Race condition in pyLoad's Flask session cookie handler allows unauthenticated attackers to manipulate the SESSION_COOKIE_SECURE flag globally across all concurrent requests by spoofing the X-Forwarded-Proto header. On deployments behind a TLS-terminating proxy, this enables session cookie downgrade attacks resulting in plaintext cookie transmission; on default plain HTTP deployments, it causes session denial of service by forcing the Secure flag and breaking all concurrent user sessions. The vulnerability requires no authentication and exploits a multi-threaded race window in the Cheroot WSGI server (request_queue_size=512) combined with missing proxy origin validation (acknowledged TODO in code).
SQL Injection in SourceCodester Payroll Management and Information System v1.0 exposes the /payroll/view_account.php endpoint to database-level manipulation via the emp_id GET parameter. The CVSS vector (PR:H) confirms exploitation requires high-privilege (administrative) authentication, substantially narrowing the realistic attacker population. No public exploit code or active exploitation has been identified; EPSS places this at the 7th percentile (0.02%), and SSVC assessment concurs with exploitation status of none and non-automatable attack path.
Stored cross-site scripting in OPEN-BRAIN WordPress plugin versions up to 0.5.0 allows authenticated administrators to inject malicious scripts via the API Key settings field, which are executed when any user accesses the plugin settings page. The vulnerability stems from improper use of sanitize_text_field() (which does not prevent attribute breakout) combined with missing esc_attr() escaping when outputting the API key to an HTML input value attribute. While exploitation requires administrator-level access, the stored nature means scripts persist and affect all subsequent user interactions with the settings page.
Stored Cross-Site Scripting (XSS) in Custom New User Notification plugin for WordPress versions up to 1.2.0 allows authenticated administrators to inject arbitrary JavaScript into plugin settings pages via unescaped admin form fields (User Mail Subject, User From Name, User From Email, Admin Mail Subject, Admin From Name, Admin From Email). When any user accesses the plugin settings page, the injected scripts execute in their browser context, enabling privilege escalation in WordPress multisite environments where subsite administrators target super administrators. No public exploit code or active exploitation has been identified; the attack requires Administrator-level credentials, limiting real-world risk despite moderate CVSS score.
Dell PowerScale OneFS prior to version 9.12.0.0 contains an improper resource shutdown or release flaw (CWE-404) that a high-privileged local attacker can exploit to cause a denial of service against the storage platform. The CVSS vector (AV:L/PR:H) confirms exploitation is constrained to authenticated local access with elevated privileges, significantly limiting the realistic attack surface. No public exploit code has been identified at time of analysis, EPSS sits at 0.01% (0th percentile), and CISA's SSVC framework rates exploitation as none and technical impact as partial, collectively indicating this is a low-urgency finding for most environments.
In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Denial of service in Dell PowerScale OneFS (versions prior to 9.12.0.0) is triggered by a high-privileged local attacker exploiting improper handling of unusual or exceptional conditions (CWE-754). The impact is limited entirely to availability, with no confidentiality or integrity exposure. No public exploit has been identified, EPSS stands at 0.01% (2nd percentile), and CISA SSVC classifies exploitation status as none - indicating this is a low-urgency finding despite the availability impact.