Stored Cross-Site Scripting in Adobe Experience Manager versions FP11.7 and earlier allows authenticated attackers to inject malicious JavaScript into form fields, which executes in victims' browsers with limited impact (confidentiality and integrity). The vulnerability requires user interaction (victim must view the affected page) and authenticated access, resulting in a CVSS 5.4 (medium) score. No public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting (XSS) in Fortinet FortiSandbox and FortiSandbox PaaS versions 5.0.0 through 5.0.4 allows unauthenticated remote attackers to inject malicious scripts via crafted HTTP requests. Exploitation requires user interaction (clicking a malicious link), resulting in session hijacking, credential theft, or malware distribution to administrators accessing the FortiSandbox web interface. No public exploit code or active exploitation has been confirmed at time of analysis.
Remote code execution in giskard-checks through server-side template injection (SSTI) in the ConformityCheck class allows arbitrary Python code execution when the rule parameter is processed via unsandboxed Jinja2 template rendering. Affected versions prior to 1.0.2b1 silently interpret rule strings as Jinja2 templates, enabling attackers with write access to check definitions or configuration files to inject malicious template expressions that execute during test suite execution. Exploitation requires local file write access and subsequent developer execution of the test suite, but the implicit template evaluation increases risk when untrusted check definitions are integrated from shared projects or external sources.
Kiuwan SAST fails to properly enforce SSO login authorization for locally disabled user accounts, permitting disabled users to maintain application access through single sign-on mechanisms. This affects Kiuwan Cloud and Kiuwan SAST on-premise (KOP) versions prior to 2.8.2509.4, enabling authenticated attackers with prior credentials to bypass account disablement controls. An attacker whose account has been disabled by administrators can re-authenticate via SSO and regain unauthorized access to the system.
Improper validation of input quantity in Schneider Electric PowerChute Serial Shutdown versions 1.4 and prior allows authenticated Web Admin users to truncate event and data logs via crafted POST /logsettings requests, compromising log integrity and audit trail reliability. The vulnerability requires valid admin credentials and network access but poses direct impact to forensic and compliance capabilities. No public exploit code or active exploitation has been confirmed at time of analysis.
MaxKB versions 2.7.1 and below allow authenticated administrators to trigger arbitrary code execution on their own workstations through improper CSV formula sanitization in the chat export feature. When exporting chat history to Excel via the /admin/api/workspace/{workspace_id}/application/{application_id}/chat/export endpoint, formula strings (e.g., =cmd|'/c calc'!A1) are written unsanitized to the .xlsx file, enabling Dynamic Data Exchange (DDE) exploitation when the file is opened in Microsoft Excel. No public exploit code has been identified, but the vulnerability represents a high-impact attack path for administrators with legitimate export access and is a direct repeat of a previously patched flaw (CVE-2025-4546) that was incompletely remediated across the codebase.
CRLF injection in Schneider Electric PowerChute™ Serial Shutdown versions 1.4 and prior allows authenticated Web Admin users to reset application user credentials by manipulating the POST /setPCBEDesc request payload, achieving limited availability impact with CVSS 5.3 and confirmed actively exploited status (CISA KEV).
MCPHub below version 0.11.0 allows unauthenticated attackers to bypass authentication on unprotected endpoints and perform actions with the privileges of other users. The vulnerability stems from missing authentication middleware on certain endpoints, enabling attackers on the local network (AV:A) to impersonate legitimate users without requiring credentials. No public exploit code or active exploitation has been confirmed at this time.
Denial of service in Schneider Electric PowerChute Serial Shutdown versions 1.4 and prior allows authenticated Web Admin users to trigger uncontrolled resource consumption by flooding the system with POST requests to the /helpabout endpoint, causing excessive troubleshooting zip file creation and service degradation. Attack requires valid admin credentials and network access to the web interface; CVSS 5.3 reflects low availability impact with no confidentiality or integrity compromise.
Unauthenticated attackers can bypass authorization checks in the Nexi XPay plugin for WordPress (versions up to 8.3.0) to mark pending WooCommerce orders as paid or completed by exploiting a missing authorization check on the redirect function. This allows payment fraud by converting unpaid orders into completed transactions without authentication. No public exploit code or active exploitation has been reported at time of analysis.
