Privilege-based compromise of the Oracle Applications DBA product (ADPatch component) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows an already high-privileged attacker with HTTP network access to fully take over the Applications DBA and, via a scope change, significantly impact additional products. Exploitation is rated difficult and requires human interaction from a victim other than the attacker. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%, 10th percentile), and it is not in CISA KEV, indicating low real-world exploitation pressure despite the high CVSS score.
Weak password policy enforcement in Quantum Networks router QN-I-470 version 6.1.1.B1 enables adjacent network attackers to gain unauthorized administrative access through password brute-force attacks. CVSS 7.6 reflects adjacent network requirement (AV:A) and high complexity (AC:H), limiting exploitation to attackers already on the local network segment. No active exploitation confirmed (not in CISA KEV), but authentication bypass via brute-force is a well-understood attack primitive requiring only network proximity and time.
Remote denial of service in Coturn TURN/STUN server allows unauthenticated attackers to crash ARM64 deployments with a single malformed UDP packet. The vulnerability triggers a fatal SIGBUS signal via misaligned memory access during STUN attribute parsing, requiring no authentication or special configuration. All ARM64 installations of Coturn prior to 4.10.0 are vulnerable to instant process termination. EPSS exploitation probability is not yet available as this is a newly disclosed CVE, but the attack complexity is low (AC:L) and requires no privileges (PR:N), making exploitation trivial once awareness spreads in attacker communities.
Use-after-free memory corruption (CWE-416) in Mozilla Firefox 149 and ESR 115.34/140.9, plus the shared Gecko engine in Thunderbird 149 and Thunderbird ESR 140.9, can lead to arbitrary code execution within the browser process when a victim renders attacker-controlled web content. This is a rolled-up batch of memory-safety bugs reported by Mozilla's own developers; Mozilla states some showed evidence of memory corruption presumed exploitable for code execution. There is no public exploit identified at time of analysis, the bug is not in CISA KEV, and EPSS is very low (0.06%, 17th percentile), consistent with the CVSS 7.5 rating being held down by high attack complexity (AC:H) and required user interaction (UI:R).
Remote attackers can crash Mozilla Firefox by triggering a use-after-free in the JavaScript Engine, exploiting freed memory during JS execution to cause denial of service. Affects all unpatched Firefox versions below 150, ESR 115.35, and ESR 140.10. CVSS 7.5 (High) reflects network-accessible exploitation with no authentication required, though SSVC assessment indicates non-automatable exploitation with partial technical impact. No public exploit code or active exploitation (KEV) confirmed at time of analysis, and ENISA tracking suggests European-focused monitoring.
High-severity denial-of-service condition in Mozilla Firefox DOM processing allows remote attackers to crash the browser via network-delivered content without authentication or user interaction. Fixed in Firefox 150, Firefox ESR 115.35, and Firefox ESR 140.10. CVSS 7.5 reflects network attack vector with low complexity (AV:N/AC:L/PR:N/UI:N) but impact limited to availability (A:H). EPSS data not provided. Not listed in CISA KEV, indicating no confirmed active exploitation. SSVC framework rates exploitation as 'none' and technical impact as 'partial', suggesting lower real-world priority despite high CVSS score.
Account takeover in GitHub Enterprise Server (all versions prior to 3.21) is possible through an OAuth redirect URI validation bypass caused by a flawed regular expression (CWE-185). An attacker who knows a first-party OAuth application's registered callback URL can craft a malicious authorization link that leaks the victim's OAuth authorization code to an attacker-controlled domain, granting access to the victim's account with the scopes of that application. Reported via the GitHub Bug Bounty program; there is no public exploit identified at time of analysis, EPSS is very low (0.05%), and CISA SSVC records exploitation status as none.
Unlimited credential brute-forcing against blueprintUE Self-Hosted Edition login form allows remote attackers to enumerate valid accounts and compromise credentials through dictionary attacks, credential stuffing, or exhaustive guessing. The login handler (versions prior to 4.2.0) implements zero rate limiting, no progressive delays, no account lockouts, and no CAPTCHA challenges, enabling attackers to submit authentication attempts at full network speed. While a strong password policy is enforced (10+ characters, mixed case, digit, special), this does not prevent attacks using breached credential databases or targeted guessing against predictable passwords. EPSS exploitation probability data not available; no public exploit code or active exploitation confirmed at time of analysis.
