Remote code execution in DataEase (open-source BI/data-visualization platform) versions 2.10.20 and below allows an authenticated attacker to run arbitrary commands as root by abusing an unsafe Java deserialization path in the bundled Quartz 2.3.2 scheduler. Because Quartz reads job-data BLOBs from the qrtz_job_details table via ObjectInputStream with no class filter, and the shipped commons-collections-3.2.1 (pulled in by velocity-1.7.jar) exposes the InvokerTransformer gadget, an attacker who can write to the job table - e.g. by chaining the previously disclosed previewSql SQL injection - plants a CommonsCollections6 payload that fires when the cron trigger runs. SSVC rates technical impact as total with a proof-of-concept exploit; EPSS is low at 0.40% (61st percentile) and it is not in CISA KEV, so this is currently a PoC-stage rather than mass-exploited issue.
Unauthenticated SQL injection in the DirectoryPress - Business Directory And Classified Ad Listing WordPress plugin (versions ≤ 3.6.26) allows remote attackers to extract sensitive database information via the 'packages' parameter. Exploitation requires no user interaction or privileges, making it highly automatable. No active exploitation or public exploit code has been reported, and the EPSS probability is low (0.06%).
Denial of service in fio (Flexible I/O Tester) v3.41 lets a crafted job file crash the process via a NULL pointer dereference: when the fdp_pli option is supplied without an argument, the str_fdp_pli_cb() callback passes a NULL pointer to strdup(), triggering a segmentation fault (CWE-476). Only availability is affected - no code execution or data exposure. It carries a low EPSS score (0.06%, 19th percentile), is not on CISA KEV, and has no public exploit identified at time of analysis, though a referenced gist and upstream GitHub issue #2055 document reproduction.
Unauthenticated denial of service in zrok's OAuth-protected proxy shares (openziti/zrok <= 1.1.11 and v2 < 2.0.1) lets a remote attacker crash the proxy process with a single crafted Cookie header. The GetSessionCookie routine reads an attacker-controlled cookie-stripe count and performs make([]string, count) with no upper bound before any authentication, driving gigabyte-scale heap allocations that cause OOM termination or goroutine panics across every share the proxy serves. There is no public exploit identified at time of analysis, and EPSS is low (0.06%), but exploitation is trivially automatable per CISA SSVC.
Stack buffer overflow in ngtcp2, a C implementation of the IETF QUIC protocol, affects all versions prior to 1.22.1 when the qlog logging callback is enabled. The function ngtcp2_qlog_parameters_set_transport_params() serializes peer-supplied QUIC transport parameters into a fixed 1024-byte stack buffer without bounds checking, so a remote peer can send oversized transport parameters during the handshake to write past the buffer and crash the process (availability impact per CVSS 7.5). SSVC lists exploitation status as 'poc' and there is publicly available exploit code exists, but EPSS is very low at 0.04% (12th percentile), and it is not in CISA KEV.
SQL injection in Riaxe Product Customizer for WordPress (all versions ≤2.1.2) allows unauthenticated remote attackers to extract sensitive database contents via crafted REST API requests. The vulnerability exists in the /wp-json/InkXEProductDesignerLite/add-item-to-cart endpoint where the 'options' parameter keys within 'product_data' lack proper SQL escaping. CVSS 7.5 (High) with attack vector network/low complexity/no authentication required. Wordfence discovery indicates active researcher attention. No CISA KEV listing or public exploit code identified at time of analysis, but EPSS data unavailable for risk calibration.
Apache Airflow 3.0.0 through 3.1.x exposes JWT authentication tokens in application logs, allowing any authenticated UI user with log access to escalate privileges and impersonate DAG Authors. CVSS rates this 7.5 HIGH for confidentiality impact, though the EPSS score of 0.02% (5th percentile) suggests minimal observed exploitation attempts. No active exploitation is confirmed; vendor patch available in version 3.2.0 released April 2026.
Signature validation bypass in Redsys payment gateway plugin (WooCommerce) allows remote attackers to mark unpaid orders as completed without actual payment. Unauthenticated attackers who obtain a valid order key and amount can forge payment callbacks across Redsys, Bizum, and Google Pay flows, enabling fraudulent order fulfillment. Affects versions ≤7.0.0 of 'Payment Gateway for Redsys & WooCommerce Lite' WordPress plugin. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation, though EPSS data unavailable. No CISA KEV listing or public POC identified at time of analysis. Vendor patch released in changeset 3501998.