Memory corruption in Python's asyncio introspection and profiling.sampling modules (3.14-3.15) allows a local attacker with high privileges to read and write arbitrary memory in a connected privileged Python process via remote debugging. Exploitation requires persistent, repeated connections and high tolerance for crashes due to ASLR; no public exploit code has been identified. SSVC framework rates technical impact as total, but exploitation remains none-indicating low real-world priority despite severe capability impact.
Apache APISIX 2.99.0 through 3.15.0 transmits sensitive log data in cleartext over HTTP when exporting logs to Tencent Cloud CLS, allowing network-based attackers to intercept and read confidential information without authentication. Vendor-released patch: version 3.16.0. EPSS indicates low real-world exploitation probability (0.01%), though the attack vector is unauthenticated and low-complexity, suggesting availability of automated interception tools rather than active targeted exploitation.
Authentication bypass in Siemens Industrial Edge Management systems (Pro V1 ≥1.7.6 <1.15.17, Pro V2 ≥2.0.0 <2.1.1, Virtual ≥2.2.0 <2.8.0) allows unauthenticated remote attackers with user interaction to impersonate legitimate users and tunnel to managed devices when remote connection features are enabled. Exploitation requires knowledge of connection headers and ports but does not bypass device-level application authentication. No public exploit identified at time of analysis. CVSS 7.1 with network attack vector, low complexity, and no authentication required (PR:N), indicating moderate real-world risk for industrial environments with exposed management interfaces.
Stored Cross-Site Scripting in MaxKB 2.7.1 and below allows authenticated users to inject arbitrary JavaScript into the Application prologue field via <html_rander> tags, which the backend stores unsanitized and the frontend renders with innerHTML-equivalent mechanisms. Exploitation enables session hijacking, unauthorized workspace/application deletion, and sensitive data exposure against any visitor accessing the affected chatbot. Fixed in version 2.8.0.
Stored cross-site scripting (XSS) in October CMS versions prior to 3.7.14 and 4.1.10 allows authenticated users with Event Log viewing permissions to execute arbitrary JavaScript in other users' browsers via malicious HTML content in the mail preview iframe. The vulnerability stems from improper iframe sandboxing when rendering logged email messages, affecting confidentiality and integrity with a CVSS score of 5.1. No public exploit code has been identified at the time of analysis.
Stored Cross-Site Scripting (XSS) in October CMS versions prior to 3.7.14 and 4.1.10 allows authenticated backend users with editor settings permissions to inject malicious JavaScript into Markup Classes fields, which executes unsanitized in the Froala editor dropdown menus when any user-including superusers-opens a RichEditor. This enables privilege escalation when a superuser performs routine content editing tasks. CVSS 5.1 indicates moderate risk; exploitation requires authenticated backend access and user interaction (opening an editor), but the stored nature of the payload and privilege escalation potential elevate real-world concern. No public exploit code or active CISA KEV status reported.
Stored cross-site scripting (XSS) in Chamilo LMS versions prior to 2.0.0-RC.3 allows authenticated users to upload malicious HTML files containing JavaScript via the social post attachment API endpoint. The uploaded files are served without sanitization, content-type restrictions, or proper content-disposition headers, causing embedded JavaScript to execute in the browser within the application's trusted origin. This enables session hijacking, account takeover, and privilege escalation attacks, particularly when an administrator views a malicious link. The vulnerability is confirmed fixed in version 2.0.0-RC.3.
Stored Cross-Site Scripting in MaxKB's MdRenderer component allows authenticated users to inject malicious scripts via custom <iframe_render> tags in LLM responses or Application Prologue configurations, leading to JavaScript execution in the parent window context with access to session tokens and sensitive data. MaxKB versions 2.7.1 and earlier are affected; the vulnerability is fixed in version 2.8.0. The attack requires user interaction (UI:P) but impacts all visitors to an affected application's chat interface, making it a high-impact stored XSS despite the moderate CVSS 5.1 score.
Open redirect vulnerability in Immich prior to version 2.7.3 allows authenticated attackers to craft malicious shared album names that inject unsanitized HTML into Open Graph meta tags, redirecting victims' browsers to attacker-controlled sites when they open the share link. This enables phishing attacks where victims can be directed to credential-harvesting sites that impersonate the Immich login interface, exploiting user trust in the shared album feature.