Multiple memory corruption bugs in Firefox ESR 140.9, Firefox 149, Thunderbird ESR 140.9, and Thunderbird 149 could enable remote code execution against users visiting malicious websites. Mozilla has fixed these memory safety vulnerabilities in Firefox 150 and Firefox ESR 140.10, with vendor advisories (MFSA2026-30, MFSA2026-32, MFSA2026-33, MFSA2026-34) confirming patches are available. EPSS score of 0.05% (14th percentile) indicates low observed exploitation probability, and no public exploit identified at time of analysis, though SSVC framework assesses total technical impact if successfully weaponized.
Memory corruption in Firefox's Widget: Cocoa component on macOS enables remote denial of service through use-after-free exploitation. Mozilla patched this in Firefox 150 and Firefox ESR 140.10 after internal discovery. The CVSS vector indicates network-accessible exploitation requiring no authentication or user interaction, though SSVC assessment classifies technical impact as partial and exploitation as non-automatable. No public exploit identified at time of analysis, with SSVC indicating no evidence of active exploitation.
High-severity denial-of-service in Firefox WebRTC component allows remote unauthenticated attackers to crash the browser via network-based use-after-free memory corruption. Affects Firefox versions prior to 150 and Firefox ESR prior to 140.10. Vendor-released patches available (Firefox 150, Firefox ESR 140.10). CVSS 7.5 reflects high availability impact with low attack complexity and no privileges required. No public exploit identified at time of analysis, though SSVC framework classifies technical impact as partial and exploitation as none, suggesting limited real-world activity despite the theoretical ease of exploitation indicated by CVSS.
Signal K Server versions before 2.25.0 allow remote unauthenticated attackers to crash the server via Regular Expression Denial of Service (ReDoS) in WebSocket subscription handling. By injecting unescaped regex metacharacters into the context parameter, attackers trigger catastrophic backtracking that consumes 100% CPU and renders the server completely unresponsive to all API and socket requests. This creates a complete denial of service for marine navigation systems relying on Signal K Server as their central data hub. While EPSS score is low (0.04%, 13th percentile), the trivial exploitation complexity (AV:N/AC:L/PR:N/UI:N) and complete availability impact make this a priority for boat operators running vulnerable versions. No public exploit identified at time of analysis, but the GitHub security advisory provides clear technical details. Vendor-released patch available in version 2.25.0.
Denial-of-service in Oracle VM VirtualBox 7.2.6 (Core component) lets an unauthenticated remote attacker reachable over the VirtualBox Remote Desktop Protocol (VRDP/RDP) service trigger a hang or repeatable crash, producing a complete availability loss of the virtualization host process. There is no public exploit identified at time of analysis, and EPSS is very low (0.04%, 12th percentile), so while the flaw is network-reachable and unauthenticated, real-world exploitation pressure currently appears minimal. Note that the supplied 'Authentication Bypass' tag conflicts with the availability-only CVSS vector - the confirmed impact is DoS, not auth bypass.
Denial-of-service in Oracle Identity Manager Connector (Core component) version 12.2.1.4.0 lets a remote, unauthenticated attacker send network traffic over TCP to hang or repeatedly crash the service, producing a complete availability outage (CVSS 3.1 7.5). Oracle disclosed this in the April 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and EPSS is very low (0.04%). Confidentiality and integrity are unaffected - the impact is purely availability (CWE-400, resource exhaustion).
Denial of service in the Networking component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated, network-based attacker to cause a hang or repeatable crash (complete availability loss) of the affected runtime. The flaw is described by Oracle as easily exploitable via multiple protocols against any application that feeds attacker-controlled data to the vulnerable networking APIs (e.g., an exposed web service). There is no public exploit identified at time of analysis; EPSS is very low (0.04%, 12th percentile) and CISA SSVC lists exploitation status as none, so this is a patch-in-cycle availability issue rather than an active threat.
Remote attackers can crash Nest.js applications (versions prior to 11.1.19) by sending approximately 47 KB of fragmented JSON messages within a single TCP frame, triggering a call stack overflow. The handleData() function's recursive processing of small valid JSON messages causes stack exhaustion before maxBufferSize limits are enforced, resulting in RangeError and denial of service. No authentication required (CVSS AV:N/PR:N). Vendor patch released in version 11.1.19. EPSS data not available; no confirmed active exploitation (not in CISA KEV).
