Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis_client_id. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Out-of-bounds reads in openCryptoki's BER/DER decoding layer expose Linux and AIX systems to cryptographic service disruption and limited memory disclosure across all token backends. All five primitive decoders in the shared asn1.c library lack buffer-length parameters, accepting attacker-controlled BER length fields without validating them against actual buffer boundaries - a condition reachable via PKCS#11 API operations (C_CreateObject, C_UnwrapKey), token file loading from disk, or remote backend channels (ICSF). Proof-of-concept code exists per SSVC classification, though EPSS sits at 0.01% and no confirmed active exploitation (CISA KEV) has been recorded.
Credential exposure in Dell PowerScale OneFS affects all versions prior to 9.12.0.0, where sensitive authentication material is inadvertently written to log files readable by low-privileged local users. A locally authenticated attacker who triggers the relevant logging path and can read the resulting log files may extract credentials belonging to other users, then authenticate as those accounts to operate at the victim's privilege level. No public exploit code exists (EPSS 0.01%, SSVC exploitation: none), positioning this as a post-compromise lateral movement or privilege escalation risk rather than an initial access vector.
Eaton Intelligent Power Protector (IPP) software allows brute-force credential attacks against the web interface login page due to missing rate-limiting controls, enabling remote attackers to enumerate valid credentials and gain unauthorized access without authentication. CVSS 6.5 reflects moderate confidentiality and integrity impact via network access. Eaton has released a patched version available from their download center.
Yamaha SR-B30A sound bar firmware 2.40 allows remote attackers within Bluetooth Low Energy (BLE) radio range to connect to the device and modify settings without authentication via the Sound Bar Remote protocol. The vulnerability enables unauthenticated integrity compromise (modification of device configuration) but does not expose sensitive data or cause denial of service. This affects only devices within BLE proximity range, significantly limiting practical attack scope despite the moderate CVSS score.
SQL injection in Accessibility Suite by Ability, Inc WordPress plugin (versions up to 4.20) allows authenticated attackers with Subscriber-level access to extract sensitive database information via an unescaped 'scan_id' parameter. The vulnerability is unauthenticated remote network-accessible but requires low-privilege login credentials; no public exploit code or active exploitation has been identified at the time of analysis.
Stored Cross-Site Scripting in the Email Encoder - Protect Email Addresses and Phone Numbers WordPress plugin (versions ≤ 2.4.4) allows authenticated contributors to inject persistent JavaScript via the 'eeb_mailto' shortcode due to missing sanitization in MailtoShortcode.php. When any user visits a page containing the poisoned shortcode, the injected script executes in their browser, enabling session hijack, credential theft, or admin account takeover. EPSS sits at 0.03% (8th percentile) and CISA SSVC records exploitation as none, placing current real-world risk low despite the scope-changed CVSS of 6.4.
Livemesh Addons for Elementor plugin versions up to 9.0 allow authenticated attackers with Subscriber-level access to inject arbitrary JavaScript via the plugin settings page through missing authorization checks on the AJAX handler lae_admin_ajax() and insufficient output escaping on checkbox fields. The injected scripts execute whenever an administrator accesses the settings page if the attacker obtains a valid nonce, which can be leaked due to improper access control on settings pages. This combination of authorization bypass and stored XSS affects all WordPress installations running the vulnerable plugin.
Stored XSS in WP Maps plugin for WordPress allows authenticated contributors to inject malicious scripts via the 'put_wpgm' shortcode due to insufficient input sanitization and output escaping. Attackers with contributor-level access and above can craft malicious shortcode attributes that persist in page content and execute for all subsequent visitors. All versions up to 4.8.7 are affected; patched version 4.8.8 is available.
Stored Cross-Site Scripting in BetterDocs WordPress plugin versions up to 4.3.8 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via the 'betterdocs_feedback_form' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users who view affected pages, enabling account compromise, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at this time.
Stored cross-site scripting in the Vantage WordPress theme up to version 1.20.32 allows authenticated contributors and higher-privileged users to inject malicious scripts into gallery block text content that execute for all site visitors. The vulnerability stems from insufficient output escaping in the gallery template, enabling attackers with contributor-level access to compromise page integrity and potentially steal session tokens or deface content.