MaxKB versions 2.7.1 and below allow authenticated users with tool-editing permissions to bypass sandbox network protection via socket.sendto() with the MSG_FASTOPEN flag, enabling connections to internal services explicitly blocked by the sandbox's banned hosts configuration. The vulnerability exploits a gap in LD_PRELOAD hooking-sendto() with MSG_FASTOPEN establishes TCP connections directly through the kernel without invoking the hooked connect() function, completely circumventing IP validation. This is a server-side request forgery (SSRF) vector that requires prior authentication and tool-editing privileges. Vendor-released patch: version 2.8.0.
SAP HANA Cockpit and HANA Database Explorer leak sensitive information to authenticated network users due to improper credential storage mechanisms (CWE-522). An authenticated attacker with network access can retrieve confidential data without requiring elevated privileges or user interaction. This vulnerability affects all versions of SAP HANA Cockpit and HANA Database Explorer; patch availability and active exploitation status are not confirmed from available data.
Denial of service in Fortinet FortiWeb 7.0-8.0.3 via integer overflow allows authenticated remote attackers with high privileges to crash the application, resulting in service unavailability. The vulnerability has a CVSS score of 4.9 (Medium) and affects multiple FortiWeb versions across a wide range. No public exploit code or active exploitation has been confirmed at the time of analysis.
SAP S/4HANA (Private Cloud and On-Premise) allows authenticated local network users to delete arbitrary operating system files due to missing authorization checks, degrading system integrity and availability. The vulnerability requires prior authentication and high complexity attack conditions (AC:H), resulting in a CVSS score of 4.9. No evidence of active exploitation or public proof-of-concept code has been identified, but the authorization bypass is confirmed across both deployment models.
Sandbox bypass in October CMS versions prior to 3.7.13 and 4.0.0-4.1.4 allows authenticated users with template editing permissions to bypass the optional Twig safe mode (CMS_SAFE_MODE) protections via unrestricted collect() helper methods. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with the non-default CMS_SAFE_MODE feature enabled. Fixed in versions 3.7.13 and 4.1.5.
October CMS versions prior to 3.7.14 and 4.1.10 allow authenticated editors to disclose sensitive environment variables through PHP's parse_ini_string() interpolation syntax in page settings fields. An attacker with Editor access can inject patterns like ${APP_KEY} or ${DB_PASSWORD} into CMS configuration fields, causing the server to resolve and expose database passwords, AWS credentials, and application keys, potentially enabling database compromise or session forgery. The vulnerability is limited to installations with cms.safe_mode enabled; CVSS 4.9 reflects high confidentiality impact but requires elevated privileges (PR:H) to exploit.
Stored cross-site scripting (XSS) in Fortinet FortiSandbox and FortiSandbox PaaS versions 4.2 through 5.0.5 allows authenticated administrators with high privileges to inject malicious scripts into web pages, leading to unauthorized code execution when other users interact with compromised content. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity but not availability. With a CVSS score of 4.8 and high privilege requirement (PR:H), this represents a moderate risk primarily to multi-user deployments where administrative accounts may be compromised or untrusted.
Stored XSS in October CMS versions before 3.7.14 and 4.1.10 allows authenticated users with media upload permissions to bypass SVG sanitization regex patterns and inject malicious JavaScript through crafted SVG files. When a superuser or other high-privileged user views or embeds the malicious SVG, the payload executes in their browser context, enabling privilege escalation. The vulnerability requires both authenticated backend access and user interaction (viewing/embedding the SVG), resulting in a CVSS 4.8 (Medium) rating; no public exploit code has been identified at time of analysis.
Windows Recovery Environment Agent improperly stores sensitive information without adequate removal, allowing physical attackers to extract confidential data and bypass security features. The vulnerability affects Windows 10 versions 1607-22H2, Windows 11 versions 22H3-26H1, Windows Server 2016-2025, and Server Core installations across multiple builds. Microsoft has released vendor patches to remediate the information disclosure.