Denial-of-service in Firefox versions prior to 150 allows remote attackers to crash the browser via malformed audio/video content during playback. The vulnerability requires no authentication and minimal attack complexity (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), enabling attackers to render the browser unresponsive or terminated through crafted media files. Mozilla has released Firefox 150 to address this issue. EPSS data not available; no evidence of active exploitation (not in CISA KEV), though SSVC assessment notes the vulnerability is not currently being exploited and is classified as non-automatable with partial technical impact.
Denial-of-service in Firefox's Audio/Video playback component allows remote attackers to crash the browser via network-based exploitation requiring no authentication or user interaction. Mozilla patched the vulnerability in Firefox 150. CVSS 7.5 (High) reflects high availability impact, but SSVC assessment marks it as partial technical impact with no confirmed exploitation, indicating lower real-world priority than critical RCE vulnerabilities. No public exploit code or CISA KEV listing identified.
Integer overflow in Firefox's WebGPU graphics component enables remote denial-of-service attacks against default browser configurations. Attackers can trigger high availability impact via network-accessible exploitation without authentication or user interaction. Mozilla patched this in Firefox 150, with SSVC framework rating it automatable with partial technical impact despite CVSS 7.5 severity. No active exploitation confirmed and EPSS data not provided for risk quantification.
Use-after-free in Firefox's WebAssembly JavaScript engine enables remote denial-of-service attacks against users running unpatched versions below Firefox 150. The vulnerability allows network-based attackers to crash the browser without authentication or user interaction by triggering memory corruption in WebAssembly processing. Mozilla patched this in Firefox 150 (MFSA2026-30). EPSS data not available, not listed in CISA KEV, and SSVC framework rates exploitation as 'none' with non-automatable, partial technical impact-suggesting lower real-world risk despite CVSS 7.5 severity.
Memory corruption in Firefox 149 and Thunderbird 149 enables remote code execution when users interact with malicious web content. Mozilla patched 55 distinct memory safety bugs in Firefox 150, some demonstrating memory corruption that could be weaponized for arbitrary code execution. While no public exploit is confirmed, the CVSS score of 7.5 reflects high complexity requiring user interaction, with SSVC assessment indicating total technical impact despite no current automation or active exploitation.
Information disclosure in Mozilla Firefox NSS Library component allows remote unauthenticated attackers to extract high-value confidential data via network-accessible boundary condition errors. Affects Firefox versions prior to 150, ESR 115.x prior to 115.35, and ESR 140.x prior to 140.10. SSVC framework classifies as automatable with partial technical impact. No public exploit identified at time of analysis, though SSVC automation rating and CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector indicate straightforward exploitation potential once vulnerability details are published.
Uninitialized memory in Firefox's Canvas2D graphics component allows remote attackers to disclose sensitive information from browser memory without authentication. Affects Firefox versions prior to 150, ESR prior to 115.35, and ESR prior to 140.10. The vulnerability carries a CVSS score of 7.5 with network-based exploitation requiring low complexity and no user interaction. SSVC framework indicates no confirmed exploitation and non-automatable attack, but EPSS data not available to assess real-world exploitation probability. Mozilla has released patches across all affected product lines.
Local file disclosure via XML External Entity (XXE) injection affects the lxml Python library (versions < 6.1.0) when applications parse untrusted XML using iterparse() or ETCompatXMLParser(), whose default configuration left resolve_entities=True. An unauthenticated remote attacker who can submit crafted XML to such an endpoint can read arbitrary local files readable by the process. There is no public exploit identified at time of analysis and EPSS risk is very low (0.03%), but exploitation is trivial (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) wherever these two specific parsers are used.
Remote information disclosure in Mozilla Network Security Services (NSS) library allows unauthenticated attackers to extract high-sensitivity data via network requests with no user interaction. Affects Firefox versions prior to 150 and Firefox ESR prior to 140.10. The vulnerability stems from incorrect boundary condition handling (CWE-754) in NSS cryptographic libraries. Vendor-released patches available in Firefox 150 and Firefox ESR 140.10. SSVC framework classifies as automatable with partial technical impact, though no public exploit identified at time of analysis.
Unauthenticated information disclosure in Oracle Financial Services Transaction Filtering 8.1.2.8.0 (User Interface component) allows a remote attacker with only network/HTTP access to read all data accessible to the application. Oracle rates it CVSS 7.5 (confidentiality-only), and community tagging labels it an authentication bypass; there is no public exploit identified at time of analysis, with EPSS at a low 0.03% (9th percentile) and SSVC exploitation status 'none'.
