Bagisto eCommerce platform before 2.3.10 is vulnerable to server-side template injection (SSTI) through customer address fields during checkout. A normal customer can inject Blade template code that executes when viewed in the admin panel, achieving RCE. PoC available.
Bagisto eCommerce platform (2.3 branch before 2.3.10) leaves installation API routes active after setup, allowing unauthenticated attackers to re-run the installer and take full control of the store including database credentials and admin account. PoC available.
gpsd (before commit dc966aa) has a heap buffer overflow in the NMEA2000 satellite view handler (PGN 129540). A malicious satellite count value overwrites the skyview array, enabling code execution on GPS daemon processes. PoC available, patch available.
The Branda WordPress plugin (through 3.4.24) allows unauthenticated attackers to reset any user's password without identity verification, enabling account takeover including administrator accounts. Full site compromise is one password reset away.
The online-movie-booking application (v5.5) by gosaliajainam contains SQL injection in movie_details.php, allowing unauthenticated attackers to extract the entire database. PoC exists. This is an open-source educational project often deployed without hardening.
Emlog 2.5.23 is vulnerable to CSRF in article creation, which chains with stored XSS to achieve account takeover. An attacker can force an admin to create an article containing malicious JavaScript that steals their session. No patch available.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to user conversations, transaction data, and message deletion. Critical for AI workflow platforms that handle sensitive prompt data.
Bagisto eCommerce platform versions before 2.3.10 suffer from server-side template injection through user-controllable first and last name fields, allowing low-privilege authenticated users to achieve remote code execution. This high-severity vulnerability (CVSS 8.8) affects confidentiality, integrity, and availability with public exploit code available and no patch currently deployed. Organizations running affected Bagisto instances should immediately upgrade to version 2.3.10 or later.
Stored XSS in Bagisto's CMS page editor allows authenticated attackers to bypass input sanitization by crafting malicious HTTP requests, enabling persistent JavaScript injection that executes when administrators view or edit pages. Public exploit code exists for this vulnerability, creating high-risk scenarios including admin account compromise and backend system hijacking. Bagisto versions prior to 2.3.10 are affected, and no patch is currently available for the underlying Laravel platform.
Server-side request forgery (SSRF) in Emlog up to version 2.5.19 allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files to the media upload endpoint, enabling internal network reconnaissance and potential credential exposure when the server processes the files. Public exploit code exists for this vulnerability and no patches are currently available. The flaw affects all Emlog installations accepting SVG uploads and can be exploited without user interaction once an attacker gains authenticated access.
An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal. [CVSS 7.5 HIGH]
An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. [CVSS 7.5 HIGH]
An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitive information and escalate privileges via a crafted HTTP request. [CVSS 7.5 HIGH]
MessagePack for Java versions prior to 0.9.11 are vulnerable to denial-of-service attacks through malicious .msgpack files that exploit unbounded heap allocation when deserializing EXT32 objects. An unauthenticated attacker can craft a small payload with attacker-controlled extension lengths that causes the library to attempt allocating excessive memory, leading to JVM heap exhaustion and service unavailability. Public exploit code exists for this vulnerability; organizations using affected versions should update immediately.
Pa4 Firmware versions up to 1.12.37-20240124 is affected by cleartext transmission of sensitive information (CVSS 7.5).
Stack-based buffer overflow in the UTT 512W router (firmware 1.7.7-171114) allows an authenticated, network-positioned attacker to corrupt memory by sending an overlong filename value to the FTP-server directory configuration handler at /goform/formFtpServerDirConfig, with high confidentiality, integrity and availability impact on the device itself. Exploitation requires valid credentials (CVSS vector PR:L) and network reachability of the web management interface, so devices with management restricted to a trusted LAN and non-default credentials are substantially harder to reach. Publicly available exploit code exists, but there is no CISA KEV listing and EPSS is low (0.11%, 29th percentile), and no vendor patch has been released because the vendor did not respond to disclosure.
Stack-based buffer overflow in the UTT 进取 512W router (firmware 1.7.7-171114) lets an authenticated attacker who can reach the device web management interface crash or potentially execute code on the device by submitting an oversized 'oldfilename' parameter to /goform/formFtpServerShareDirSelcet. According to the CVSS 4.0 vector the attacker must already hold valid credentials (PR:L), so the flaw is a post-authentication escalation/denial-of-service vector rather than an unauthenticated remote compromise. Publicly available exploit code exists (a GitHub PoC was published alongside the disclosure) and the report indicates the vendor was contacted but never responded, so no fixed firmware has been released; EPSS is only 0.11% (29th percentile), and the overall risk is low because exploitation requires an authenticated session and the affected device/firmware combination has a very small deployment base.