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
Authentication and authorization bypass in @fastify/middie 9.3.1 and earlier lets remote unauthenticated attackers reach protected routes by sending URLs with duplicate leading slashes (e.g. //admin/secret) when the deprecated top-level Fastify ignoreDuplicateSlashes option is enabled. Because middie reads the option only from routerOptions while Fastify's router still honors the top-level form, a normalization gap allows middleware-enforced checks to be skipped. There is no public exploit identified at time of analysis and EPSS is negligible (0.04%), but SSVC rates technical impact as total, reflecting a full auth-check bypass on affected deployments.
Command injection in radare2's rabin2 PDB parser allows local attackers to execute arbitrary commands when the tool is compiled without SSL support on UNIX systems. The vulnerability (CWE-78) affected a narrow window between commits 01ca2f6 and 9236f44 (post-6.1.2, pre-6.1.3), spanning less than one week in the development timeline. CVSS 7.4 (HIGH) reflects local attack vector with high complexity but no authentication required. No active exploitation confirmed (not in CISA KEV), though publicly available exploit code exists. EPSS data not provided. Fixed in commit 9236f44a28 per GitHub PR #25651.
SQL injection in SourceCodester Simple Music Cloud Community System v1.0 lets remote attackers inject malicious SQL through the /music/view_playlist.php endpoint, enabling unauthorized database queries against the backend. Per the CVSS vector (PR:N) the flaw is reachable without authentication, and a public technical write-up describing the injection is available on GitHub, though it is not listed in CISA KEV and carries a very low EPSS score (0.03%). SSVC rates exploitation as not-observed but automatable with partial technical impact, marking it as opportunistically scannable rather than actively weaponized.
SQL injection in SourceCodester Simple Music Cloud Community System v1.0 allows remote attackers to manipulate backend database queries through the /music/view_music.php endpoint. The flaw stems from unsanitized user input reaching a SQL statement (CWE-89), enabling database content disclosure and tampering. No public exploit identified at time of analysis beyond a third-party GitHub vulnerability report, and EPSS is very low (0.03%, 7th percentile), consistent with an obscure hobby-grade PHP application rather than a mass-exploited target.
Local privilege escalation in Dell Storage Manager - Replay Manager for Microsoft Servers 8.0 allows low-privileged authenticated users to gain elevated privileges with high integrity and availability impact. Dell has released security advisory DSA-2026-058 with patches. The CVSS 7.3 (High) score reflects significant post-exploitation impact, though local access and existing authentication requirements limit initial attack surface. No active exploitation (CISA KEV) or public proof-of-concept code identified at time of analysis.
Stored Cross-Site Scripting in Prismatic WordPress plugin (all versions ≤3.7.3) allows unauthenticated remote attackers to inject malicious scripts via crafted comment submissions containing the 'prismatic_encoded' pseudo-shortcode. Vulnerable code in prismatic_decode function fails to sanitize user-supplied attributes. CVSS 7.2 with scope change (S:C) elevates impact beyond vulnerable component. EPSS data not available; no CISA KEV listing identified. Wordfence threat intelligence confirms vulnerability; patch released in version 3.7.4 per WordPress plugin repository changelog.
SQL injection in SourceCodester Vehicle Parking Area Management System v1.0 allows authenticated administrators to execute arbitrary SQL commands via the /parking/manage_location.php endpoint. CVSS 7.2 indicates high-privilege requirement (PR:H) limiting exploitation to compromised admin accounts or insider threats. EPSS score of 0.01% (2nd percentile) suggests minimal observed exploitation activity. No CISA KEV listing indicates no confirmed active exploitation in enterprise environments.
SQL injection in SourceCodester Vehicle Parking Area Management System v1.0 allows authenticated high-privilege users to execute arbitrary SQL queries via the /parking/manage_user.php endpoint. CVSS 7.2 with network vector but requires high-privilege authentication (PR:H), significantly limiting attack surface. EPSS probability is very low (0.01%, 2nd percentile), indicating minimal observed exploitation activity. No CISA KEV listing or public POC confirmation, though a technical writeup exists in GitHub repository mt-0505/cve-report.
SQL injection in SourceCodester Vehicle Parking Area Management System v1.0 allows authenticated high-privilege users to execute arbitrary SQL commands via the /parking/view_parked_details.php endpoint. The vulnerability requires administrative credentials (CVSS PR:H) but enables full database compromise once authenticated. EPSS score of 0.01% (2nd percentile) indicates minimal observed exploitation activity. A public proof-of-concept exists on GitHub, lowering the technical barrier for authenticated attackers.