Unauthorized data access in Oracle Database Server's Java VM component allows a remote, unauthenticated attacker to compromise the Java VM over Oracle Net (default port 1521) and read all data accessible to it, affecting versions 19.3-19.30 and 21.3-21.21. The flaw is rated CVSS 7.5 with confidentiality-only impact and is easily exploitable per Oracle, though EPSS is very low (0.03%, 9th percentile) and no public exploit identified at time of analysis. It is addressed in the Oracle Critical Patch Update of April 2026.
Unauthorized data disclosure in Oracle Financial Services Customer Screening 8.1.2.8.0 (User Interface component) allows a remote, unauthenticated attacker with only HTTP network access to read all data accessible to the application. The flaw is an authorization/access-control weakness (CWE-285) that yields high confidentiality impact without any integrity or availability effect. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.03%, 9th percentile), indicating no observed exploitation activity.
Unauthorized data access in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 lets a remote, unauthenticated attacker read critical data over HTTP with no user interaction. The flaw stems from improper access control (CWE-284) in the Platform component and is tagged as an authentication bypass, though impact is limited to confidentiality (no data modification or denial of service). No public exploit has been identified at time of analysis and EPSS exploitation probability is very low (0.03%).
Unauthenticated information disclosure in Oracle WebLogic Server (Fusion Middleware, Web Services component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows a remote attacker with only HTTP network access to read critical data, potentially gaining access to all data accessible to the server. The flaw is rated CVSS 7.5 with confidentiality-only impact and is classified under CWE-200 (Information Exposure). Publicly available exploit code exists per the CISA SSVC assessment, but the vulnerability is not on the CISA KEV list and EPSS exploitation probability is very low (0.03%).
Unauthorized information disclosure in Oracle HCM Common Architecture (Knowledge Integration component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a remote, unauthenticated attacker read critical HCM data over HTTP without any user interaction. Oracle rates this 7.5 (confidentiality-only impact) and addressed it in the April 2026 Critical Patch Update. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%), but SSVC flags the attack as automatable.
Unauthorized data disclosure in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition arises from a flaw in the JAXP (Java API for XML Processing) component, allowing an unauthenticated remote attacker to read critical or all accessible data across affected JDK 8, 11, 17, 21, 25, and 26 builds. The confidentiality-only issue (CVSS 7.5, C:H/I:N/A:N) is easily exploitable over multiple network protocols, including via web services that pass attacker-supplied data into JAXP APIs, and also affects sandboxed Java Web Start/applet deployments running untrusted code. There is no public exploit identified at time of analysis and EPSS is very low (0.03%, 9th percentile), consistent with the SSVC exploitation status of 'none'.
Unauthorized data disclosure in Oracle Financial Services Analytical Applications Infrastructure (OFSAA) 8.0.7.9, 8.0.8.7, and 8.1.2.5 allows a remote, unauthenticated attacker to reach protected data over HTTP against the Platform component. Successful exploitation yields read access to critical or all OFSAA-accessible data with no integrity or availability impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 9th percentile), consistent with CISA SSVC scoring exploitation as 'none.'
Unauthenticated remote attackers can obtain sensitive information from Firefox's IP Protection component prior to version 150 via network-accessible requests with low attack complexity. The vulnerability leaks confidential data (CVSS:C=High) without requiring user interaction or special privileges, affecting all Firefox installations below version 150. Mozilla has released a vendor-confirmed patch in Firefox 150. No active exploitation (CISA KEV) or public exploit code identified at time of analysis, though CVSS vector indicates trivial exploitation conditions (AV:N/AC:L/PR:N/UI:N).
Denial of service in Go's x/image/webp library allows remote attackers to crash 32-bit applications by sending specially crafted WEBP images with invalid large size values, triggering runtime panic. Vendor patch released (version 0.39.0) with low EPSS score (0.02%) indicating minimal observed exploitation activity. Despite network vector and no authentication requirements (CVSS AV:N/PR:N), exploitation is platform-specific to 32-bit architectures only.