An authenticated buffer overflow in the UTT 进取 512W router firmware 1.7.7-171114 allows a user who is already logged into the web management interface to crash or potentially execute code on the device by sending a single crafted request containing an overlong addCommand parameter to /goform/formConfigCliForEngineerOnly. The flaw is a classic unchecked strcpy into a fixed-size buffer, rated 7.4 (CVSS 4.0 and our independent CVSS 3.1 assessment both agree), and it requires valid credentials (PR:L) plus network reachability to the management interface, which is normally LAN-side unless remote administration has been enabled. Publicly available exploit code exists and the vendor did not respond to the disclosure, but there is no evidence of active exploitation (not in CISA KEV) and EPSS is only 0.04% (11th percentile), so this points to a low real-world priority despite the moderate score.
Stack-based buffer overflow in the web management interface of the UTT 进取 512W router (firmware 1.7.7-171114) allows authenticated remote attackers to crash or potentially execute code on the device by sending an oversized 'Profile' argument to /goform/formRemoteControl. Exploitation requires network reachability to the router's admin web UI plus valid low-privileged credentials (the CVSS vectors for both the NVD 4.0 score and the independent 3.1 assessment specify PR:L), and publicly available exploit code exists, though there is no evidence of active exploitation (CISA KEV does not list this CVE) and EPSS is only 0.04% (11th percentile). The vendor was contacted early but never responded, so no patch has been released, and real-world risk is low despite the 7.4 CVSS 4.0 score because the product is obscure, low-deployment, and the attack is gated behind authentication.
Plex Media Server builds through 1.42.2.10156 can return a permanent account access token to a caller who already holds a valid transient Plex token via the /myplex/account endpoint, turning short-lived access into durable account access. This is a CWE-863 authorization bypass with a network attack vector and low complexity, but it requires the prerequisite transient token, so it is not an unauthenticated from-zero compromise. Publicly available exploit code exists, EPSS is very low at 0.04% (13th percentile), and no confirmed active exploitation is reported in the provided data.
In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account. [CVSS 7.1 HIGH]
Bagisto is an open source laravel eCommerce platform. [CVSS 7.1 HIGH]
Authentication bypass in Nuvation Energy Multi-Stack Controller (MSC) firmware from 2.3.8 up to but not including 2.5.1 allows unauthenticated remote attackers to reach privileged management functionality through an alternate path or channel that skips the normal login gate, giving complete loss of confidentiality, integrity and availability for the controller and potentially for systems it controls (CVSS 4.0 base score 10.0; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). This is an OT/ICS energy-storage control issue rather than a mass-exploited internet-facing bug: it is not listed in CISA KEV and no public exploit code has been identified at time of analysis, and the EPSS score of 0.11% (29th percentile) mainly reflects that EPSS models internet-facing IT software poorly and under-weights segmented industrial devices. Because the vector requires no authentication (PR:N) and no user interaction (UI:N), the practical limiting factor is exposure - exploitation requires network reachability to the MSC management interface on an affected firmware version, so an internet-exposed controller or one reachable from a compromised IT/OT bridge is the realistic abuse scenario.
Bagisto before 2.3.10 has a second server-side template injection vulnerability, this time via the type parameter. Like CVE-2026-21448, this enables remote code execution through the Blade template engine. Patch available in 2.3.10.
QNAP Malware Remover before 6.6.8.20251023 has a code generation vulnerability that allows remote attackers to bypass the protection mechanism. An ironic vulnerability in a security tool that is supposed to protect QNAP NAS devices.
A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function downloadShowFile of the file /file/downloadShowFile.action of the component com.yeqifu.sys.controller.FileController. [CVSS 5.3 MEDIUM]
A flaw has been found in EmpireSoft EmpireCMS up to 8.0. This issue affects the function egetip of the file e/class/connect.php of the component IP Address Handler. [CVSS 5.3 MEDIUM]
A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agent_worksdel.jsp of the component HTTP GET Parameter Handler. [CVSS 7.3 HIGH]
SQL injection in code-projects Online Music Site 1.0 via the ID parameter in /Frontend/AlbumByCategory.php allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in Online Music Site 1.0's ViewSongs.php parameter handling allows unauthenticated remote attackers to manipulate the ID argument and execute arbitrary database queries. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires no user interaction and impacts the confidentiality, integrity, and availability of the affected application.
SQL injection in code-projects Content Management System 1.0 via the ID parameter in /pages.php allows unauthenticated remote attackers to execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Attackers can leverage this to read, modify, or delete sensitive database information with low complexity from any network location.
Content Management System versions up to 1.0 contains a vulnerability that allows attackers to sql injection (CVSS 7.3).
