-concept exploit exists, though EPSS at 0.04% (14th percentile) and absence from CISA KEV indicate no widespread exploitation; the vendor was unresponsive to coordinated disclosure, leaving no vendor patch available.
SQL injection in KodiCMS (Kohana variant) up to version 13.82.135 allows remote low-privileged attackers to manipulate database queries through the `keyword` argument in the Search API Endpoint's `like` function. The vendor was notified but did not respond, leaving no official patch available. A public exploit exists, though EPSS probability sits at 0.04% (12th percentile), indicating minimal observed exploitation activity despite POC availability - no public exploit identified as confirmed actively exploited (CISA KEV).