SQL injection in SourceCodester Vehicle Parking Area Management System v1.0 allows high-privileged authenticated attackers to execute arbitrary SQL commands via the /parking/manage_category.php endpoint, enabling complete database compromise. EPSS score of 0.01% (2nd percentile) indicates minimal observed exploitation activity. Proof-of-concept exploit code is publicly available on GitHub, lowering the barrier for authenticated attackers with administrative access.
Denial of service in the Protobuf PHP library (protobuf-php / composer google/protobuf) allows remote attackers to crash applications that deserialize untrusted Protocol Buffers input by submitting messages containing negative varints or excessively deep nested recursion. All versions below 4.33.6 (and the 5.x line prior to 5.34.0-RC1) are affected; there is no public exploit identified at time of analysis, and EPSS is low at 0.07%, but a vendor patch is available and the issue was reported by Google's CVE coordination team.
Path traversal in OpenHarness allows authenticated gateway users with chat access to read arbitrary files on the server via the '/memory show' slash command. Affecting all versions prior to commit dd1d235, attackers can inject directory traversal sequences to escape the project memory directory and access any file readable by the OpenHarness process. CVSS 7.1 reflects high confidentiality impact with low-privilege network access. Vendor patch available via GitHub commit dd1d235450dd987b20bff01b7bfb02fe8620a0af. No public exploit identified at time of analysis, EPSS data unavailable.
Password reset token leakage in FuelCMS 1.5.2 allows unauthenticated attackers to steal a victim's password reset token through a malicious link placed in a valid password reset email. The attacker can then reset the victim's password, gaining unauthorized account access. A proof-of-concept exploit is publicly available, though exploitation is not automated and no active exploitation has been confirmed.
Local privilege escalation in the AMD Platform Configuration Blob (APCB) SMM driver, shipped in AGESA firmware across nearly the entire modern AMD EPYC, Ryzen, Threadripper, and Instinct MI300 line, lets a Ring 0 attacker escalate into System Management Mode (SMM) and potentially run arbitrary code below the operating system. The flaw stems from the SMM driver improperly invoking UEFI boot services, and AMD-reported it with a CVSS 4.0 base of 7.1; there is no public exploit identified at time of analysis and EPSS is negligible at 0.01%. Because SMM code runs at a higher trust level than the OS kernel, successful exploitation can undermine firmware integrity and any SMM-based security guarantees.
LINE for iOS versions before 26.3.0 suffer from dialog-based denial-of-service through the in-app browser. A remote attacker can render an iOS device temporarily inoperable by crafting a malicious web page that triggers infinite OS-level dialog loops when opened in LINE's browser, requiring only that a user click a malicious link. EPSS exploitation probability is minimal (0.01%, 1st percentile) with no active exploitation confirmed. Vendor patch released in version 26.3.0, addressing CWE-451 (user interface misrepresentation).
Out-of-bounds reads in openCryptoki's BER/DER decoding layer expose Linux and AIX systems to cryptographic service disruption and limited memory disclosure across all token backends. All five primitive decoders in the shared asn1.c library lack buffer-length parameters, accepting attacker-controlled BER length fields without validating them against actual buffer boundaries - a condition reachable via PKCS#11 API operations (C_CreateObject, C_UnwrapKey), token file loading from disk, or remote backend channels (ICSF). Proof-of-concept code exists per SSVC classification, though EPSS sits at 0.01% and no confirmed active exploitation (CISA KEV) has been recorded.
Credential exposure in Dell PowerScale OneFS affects all versions prior to 9.12.0.0, where sensitive authentication material is inadvertently written to log files readable by low-privileged local users. A locally authenticated attacker who triggers the relevant logging path and can read the resulting log files may extract credentials belonging to other users, then authenticate as those accounts to operate at the victim's privilege level. No public exploit code exists (EPSS 0.01%, SSVC exploitation: none), positioning this as a post-compromise lateral movement or privilege escalation risk rather than an initial access vector.
Eaton Intelligent Power Protector (IPP) software allows brute-force credential attacks against the web interface login page due to missing rate-limiting controls, enabling remote attackers to enumerate valid credentials and gain unauthorized access without authentication. CVSS 6.5 reflects moderate confidentiality and integrity impact via network access. Eaton has released a patched version available from their download center.
Yamaha SR-B30A sound bar firmware 2.40 allows remote attackers within Bluetooth Low Energy (BLE) radio range to connect to the device and modify settings without authentication via the Sound Bar Remote protocol. The vulnerability enables unauthenticated integrity compromise (modification of device configuration) but does not expose sensitive data or cause denial of service. This affects only devices within BLE proximity range, significantly limiting practical attack scope despite the moderate CVSS score.