A flaw has been found in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/work_update.jsp. [CVSS 7.3 HIGH]
A vulnerability was detected in Yonyou KSOA 9.0. Affected is an unknown function of the file /kp/PrintZPYG.jsp. [CVSS 7.3 HIGH]
A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agent_worksadd.jsp of the component HTTP GET Parameter Handler. [CVSS 7.3 HIGH]
A security vulnerability has been detected in Yonyou KSOA 9.0. This affects an unknown part of the file /worksheet/agent_work_report.jsp. [CVSS 7.3 HIGH]
A vulnerability was identified in jackying H-ui.admin versions up to 3.1. is affected by improper access control (CVSS 7.3).
A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the component HTTP GET Parameter Handler. [CVSS 7.3 HIGH]
SQL injection in code-projects Online Music Site 1.0 via the fname parameter in /Frontend/Feedback.php allows unauthenticated remote attackers to manipulate database queries and potentially extract sensitive information. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected installations at immediate risk.
SQL injection in code-projects Content Management System 1.0 via the search.php parameter allows unauthenticated remote attackers to manipulate database queries and potentially extract sensitive data or modify database contents. Public exploit code exists for this vulnerability, and no patch is currently available. Affected installations should implement immediate input validation or access controls until patching is possible.
A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/work_edit.jsp. [CVSS 7.3 HIGH]
Improper IV handling in libtpms 0.10.0 and 0.10.1 causes the library to return initial instead of final initialization vectors during symmetric cipher operations with OpenSSL 3.x, potentially weakening cryptographic security for local users who can interact with the TPM emulation. Public exploit code exists for this vulnerability affecting confidentiality of encrypted data. Update to libtpms 0.10.2 to remediate.
OS command injection in Nuvation Energy Multi-Stack Controller (MSC) firmware 2.3.8 through 2.5.0 lets an authenticated, low-privileged attacker who can reach the controller's management interface execute arbitrary operating-system commands on the device, with high impact to confidentiality, integrity, and availability of both the controller and connected systems (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; NVD rates it 9.4 under CVSS 4.0). Exploitation requires valid low-privilege credentials plus network reachability to the management interface, so this is not an unauthenticated remote compromise of default configurations, and the affected MSC is a niche OT/ICS battery-energy-storage controller rather than a broadly deployed enterprise product. No public exploit code has been identified at time of analysis (EPSS 0.29%, ~52nd percentile; not listed in CISA KEV), but the vendor has fixed the issue in version 2.5.1, which should be applied promptly given the severity of post-authentication code execution on grid-adjacent hardware.
Stored XSS in Emlog 2.5.23 allows authenticated attackers to inject malicious scripts that execute in other users' browsers, potentially leading to administrative account compromise. Public exploit code exists for this vulnerability, and no patched version is currently available. The attack requires user interaction and can affect any Emlog installation running the vulnerable version.
Stored XSS in Emlog 2.5.23's media library function allows authenticated attackers to inject malicious scripts when publishing articles, which execute in other users' browsers with scope crossing enabled. Public exploit code exists for this vulnerability, and no patched version is currently available. Successful exploitation requires user interaction and grants attackers the ability to steal session data or perform actions on behalf of affected users.
Stored XSS in Listmonk before version 6.0.0 allows authenticated users with campaign management permissions to inject malicious JavaScript that executes when administrators preview campaigns or templates, enabling privilege escalation attacks such as creating backdoor admin accounts. Public exploit code exists for this vulnerability, and the attack surface expands through the public archive feature where victims need only visit a link to trigger the payload. Version 6.0.0 addresses this flaw, though patches are currently unavailable for earlier versions.
The Registration, User Profile, Membership, Content Restriction, User Directory, and Frontend Post Submission - WP User Frontend plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'Frontend_Form_Ajax::submit_post' function in all versions up to, and including, 4.2.4. [CVSS 5.3 MEDIUM]
Unauthenticated remote attackers can bypass the authentication mechanism of the Nuvation Battery Management System (firmware versions through 2.3.9) and obtain full control of its management/web interface, enabling high-impact reads, configuration changes, and disruption of battery-management functions. The flaw is rated critical (vendor CVSS 9.3 v4.0; independently assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with no authentication or user interaction required, though exploitation depends on the BMS interface being reachable over the network. As of analysis there is confirmed no active exploitation (not in CISA KEV) and no public exploit code identified, and EPSS assigns only a 0.10% probability (28th percentile), so risk is driven by intrinsic severity and OT exposure rather than observed exploitation.
Ninja Forms versions up to 3.13.3 contains a vulnerability that allows attackers to generate valid access tokens via the REST API which can then be used to read for (CVSS 5.3).
In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers endpoint. [CVSS 5.0 MEDIUM]