Stored Cross-Site Scripting (XSS) in WP Docs plugin for WordPress (all versions through 2.2.9) allows authenticated attackers with subscriber-level access to inject malicious scripts via the 'wpdocs_options[icon_size]' parameter due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user accessing the affected page, enabling session hijacking, credential theft, or malware distribution with no user interaction required beyond normal site browsing. No public exploit code has been identified, but the vulnerability is technically straightforward to exploit given valid subscriber credentials.
Stored Cross-Site Scripting (XSS) in WP Shortcodes Plugin - Shortcodes Ultimate through version 7.4.9 allows authenticated contributors and above to inject arbitrary JavaScript into WordPress pages via the 'su_box' shortcode due to insufficient input sanitization and output escaping. The injected scripts execute in the context of all users who access the affected pages, potentially compromising site visitors' sessions and data. No public exploit code has been identified at the time of analysis, though the vulnerability is straightforward to reproduce and weaponize.
Stored Cross-Site Scripting in WP YouTube Lyte plugin for WordPress versions up to 1.7.29 allows authenticated contributors and above to inject arbitrary JavaScript via the 'lyte' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users viewing affected pages. No public exploit code or active exploitation has been confirmed at time of analysis; patch is available in version 1.7.30 and later.
ONLYOFFICE DesktopEditors versions before 9.3.0 allow local attackers to perform arbitrary file operations with SYSTEM privileges via the update service, resulting in denial of service through resource exhaustion or file manipulation. The vulnerability requires local access and operates without user interaction, making it a significant privilege-escalation risk in multi-user or compromised-account scenarios.
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthenticated attackers to inject arbitrary web scripts. Affected versions include API Manager 3.1.0 to 4.1.0 and Identity Server 5.10.0 to 5.11.0. While exploitation requires user interaction, successful attacks can result in information disclosure or UI manipulation; EPSS indicates very low exploitation likelihood, and no active exploitation or public exploit is currently identified.
Reflected Cross-Site Scripting in Customer Reviews for WooCommerce plugin allows unauthenticated attackers to inject arbitrary JavaScript via the unescaped 'crsearch' parameter, affecting all versions up to 5.101.0. Exploitation requires social engineering (victim must click a malicious link), but successful attacks can steal session cookies, perform actions as the logged-in user, or redirect to phishing sites. No public exploit code or active exploitation has been identified, though the vulnerability is trivially reproducible given the simple parameter manipulation required.
Stored Cross-Site Scripting (XSS) in CodeColorer plugin for WordPress versions up to 0.10.1 allows unauthenticated attackers to inject malicious JavaScript via the 'class' parameter in the 'cc' comment shortcode, which executes in the browsers of users viewing the affected page. Exploitation requires comments to be enabled and guest comments permitted on the target post. The vulnerability has a CVSS score of 6.1 with low complexity and no authentication required, but user interaction (visiting the affected page) is necessary for the payload to execute.
Reflected XSS in zrok's GitHub OAuth callback allows an unauthenticated attacker to execute arbitrary JavaScript in the OAuth server's browser origin by delivering a crafted login URL to a victim. The proxyUi template engine uses Go's text/template (no HTML escaping) rather than html/template, and both publicProxy and dynamicProxy OAuth callback handlers embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, rendering that error unescaped into HTML. Exploitation requires user interaction (victim must click the link and complete the GitHub OAuth flow); no active exploitation is confirmed (not in CISA KEV, EPSS 0.01%, SSVC exploitation: none), but a vendor-confirmed fix is available in v2.0.1 while v1.x remains unpatched.
Unauthorized access persists in WSO2 Identity Server after user accounts are locked because existing access tokens are not revoked, allowing locked users to continue accessing protected resources until the tokens naturally expire. Affected versions prior to 5.2.0.35 are vulnerable. A vendor patch is available, but no active exploitation or public exploits are known at this time.
Eaton Intelligent Power Protector (IPP) software allows authenticated administrators with local system access to execute arbitrary commands via XML input validation bypass, requiring user interaction. The vulnerability impacts all versions of IPP software prior to the latest patched release available on Eaton's download center. CVSS score of 6.0 reflects high integrity and availability impact but is constrained by elevated privilege requirements and high attack complexity.
Missing lock check in the AMD Platform Security Processor (PSP) across multiple EPYC server CPU generations enables a locally privileged attacker to potentially compromise guest VM confidentiality, undermining AMD SEV-based isolation guarantees. Multiple series are confirmed affected - EPYC 7003, 8004, 9004, 9005, and all corresponding Embedded variants - with firmware patches now available for each. No public exploit code exists and CISA SSVC rates exploitation as 'none' with partial technical impact, consistent with the 0.01% EPSS score (2nd percentile), making this a targeted risk primarily relevant to cloud and virtualization providers relying on AMD SEV for tenant isolation.
