Command injection in emp3r0r C2 framework before 3.21.1. Untrusted agent metadata (Transport, Hostname) injected into commands. PoC and patch available. EPSS 0.61%.
Stack overflow in FTP Navigator 8.03 via SEH overwrite. PoC available.
Buffer overflow in Prime95 29.8 build 6 user ID field allows code execution. PoC available.
Stack overflow in Domain Quester Pro 6.02 via SEH overwrite. PoC available.
Username enumeration in OwnCloud 8.1.8 via share.php endpoint. PoC available.
Heap out-of-bounds write in Nav2 AMCL (Adaptive Monte Carlo Localization) in ROS 2 Navigation Framework 1.3.11 and earlier. Robot navigation vulnerability. PoC and patch available.
String filter bypass in Inspektor Gadget Kubernetes eBPF tooling before fix. Insufficient string escaping enables filter injection. PoC and patch available.
CGI path splitting vulnerability in FrankenPHP before 1.11.2 — Unicode characters bypass path validation during CGI processing. PoC and patch available.
Buffer overflow in webfsd 1.21 web server via crafted request targeting filename variable. PoC available.
SQL injection in CordysCRM 1.4.1 employee list query via departmentIds parameter. PoC available.
Administrative account takeover in newbee-mall arises from pre-seeded admin accounts shipped in the database initialization schema with a predictable, publicly known default password. Any deployment that runs the provided schema and leaves the seeded credentials unchanged lets remote unauthenticated attackers log in as administrator and take full control of the storefront and its backend. Publicly available exploit information exists (project issue #119 and a VulnCheck advisory), though EPSS is low (0.13%) and it is not listed in CISA KEV, so no public exploit identified as actively exploited.
Weak password storage in newbee-mall exposes all user credentials to trivial offline recovery: the application hashes passwords with unsalted MD5 and no computational cost factor, so any attacker who obtains the hash table (via database dump, backup leak, or other compromise) can crack plaintext passwords en masse using rainbow tables or commodity GPU cracking. Publicly available exploit/disclosure material exists (VulnCheck advisory and upstream issue), but there is no public exploit identified as being used in active attacks, and EPSS is very low (0.02%, 3rd percentile). This is an enabling credential-disclosure weakness rather than a directly remotely triggerable RCE, and its real impact is contingent on a prior data exposure.
Arbitrary local file disclosure in Crawl4AI's Docker API (versions before 0.8.0) lets unauthenticated remote attackers read any file on the server by supplying file:// URLs to the /execute_js, /screenshot, /pdf, and /html endpoints. Because the API validates no scheme, an attacker can exfiltrate /etc/passwd, /etc/shadow, application config, and process environment via /proc/self/environ - directly exposing credentials and API keys. Publicly documented in GitHub advisory GHSA-vx9w-5cx4-9796 with a working request example; no public exploit identified as active exploitation, and EPSS is low (0.06%, 19th percentile).
Remote code execution in Crawl4AI Docker API before 0.8.0 via hooks parameter. The /crawl endpoint accepts Python code in hooks that executes on the server. EPSS 0.28%.
Authentication bypass in AdForest WordPress theme (all versions through 6.0.12) allows unauthenticated attackers to take over any user account.
Unrestricted file upload in Airleader Master versions 6.381 and prior. Multiple webpages allow unauthenticated file upload with maximum privileges.
Unrestricted file upload in NTN software enables web shell upload and RCE.
SQL injection in Farktor E-Commerce platform allows full database access.
Privilege escalation in Prime Listing Manager WordPress plugin through 1.1 allows unauthenticated administrative access.
Missing certificate validation in SolaX solar inverter MQTT connections to Alibaba Cloud. Devices accept any server certificate, enabling MITM attacks on solar energy infrastructure.
Code injection in authentik identity provider from 2021.3.1 through multiple versions. Users with delegated permissions can inject code. Patch available.
Man-in-the-middle interception affects the Xiaomi Galaxy FDS Android SDK (galaxy-fds-sdk-android) version 3.0.8 and prior, which disables TLS hostname verification whenever HTTPS is enabled — the default. Because createHttpClient() installs Apache HttpClient's ALLOW_ALL_HOSTNAME_VERIFIER, any TLS certificate from any host is accepted, letting an on-path attacker impersonate Xiaomi FDS cloud storage endpoints and steal authentication credentials, file contents, and API responses. EPSS is very low (0.03%, 8th percentile) and there is no public exploit identified at time of analysis, but the project has reached end-of-life so no fix is expected.
CSRF leading to privilege escalation in Dolibarr ERP & CRM v.22.0.9. Attackers can escalate privileges via the notes field in permission management.