Windows Boot Manager contains an uninitialized resource vulnerability (CWE-908) that allows unauthorized attackers to bypass security features through physical access to affected systems. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Windows Server 2016/2019/2022/2025. While the CVSS score of 4.6 reflects the physical attack vector requirement and information disclosure impact, the authentication bypass nature comb
Remote code execution in MaxKB workflow engine (versions 2.7.1 and below) allows authenticated users to bypass an incomplete CVE-2025-53928 fix by injecting arbitrary MCP node configurations through the workflow creation API. An attacker with low-privilege credentials can omit the mcp_source field to trigger the unpatched else branch, inject stdio transport with arbitrary commands, and achieve RCE when the workflow is executed via chat interaction. This represents an incomplete remediation of a prior vulnerability-the patch restricted one code path but left an alternative execution path fully exposed.
Stored cross-site scripting (XSS) in Fortinet FortiSOAR allows authenticated remote attackers to inject malicious scripts via crafted HTTP requests, affecting both PaaS and on-premise deployments across versions 7.3 through 7.6.3. The vulnerability requires user interaction to trigger the payload and results in limited confidentiality and integrity impact, with a CVSS score of 4.6 reflecting the authentication requirement and user-interaction dependency. No public exploit code or active exploitation has been confirmed at the time of analysis.
Stored cross-site scripting (XSS) in Docmost prior to version 0.70.0 allows authenticated attackers to inject malicious scripts through MIME type spoofing, potentially compromising user sessions and data integrity. The vulnerability requires user interaction (clicking a link or viewing injected content) and affects only the confidentiality and integrity of affected users' data, not availability. Vendor-released patch: version 0.70.0.
A side-channel vulnerability exists in the implementation of BIP-39 mnemonic processing, as observed in Trezor One v1.13.0 to v1.14.0, Trezor T v1.13.0 to v1.14.0, and Trezor Safe v1.13.0 to v1.14.0 hardware wallets. This originates from the BIP-39 standard guidelines, which induce non-constant time execution and specific branch patterns for word searching. An attacker with physical access during the initial setup phase can collect a single side-channel trace. By utilizing profiling-based Deep Learning Side-Channel Analysis (DL-SCA), the attacker can recover the mnemonic code and subsequently steal the assets. The issue was patched.
Windows Hello biometric authentication can be bypassed by high-privileged local attackers through improper input validation, allowing unauthorized access to authentication mechanisms. This affects Windows 10 versions 21H2 and 22H2, and Windows 11 versions 22H3 through 26H1. The vulnerability requires administrative or SYSTEM-level privileges to exploit and does not enable remote exploitation, but represents a significant risk in multi-user or compromised-admin scenarios where biometric security is the primary defense mechanism.
Windows Virtualization-Based Security (VBS) Enclave in Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025 allows high-privileged local attackers to bypass security features through improper access control, resulting in integrity compromise without requiring user interaction. A vendor-released patch is available from Microsoft's security updates.
Stored Cross-Site Scripting in WholeSale Products Dynamic Pricing Management WooCommerce plugin allows authenticated administrators to inject arbitrary web scripts via admin settings that execute for all users on affected pages. The vulnerability affects all versions up to and including 1.2 on multi-site WordPress installations or single-site installations with unfiltered_html disabled. While the CVSS score of 4.4 is moderate, exploitation requires high-privilege administrator credentials and the attack is limited by high attack complexity; however, the persistent nature of stored XSS means injected payloads affect all subsequent site visitors.
Windows Snipping Tool leaks sensitive information to unauthenticated network attackers via user interaction, enabling spoofing attacks. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), as well as Windows Server 2012 through 2025. Microsoft has released patches for all affected versions; exploitation requires user interaction but no specialized technical knowledge.
Docmost versions 0.70.0 through 0.70.2 allow unauthenticated users to bypass authorization controls and enumerate restricted child page titles and text snippets via the public search endpoint, exposing confidential documentation content that should only be visible to authorized share viewers. This medium-severity confidentiality breach affects any Docmost instance with publicly shared workspaces and requires user interaction (clicking a link or accessing the search interface), but poses significant risk to organizations treating Docmost as a confidential knowledge base.
