Command injection in emp3r0r C2 framework before 3.21.1. Untrusted agent metadata (Transport, Hostname) injected into commands. PoC and patch available. EPSS 0.61%.
Stack overflow in FTP Navigator 8.03 via SEH overwrite. PoC available.
Buffer overflow in Prime95 29.8 build 6 user ID field allows code execution. PoC available.
Stack overflow in Domain Quester Pro 6.02 via SEH overwrite. PoC available.
Username enumeration in OwnCloud 8.1.8 via share.php endpoint. PoC available.
Heap out-of-bounds write in Nav2 AMCL (Adaptive Monte Carlo Localization) in ROS 2 Navigation Framework 1.3.11 and earlier. Robot navigation vulnerability. PoC and patch available.
String filter bypass in Inspektor Gadget Kubernetes eBPF tooling before fix. Insufficient string escaping enables filter injection. PoC and patch available.
CGI path splitting vulnerability in FrankenPHP before 1.11.2 — Unicode characters bypass path validation during CGI processing. PoC and patch available.
Buffer overflow in webfsd 1.21 web server via crafted request targeting filename variable. PoC available.
SQL injection in CordysCRM 1.4.1 employee list query via departmentIds parameter. PoC available.
Administrative account takeover in newbee-mall arises from pre-seeded admin accounts shipped in the database initialization schema with a predictable, publicly known default password. Any deployment that runs the provided schema and leaves the seeded credentials unchanged lets remote unauthenticated attackers log in as administrator and take full control of the storefront and its backend. Publicly available exploit information exists (project issue #119 and a VulnCheck advisory), though EPSS is low (0.13%) and it is not listed in CISA KEV, so no public exploit identified as actively exploited.
Weak password storage in newbee-mall exposes all user credentials to trivial offline recovery: the application hashes passwords with unsalted MD5 and no computational cost factor, so any attacker who obtains the hash table (via database dump, backup leak, or other compromise) can crack plaintext passwords en masse using rainbow tables or commodity GPU cracking. Publicly available exploit/disclosure material exists (VulnCheck advisory and upstream issue), but there is no public exploit identified as being used in active attacks, and EPSS is very low (0.02%, 3rd percentile). This is an enabling credential-disclosure weakness rather than a directly remotely triggerable RCE, and its real impact is contingent on a prior data exposure.
Arbitrary local file disclosure in Crawl4AI's Docker API (versions before 0.8.0) lets unauthenticated remote attackers read any file on the server by supplying file:// URLs to the /execute_js, /screenshot, /pdf, and /html endpoints. Because the API validates no scheme, an attacker can exfiltrate /etc/passwd, /etc/shadow, application config, and process environment via /proc/self/environ - directly exposing credentials and API keys. Publicly documented in GitHub advisory GHSA-vx9w-5cx4-9796 with a working request example; no public exploit identified as active exploitation, and EPSS is low (0.06%, 19th percentile).
AVS Audio Converter 9.1.2.600 contains a stack overflow vulnerability that allows attackers to execute arbitrary code by manipulating the output folder text input. [CVSS 8.8 HIGH]
Smart Visu Server Firmware contains a vulnerability that allows attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host head (CVSS 8.8).
FTP Commander Pro 8.03 contains a local stack overflow vulnerability that allows attackers to execute arbitrary code by overwriting the EIP register through a custom command input. [CVSS 8.4 HIGH]
SpotAuditor 5.3.2 contains a local buffer overflow vulnerability in the Base64 Encrypted Password tool that allows attackers to execute arbitrary code by crafting a malicious payload. [CVSS 8.4 HIGH]
AVS Audio Converter 9.1 contains a local buffer overflow vulnerability that allows local attackers to overwrite CPU registers by manipulating the 'Exit folder' input field. [CVSS 8.4 HIGH]
ClamAV versions up to 0.103.0 contains a vulnerability that allows attackers to manipulate bytecode function names (CVSS 8.4).
Thrive Smart Home 1.1 contains an SQL injection vulnerability in the checklogin.php endpoint that allows unauthenticated attackers to bypass authentication by manipulating the 'user' POST parameter. [CVSS 8.2 HIGH]
Mobilego versions up to 8.5.0 is affected by incorrect permission assignment for critical resource (CVSS 7.8).
Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in the service configuration to inject malicious executables and escalate privileges on the system. [CVSS 7.8 HIGH]
NextVPN 4.10 contains an insecure file permissions vulnerability that allows local users to modify executable files with full access rights. Attackers can replace system executables with malicious files to gain SYSTEM or Administrator privileges through unauthorized file modification. [CVSS 7.8 HIGH]
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTTP request paths. [CVSS 7.5 HIGH]
JUNG Smart Visu Server 1.1.1050 can be forcibly shut down or rebooted by unauthenticated remote attackers through a single POST request, causing service disruption. Public exploit code exists for this denial of service vulnerability, and no patch is currently available to address the authentication bypass.
thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parameter. Attackers can inject malicious SQL code like ' or '1=1 to the username field to gain unauthorized access to user accounts. [CVSS 7.5 HIGH]
TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'server_name' parameter. Attackers can inject malicious SQL code like ' or '1=1 to retrieve unauthorized database records and potentially access sensitive system information. [CVSS 7.5 HIGH]
An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint [CVSS 7.5 HIGH]
PRO-7070 Hazır Profesyonel Web Sitesi version 1.0 contains an authentication bypass vulnerability in the administration panel login page. Attackers can bypass authentication by using '=' 'or' as both username and password to gain unauthorized access to the administrative interface. [CVSS 7.5 HIGH]
Centova Cast 3.2.12 contains a denial of service vulnerability that allows attackers to overwhelm the system by repeatedly calling the database export API endpoint. Attackers can trigger 100% CPU load by sending multiple concurrent requests to the /api.php endpoint with crafted parameters. [CVSS 7.5 HIGH]
Heatmiser Netmonitor 3.03 contains a hardcoded credentials vulnerability in the networkSetup.htm page with predictable admin login credentials. Attackers can access the device by using the hard-coded username 'admin' and password 'admin' in the hidden form input fields. [CVSS 7.5 HIGH]
FrankenPHP versions prior to 1.11.2 fail to properly isolate session data between worker requests, enabling cross-user session fixation where an attacker can read sensitive $_SESSION information intended for other users. This high-severity flaw affects multi-request worker mode deployments and has public exploit code available. A patched version 1.11.2 is available and should be deployed immediately.
iNetTools for iOS 8.20 contains a denial of service vulnerability in the Whois feature that allows attackers to crash the application by manipulating input. Attackers can paste a specially crafted 98-character buffer into the Domain Name field to trigger an application crash. [CVSS 7.5 HIGH]
SurfOffline Professional 2.2.0.103 contains a structured exception handler (SEH) overflow vulnerability that allows attackers to crash the application by manipulating the project name input. [CVSS 7.5 HIGH]
XnConvert 1.82 contains a denial of service vulnerability in its registration code input field that allows attackers to crash the application. Attackers can generate a 9000-byte buffer of repeated characters and paste it into the registration code field to trigger an application crash. [CVSS 7.5 HIGH]
GHIA CamIP 1.2 for iOS contains a denial of service vulnerability in the password input field that allows attackers to crash the application. Attackers can paste a 33-character buffer of repeated characters into the password field to trigger an application crash on iOS devices. [CVSS 7.5 HIGH]
FTP Navigator 8.03 contains a denial of service vulnerability that allows attackers to crash the application by overwriting Structured Exception Handler (SEH) with malicious input. [CVSS 7.5 HIGH]
SpotAuditor 5.3.2 contains a denial of service vulnerability in its Base64 decryption feature that allows attackers to crash the application by supplying an oversized buffer. [CVSS 7.5 HIGH]
Product Key Explorer 4.2.0.0 contains a denial of service vulnerability that allows local attackers to crash the application by overflowing the registration name input field. [CVSS 6.2 MEDIUM]
E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credentials by manipulating login parameters. [CVSS 6.5 MEDIUM]
RICOH Web Image Monitor 1.09 contains an HTML injection vulnerability in the address configuration CGI script that allows attackers to inject malicious HTML code. [CVSS 6.1 MEDIUM]
Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HTML code through the outputtitle parameter. [CVSS 6.1 MEDIUM]
Remote code execution in Crawl4AI Docker API before 0.8.0 via hooks parameter. The /crawl endpoint accepts Python code in hooks that executes on the server. EPSS 0.28%.
Authentication bypass in AdForest WordPress theme (all versions through 6.0.12) allows unauthenticated attackers to take over any user account.
Unrestricted file upload in Airleader Master versions 6.381 and prior. Multiple webpages allow unauthenticated file upload with maximum privileges.
Unrestricted file upload in NTN software enables web shell upload and RCE.
SQL injection in Farktor E-Commerce platform allows full database access.
Privilege escalation in Prime Listing Manager WordPress plugin through 1.1 allows unauthenticated administrative access.
A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Item Name parameter. [CVSS 5.5 MEDIUM]
Stored XSS in Solspace Freeform for Craft CMS 5.x allows authenticated users with form creation privileges to inject malicious JavaScript into form labels and integration metadata, which executes in the Control Panel when administrators view the builder or integrations. Public exploit code exists for this vulnerability. The vulnerability is resolved in version 5.14.7.