Route guard bypass in @fastify/static 8.0.0-9.1.0 exposes files protected by Fastify path-based middleware to unauthenticated remote attackers via percent-encoded path separators. The plugin decodes %2F in URLs before filesystem path resolution, while Fastify's router evaluates the raw encoded string - guards checking for a path like /protected/ never fire when the request arrives as /protected%2F, yet @fastify/static serves the file anyway. No public exploit is identified at time of analysis and EPSS is 0.01%, but confidentiality impact is rated High when route guards are the sole access control layer.
Insecure HTTP response header configuration in Eaton Intelligent Power Protector (IPP) software enables attackers to perform web-based attacks including information disclosure and content modification. The vulnerability requires network access, unusual attack complexity, and user interaction (CVSS AV:N/AC:H/PR:N/UI:R), affecting all versions of IPP software prior to the patched release. No public exploit code or active exploitation has been identified at time of analysis.
OAuth2 credential theft in Sparx Enterprise Architect 16.1.1627 is possible because the client fails to validate the 'aud' (audience) claim of tokens received during OpenID Connect authentication, allowing a local attacker to capture credentials intended for a different relying party. An attacker with low-privileged local access who can position themselves in the OAuth2 exchange - when a victim user is actively authenticating - can obtain high-value OAuth2 credentials and gain access to protected resources. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS is 0.02% and SSVC exploitation status is 'none'.
Eaton Intelligent Power Protector (IPP) software uses insecure cookie configuration that allows network attackers to intercept session cookies via man-in-the-middle attack when high-privilege users interact with the application. CVSS 5.7 reflects the requirement for high privileges and user interaction, combined with high confidentiality and integrity impact. Eaton has released a patched version available on their download center.
Unsandboxed Jinja2 template rendering in home-assistant-cli before version 1.0.0 enables arbitrary code execution on the local machine when a user processes a maliciously crafted template with the `--local` flag. Exploitation chains two steps - an attacker distributes a crafted `.j2` template and social-engineers the victim into rendering it locally - allowing traversal of Python's `__globals__` and `__builtins__` to invoke arbitrary OS commands. No public exploit has been identified and CISA KEV does not list this CVE, consistent with SSVC's assessment of zero current exploitation; despite the "Technical Impact: total" SSVC rating, real-world risk is substantially limited by the multi-step social engineering preconditions.
Insuffient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised HV to trigger an out of bounds condition without RMP checks resulting in a. Rated medium severity (CVSS 5.6).
Stored cross-site scripting in Better Find and Replace WordPress plugin (versions ≤1.7.9) allows authenticated attackers with Author-level privileges or above to inject arbitrary web scripts via the title field of uploaded images. The injected script executes in the browsers of any user who accesses a page containing the malicious image, potentially leading to session hijacking or phishing attacks. No active exploitation or public proof-of-concept is reported.
The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
TP-Link Archer C7 v5 and v5.8 routers use weak RSA-1024 encryption for admin password transmission during web login, allowing adjacent attackers with network traffic interception capability to perform cryptanalytic attacks (brute-force or key factorization) to recover plaintext credentials and gain unauthorized administrative access. EPSS score of P (Probable) and active POC availability indicate realistic exploitation risk in local network environments; however, exploitation requires both network adjacency and successful cryptanalysis of a 1024-bit RSA key, limiting attack scope to motivated adversaries on shared networks (e.g., compromised WiFi).
Privilege escalation in ASUS DriverHub through version 1.0.6.11 allows local authenticated users to modify update validation resources, bypassing security checks to execute arbitrary code with elevated privileges during driver updates. The vulnerability exploits improper file permission assignment in the update process, requiring user interaction to trigger the elevated execution. CVSS 5.4 indicates moderate severity; exploitation requires local access and authenticated user status with specific file system conditions.