SQL injection in Accessibility Suite by Ability, Inc WordPress plugin (versions up to 4.20) allows authenticated attackers with Subscriber-level access to extract sensitive database information via an unescaped 'scan_id' parameter. The vulnerability is unauthenticated remote network-accessible but requires low-privilege login credentials; no public exploit code or active exploitation has been identified at the time of analysis.
Stored Cross-Site Scripting in the Email Encoder - Protect Email Addresses and Phone Numbers WordPress plugin (versions ≤ 2.4.4) allows authenticated contributors to inject persistent JavaScript via the 'eeb_mailto' shortcode due to missing sanitization in MailtoShortcode.php. When any user visits a page containing the poisoned shortcode, the injected script executes in their browser, enabling session hijack, credential theft, or admin account takeover. EPSS sits at 0.03% (8th percentile) and CISA SSVC records exploitation as none, placing current real-world risk low despite the scope-changed CVSS of 6.4.
Livemesh Addons for Elementor plugin versions up to 9.0 allow authenticated attackers with Subscriber-level access to inject arbitrary JavaScript via the plugin settings page through missing authorization checks on the AJAX handler lae_admin_ajax() and insufficient output escaping on checkbox fields. The injected scripts execute whenever an administrator accesses the settings page if the attacker obtains a valid nonce, which can be leaked due to improper access control on settings pages. This combination of authorization bypass and stored XSS affects all WordPress installations running the vulnerable plugin.
Stored XSS in WP Maps plugin for WordPress allows authenticated contributors to inject malicious scripts via the 'put_wpgm' shortcode due to insufficient input sanitization and output escaping. Attackers with contributor-level access and above can craft malicious shortcode attributes that persist in page content and execute for all subsequent visitors. All versions up to 4.8.7 are affected; patched version 4.8.8 is available.
Stored Cross-Site Scripting in BetterDocs WordPress plugin versions up to 4.3.8 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via the 'betterdocs_feedback_form' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users who view affected pages, enabling account compromise, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at this time.
Stored cross-site scripting in the Vantage WordPress theme up to version 1.20.32 allows authenticated contributors and higher-privileged users to inject malicious scripts into gallery block text content that execute for all site visitors. The vulnerability stems from insufficient output escaping in the gallery template, enabling attackers with contributor-level access to compromise page integrity and potentially steal session tokens or deface content.
Stored Cross-Site Scripting (XSS) in WP Docs plugin for WordPress (all versions through 2.2.9) allows authenticated attackers with subscriber-level access to inject malicious scripts via the 'wpdocs_options[icon_size]' parameter due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user accessing the affected page, enabling session hijacking, credential theft, or malware distribution with no user interaction required beyond normal site browsing. No public exploit code has been identified, but the vulnerability is technically straightforward to exploit given valid subscriber credentials.
Stored Cross-Site Scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate through version 7.4.9 allows authenticated contributors and above to inject arbitrary JavaScript into WordPress pages via the 'su_box' shortcode due to insufficient input sanitization and output escaping. The injected scripts execute in the context of all users who access the affected pages, potentially compromising site visitors' sessions and data. No public exploit code has been identified at the time of analysis, though the vulnerability is straightforward to reproduce and weaponize.
Stored Cross-Site Scripting in WP YouTube Lyte plugin for WordPress versions up to 1.7.29 allows authenticated contributors and above to inject arbitrary JavaScript via the 'lyte' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users viewing affected pages. No public exploit code or active exploitation has been confirmed at time of analysis; patch is available in version 1.7.30 and later.
ONLYOFFICE DesktopEditors versions before 9.3.0 allow local attackers to perform arbitrary file operations with SYSTEM privileges via the update service, resulting in denial of service through resource exhaustion or file manipulation. The vulnerability requires local access and operates without user interaction, making it a significant privilege-escalation risk in multi-user or compromised-account scenarios.
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthenticated attackers to inject arbitrary web scripts. Affected versions include API Manager 3.1.0 to 4.1.0 and Identity Server 5.10.0 to 5.11.0. While exploitation requires user interaction, successful attacks can result in information disclosure or UI manipulation; EPSS indicates very low exploitation likelihood, and no active exploitation or public exploit is currently identified.