Fortinet FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4 store connector passwords in a recoverable format, allowing authenticated remote attackers to retrieve plaintext or weakly encrypted credentials for multiple installed connectors by modifying the server address in connector configuration. This affects security orchestration workflows that depend on connector authentication for external integrations.
Server-side request forgery in Fortinet FortiSOAR (both PaaS and on-premise versions 7.3 through 7.6.4) allows authenticated attackers to discover services running on local ports by crafting malicious requests. The vulnerability requires valid user credentials and carries a CVSS score of 4.3 with low confidentiality impact; no public exploit code or active exploitation has been confirmed at this time.
SAP S/4HANA OData Service for Manage Technical Object Structures allows authenticated users to update and delete child entities without proper authorization checks, enabling unauthorized data modification. The vulnerability affects S/4HANA deployments exposing the vulnerable OData service and requires valid user credentials but no elevated privileges. CVSS base score is 4.3 (low-to-medium severity) with confirmed patch availability from SAP Security Patch Day.
Blind Server-Side Request Forgery in Open WebUI 0.7.2 and below allows authenticated remote attackers to scan the local network and infer open ports via the image editing prompt functionality, which performs unrestricted GET requests to user-supplied URLs. The vulnerability enables port enumeration of internal network services without exposing response content, potentially leading to reconnaissance of locally accessible services. No public exploit code or active exploitation has been confirmed; patch status remains unresolved at time of publication.
Material Master application fails to enforce authorization checks for authenticated users executing reports, allowing disclosure of sensitive information to any authenticated user regardless of intended access permissions. Affects SAP Material Master with CVSS 4.3 (low severity) and confirmed authentication requirement; no active exploitation reported. Remote attackers with valid credentials can access restricted report data without additional attack complexity.
Eventin - Events Calendar, Event Booking, Ticket & Registration plugin for WordPress fails to properly validate user capabilities in the get_item_permissions_check() function, allowing authenticated Subscriber-level users to enumerate and read arbitrary order data including customer names, emails, and phone numbers through order ID iteration. Affected versions include all releases up to and including 4.1.8. This is a low-complexity, network-accessible vulnerability (CVSS 4.3) that requires only basic authentication, making it exploitable by any user with a WordPress account on an affected site.
Path traversal vulnerability in Apache PDFBox Examples ExtractEmbeddedFiles tool allows authenticated local users to write files outside intended directories via malicious PDF files when the initial path traversal fix fails to properly validate file path separators. Affects PDFBox 2.0.24-2.0.36 and 3.0.0-3.0.7; CVSS 4.3 with low exploitability (EPSS 0.02%, SSVC automation: no). Patch versions 2.0.37 and 3.0.8 address the issue.
Insecure session management in SAP Business Objects Business Intelligence Platform allows unauthenticated attackers to obtain and reuse valid session tokens, enabling unauthorized access to victim sessions with moderate complexity. An attacker exploiting this vulnerability could access or modify information within the compromised session's scope, affecting confidentiality and integrity. The attack requires user interaction (UI:R) and high attack complexity (AC:H), limiting real-world exploitation but still warranting prioritized remediation for organizations running affected BI Platform versions.
Fortinet FortiSOAR stores LDAP service account passwords in a recoverable format, allowing authenticated high-privilege remote attackers to retrieve plaintext or weakly protected credentials by modifying the LDAP server address in configuration. This affects FortiSOAR PaaS and on-premise versions 7.3 through 7.6.4. The vulnerability requires high-level administrative authentication and poses a confidentiality risk to stored credentials, with no evidence of active exploitation or public exploit code at time of analysis.
Reflected cross-site scripting (XSS) in SAP BusinessObjects Business Intelligence allows authenticated attackers to inject malicious JavaScript via crafted URLs that execute in victim browsers, potentially exposing restricted information. The vulnerability requires user interaction (clicking a malicious link) and affects only confidentiality with a CVSS score of 4.1 (low severity). No public exploit code or active exploitation has been identified.
Command injection in Podman's HyperV machine backend allows local administrators with high privileges to execute arbitrary PowerShell commands at SYSTEM level on Windows hosts by crafting a malicious VM image path containing PowerShell subexpression syntax. The vulnerability affects Podman v4 and v5 on Windows only; a vendor patch is available via commit 571c842.