Privilege escalation in ASUS Member Center (华硕大厅) versions 1.6.6.4 and earlier allows authenticated local users to achieve Administrator-level privilege escalation by exploiting a Time-of-check Time-of-use (TOC-TOU) race condition during the update process. An attacker can substitute a malicious payload for the legitimate downloaded update immediately after integrity verification completes but before execution, causing the compromised code to run with administrative privileges upon user consent. CVSS 5.4 reflects the requirement for local access, user interaction, and elevated (but non-Administrator) initial privileges; however, the vulnerability achieves full privilege escalation to Administrator with moderate technical difficulty.
SiYuan 3.6.1 through 3.6.3 allows arbitrary code execution when users view malicious bazaar packages in the marketplace UI. The vulnerability stems from an incomplete XSS fix (for CVE-2026-33066) that enabled an HTML sanitizer but failed to block iframe tags with srcdoc attributes containing embedded scripts. A malicious package author can inject JavaScript that executes in the Electron process with full application privileges, compromising the user's machine. The issue is confirmed fixed in version 3.6.4 and no public exploitation has been reported at time of analysis.
Riaxe Product Customizer plugin for WordPress versions up to 2.1.2 allows unauthenticated attackers to delete arbitrary user accounts via a REST API endpoint lacking permission checks. The POST /wp-json/InkXEProductDesignerLite/customer/delete_customer route accepts a list of user IDs and directly deletes them without authentication or authorization validation, enabling attackers to remove administrator accounts and cause complete site lockout. This is confirmed by Wordfence and affects all installations running the vulnerable plugin version.
Broken ownership check in zrok's DELETE /api/v2/unaccess endpoint allows a low-privileged authenticated user to permanently delete admin-created global frontend records, taking down all public shares routed through that frontend on the affected instance. The flaw exists in controller/unaccess.go (unaccessHandler.Handle, line 56): when a frontend's environment_id is NULL - the marker for admin-created global frontends - the ownership guard short-circuits to false and skips authorization entirely. Exploitation requires prior knowledge of a global frontend token obtained out-of-band; no active exploitation is confirmed (not in CISA KEV), and EPSS is 0.04% at the 11th percentile, indicating low real-world exploitation probability at time of analysis.
Protected file access bypass in Silverstripe Assets Module allows unauthenticated remote visitors to read files that should be restricted by the CMS file permission system. When image variants are generated via template rendering - for example calling ScaleWidth() or Convert() - the DBFile::getURL() and DBFile::getSourceURL() methods incorrectly insert an access grant into the current HTTP session, nullifying the "protected" visibility setting for those files. Versions prior to 2.4.5 and 3.0.0-rc1 through 3.1.2 are affected; patches exist at 2.4.5 and 3.1.3. No public exploit has been identified at time of analysis, and EPSS is very low at 0.03%, but SSVC flags the attack as automatable.
Payment status manipulation in the Fluent Forms WordPress plugin (versions up to and including 6.1.21) allows unauthenticated remote attackers to alter Stripe SCA payment submission statuses - for example, forcing a pending payment to 'failed' - by supplying an arbitrary submission_id to an unprotected AJAX endpoint. The vulnerability stems from missing authorization and ownership validation on a user-controlled parameter in the Stripe SCA confirmation flow. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.03%, though SSVC flags the attack as automatable, making bulk interference with payment workflows theoretically feasible at scale.
Path traversal in @fastify/static 8.0.0-9.1.0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths accessible to the Node.js process when the directory listing feature is explicitly enabled. The flaw resides in dirList.path(), which uses Node.js path.join() without verifying the resolved path remains within the configured static root, making URL sequences like /public/../etc/ sufficient to escape the intended boundary. No active exploitation has been identified (SSVC Exploitation: none; EPSS: 0.02%), though the attack is automatable against susceptible configurations; disclosure is limited to directory and file names only - file contents are not readable via this path.
Unauthenticated attackers can modify post share count metadata in Post Grid Gutenberg Blocks for News, Magazines, Blog Websites - PostX (PostX) plugin versions up to 5.0.5 due to a missing capability check in the ultp_shareCount_callback() function. This allows unauthorized modification of share_count post meta for any post including private and draft posts, affecting all WordPress installations running the vulnerable plugin. No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated attackers can modify stored map latitude and longitude options in the Basic Google Maps Placemarks WordPress plugin through version 1.10.7 due to missing authorization checks on administrative functions. The vulnerability allows remote, unauthenticated modification of critical map configuration without requiring user interaction, affecting any WordPress site running the vulnerable plugin with default settings. No public exploit code or active exploitation has been identified at the time of analysis.