Reflected Cross-Site Scripting in Customer Reviews for WooCommerce plugin allows unauthenticated attackers to inject arbitrary JavaScript via the unescaped 'crsearch' parameter, affecting all versions up to 5.101.0. Exploitation requires social engineering (victim must click a malicious link), but successful attacks can steal session cookies, perform actions as the logged-in user, or redirect to phishing sites. No public exploit code or active exploitation has been identified, though the vulnerability is trivially reproducible given the simple parameter manipulation required.
Stored Cross-Site Scripting (XSS) in CodeColorer plugin for WordPress versions up to 0.10.1 allows unauthenticated attackers to inject malicious JavaScript via the 'class' parameter in the 'cc' comment shortcode, which executes in the browsers of users viewing the affected page. Exploitation requires comments to be enabled and guest comments permitted on the target post. The vulnerability has a CVSS score of 6.1 with low complexity and no authentication required, but user interaction (visiting the affected page) is necessary for the payload to execute.
Reflected XSS in zrok's GitHub OAuth callback allows an unauthenticated attacker to execute arbitrary JavaScript in the OAuth server's browser origin by delivering a crafted login URL to a victim. The proxyUi template engine uses Go's text/template (no HTML escaping) rather than html/template, and both publicProxy and dynamicProxy OAuth callback handlers embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, rendering that error unescaped into HTML. Exploitation requires user interaction (victim must click the link and complete the GitHub OAuth flow); no active exploitation is confirmed (not in CISA KEV, EPSS 0.01%, SSVC exploitation: none), but a vendor-confirmed fix is available in v2.0.1 while v1.x remains unpatched.
Unauthorized access persists in WSO2 Identity Server after user accounts are locked because existing access tokens are not revoked, allowing locked users to continue accessing protected resources until the tokens naturally expire. Affected versions prior to 5.2.0.35 are vulnerable. A vendor patch is available, but no active exploitation or public exploits are known at this time.
Eaton Intelligent Power Protector (IPP) software allows authenticated administrators with local system access to execute arbitrary commands via XML input validation bypass, requiring user interaction. The vulnerability impacts all versions of IPP software prior to the latest patched release available on Eaton's download center. CVSS score of 6.0 reflects high integrity and availability impact but is constrained by elevated privilege requirements and high attack complexity.
Missing lock check in the AMD Platform Security Processor (PSP) across multiple EPYC server CPU generations enables a locally privileged attacker to potentially compromise guest VM confidentiality, undermining AMD SEV-based isolation guarantees. Multiple series are confirmed affected - EPYC 7003, 8004, 9004, 9005, and all corresponding Embedded variants - with firmware patches now available for each. No public exploit code exists and CISA SSVC rates exploitation as 'none' with partial technical impact, consistent with the 0.01% EPSS score (2nd percentile), making this a targeted risk primarily relevant to cloud and virtualization providers relying on AMD SEV for tenant isolation.
Route guard bypass in @fastify/static 8.0.0-9.1.0 exposes files protected by Fastify path-based middleware to unauthenticated remote attackers via percent-encoded path separators. The plugin decodes %2F in URLs before filesystem path resolution, while Fastify's router evaluates the raw encoded string - guards checking for a path like /protected/ never fire when the request arrives as /protected%2F, yet @fastify/static serves the file anyway. No public exploit is identified at time of analysis and EPSS is 0.01%, but confidentiality impact is rated High when route guards are the sole access control layer.
Insecure HTTP response header configuration in Eaton Intelligent Power Protector (IPP) software enables attackers to perform web-based attacks including information disclosure and content modification. The vulnerability requires network access, unusual attack complexity, and user interaction (CVSS AV:N/AC:H/PR:N/UI:R), affecting all versions of IPP software prior to the patched release. No public exploit code or active exploitation has been identified at time of analysis.
OAuth2 credential theft in Sparx Enterprise Architect 16.1.1627 is possible because the client fails to validate the 'aud' (audience) claim of tokens received during OpenID Connect authentication, allowing a local attacker to capture credentials intended for a different relying party. An attacker with low-privileged local access who can position themselves in the OAuth2 exchange - when a victim user is actively authenticating - can obtain high-value OAuth2 credentials and gain access to protected resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS is 0.02% and SSVC exploitation status is 'none'.
Eaton Intelligent Power Protector (IPP) software uses insecure cookie configuration that allows network attackers to intercept session cookies via man-in-the-middle attack when high-privilege users interact with the application. CVSS 5.7 reflects the requirement for high privileges and user interaction, combined with high confidentiality and integrity impact. Eaton has released a patched version available on their download center.