Stored cross-site scripting (XSS) in wger fitness application allows authenticated users to inject malicious JavaScript via unescaped license attribution fields in ingredient and image models, which executes when any visitor views the affected page. The vulnerability persists in the database and can be exploited to steal session cookies, perform unauthorized actions as other users, or conduct phishing attacks. Affected versions allow low-privilege authenticated users (any non-temporary account) to create ingredients with JavaScript payloads in the `license_author` field, which bypasses all input sanitization and is rendered with Django's `|safe` filter, disabling auto-escaping.
UDP Console in Arcserve allows information disclosure when an administrator configures the activation server hostname to an arbitrary or malicious URL, causing the product to unintentionally communicate with and leak data to the attacker-controlled domain. The vulnerability requires user interaction (configuring a malicious hostname) and affects all versions of Arcserve UDP Console, with CVSS 6.3 (network-accessible, low complexity) indicating moderate real-world risk. No active exploitation or public proof-of-concept has been identified at the time of analysis.
Unauthorized BIOS access on Dell Client Platform systems is possible via a weak password recovery mechanism exploitable by anyone with physical access to the device. Affecting over 60 distinct Dell product lines - including Dell Pro, Alienware, ChengMing, and Dell G-series models - the flaw allows a physically-present, unauthenticated attacker to bypass BIOS password protections, with a CVSS-noted scope change indicating that the compromise can extend beyond the firmware layer itself. No public exploit code or CISA KEV listing exists; EPSS stands at 0.01%, and SSVC confirms exploitation status as 'none,' making this a low-urgency but real-risk issue for environments where physical security cannot be guaranteed.
ONLYOFFICE DocumentServer before 9.3.0 contains an untrusted pointer dereference vulnerability in XLS file processing that enables authenticated remote attackers to leak sensitive memory and bypass ASLR protections. The vulnerability affects XLS conversion workflows through multiple vectors including pictFmla.cbBufInCtlStm manipulation, allowing information disclosure without requiring user interaction. CVSS 5.0 reflects moderate risk given network accessibility and the authentication barrier, though the scope change to CVSS:C indicates potential cross-boundary impact.
Sensitive PII and citizen identifier (BSN) exposure in Valtimo's inbox module affects versions 13.0.0.RELEASE through 13.21.x, where InboxHandlingService logs full inbox message content at INFO level, making case details and personal data readable by anyone with application log access or the Valtimo admin role. The vulnerability requires high-privilege access (CVSS PR:H), confining realistic risk to insider threats or compromised admin accounts rather than external attackers. No public exploit exists and no active exploitation has been observed (EPSS 0.03%, SSVC exploitation: none); however, GDPR and privacy compliance implications are significant given BSN citizen identifiers may be exposed.
Integer overflow in FFmpeg's CENC subsample data parsing (libavformat/mov.c) before version 8.1 enables out-of-bounds memory writes on local systems processing specially crafted MP4 files. The vulnerability requires attacker-controlled media file input and non-default system configuration, limiting exploitation to local contexts; no active exploitation or public exploit code has been identified. With a CVSS score of 4.9 and low attack complexity requirement, this represents a moderate local integrity and confidentiality risk primarily affecting users who process untrusted video files from untrusted sources.
MuPDF mutool fails to sanitize PDF metadata before displaying it in terminal output, allowing local attackers to inject ANSI escape sequences through crafted PDF files. When a user runs mutool info on a malicious PDF, embedded escape codes can clear the terminal and display fabricated text for social engineering attacks such as fake login prompts or spoofed shell commands. This is a low-severity local vulnerability (CVSS 3.3) requiring user interaction, with a vendor-released patch available.
OAuth token interception in Cryptomator 1.19.1 is enabled by a logic flaw in CheckHostTrustController.getAuthority() that re-opens the attack surface addressed by CVE-2026-32303. An attacker with write access to a cloud-synced vault.cryptomator file can craft a Hub configuration mixing HTTPS-on-port-80 and plaintext HTTP endpoints, causing the application to auto-trust the vault without prompting the user while routing the OAuth tokenEndpoint over unencrypted HTTP. A network-positioned attacker who intercepts that exchange gains the victim's OAuth token and can authenticate to the Cryptomator Hub API on their behalf. No public exploit identified at time of analysis (SSVC lists poc), and EPSS sits at the 1st percentile, indicating low widespread exploitation probability. Vendor-released patch available in version 1.19.2.