A mitigation bypass in Firefox for Android allows remote attackers to achieve high-impact integrity violations without authentication or user interaction. Fixed in Firefox 150, this CWE-200 information disclosure flaw enables attackers to circumvent existing security controls via network-based vectors. Despite a CVSS base score of 7.5 (High), real-world exploitation risk appears limited: EPSS probability is only 0.02% (5th percentile), no public exploit code has been identified, and CISA SSVC framework rates it as non-exploited with partial technical impact, though automatable.
Local privilege-driven compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker who is already logged onto the host running VirtualBox to take over the VirtualBox instance, with a scope change that can significantly impact additional products beyond the hypervisor itself. The flaw is classed as improper access control (CWE-284) and tagged as an authentication bypass, yielding total confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, it is not listed in CISA KEV, and EPSS is negligible (0.01%), consistent with the high attack complexity and privilege requirements.
Privilege-based host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker with logon access to the host to take over VirtualBox, with a scope change that can significantly impact additional products beyond the hypervisor itself. Disclosed in Oracle's April 2026 Critical Patch Update with a CVSS 3.1 base score of 7.5 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none with the flaw rated not automatable.
Full compromise of Oracle VM VirtualBox 7.2.6 (Core component) is possible for a high-privileged local attacker who can log on to the host where VirtualBox runs, per Oracle's April 2026 Critical Patch Update. Because the flaw carries a scope change (S:C), a successful attack breaks out of VirtualBox and can significantly impact additional products on the host, yielding total loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with the high exploitation difficulty (AC:H) and the local, high-privilege prerequisite.
Guest-to-host compromise in Oracle VM VirtualBox 7.2.6 (Core component) allows a high-privileged local attacker to take over the VirtualBox instance, with a scope change that can significantly impact products beyond VirtualBox itself - consistent with a hypervisor escape affecting the host. Disclosed in the Oracle April 2026 Critical Patch Update with a CVSS 3.1 base score of 7.5. There is no public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.01%).
Command injection in Lawnchair's GitHub Actions workflow allows authenticated repository contributors to execute arbitrary code on GitHub-hosted CI/CD runners. The vulnerability affects Lawnchair for Android versions prior to commit fcba413f5 and stems from unsanitized workflow_dispatch inputs in release_update.yml. Authenticated attackers with repository write access can inject shell commands through workflow parameters, achieving full code execution in the build environment. A patch is available (commit fcba413f5), and the CVSS vector indicates this is a network-accessible, low-complexity attack requiring low privileges. CVSS v4.0 score of 7.4 reflects high confidentiality, integrity, and availability impact scoped to the vulnerable CI/CD system. EPSS data not provided; no CISA KEV listing at time of analysis.
Password reset tokens in blueprintUE self-hosted edition remain valid indefinitely, allowing attackers who intercept a reset link to compromise accounts at any future time. The vulnerability affects all versions prior to 4.2.0. While exploitation requires initial interception of a password reset token (AC:H), successful exploitation grants persistent unauthorized access with high confidentiality and integrity impact but no availability impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, score 7.4). No active exploitation, KEV listing, or public POC identified at time of analysis.
Remote code execution or information disclosure in Mozilla Firefox's WebRTC component allows network-based attackers to trigger memory corruption through incorrect boundary checks (CWE-119 buffer overflow class). All Firefox versions prior to 150, ESR versions prior to 115.35, and ESR versions prior to 140.10 are vulnerable. The CVSS vector indicates network-accessible exploitation with no authentication required (AV:N/PR:N), though CISA SSVC framework classifies exploitation as 'none' and automatable as 'no', suggesting limited real-world exploitation evidence at time of analysis. EPSS data not provided. Mozilla has released patches across all affected product lines.
Uninitialized memory access in Firefox's Web Codecs API enables remote attackers to disclose sensitive data, modify limited application state, and potentially trigger denial of service without authentication. The vulnerability affects Firefox versions prior to 150 and Firefox ESR versions prior to 140.10. Mozilla has released patches addressing this memory safety issue. EPSS data not available, but SSVC framework indicates non-automated exploitation with partial technical impact. No public exploit identified at time of analysis.
Server-Side Request Forgery in Glances IP plugin allows authenticated attackers to force the monitoring application to send HTTP requests to arbitrary internal or external endpoints, with automatic credential leakage when public_username and public_password are configured. The vulnerability affects all versions prior to 4.5.4 and arises from insufficient validation of the public_api configuration parameter. EPSS exploitation probability is low (0.04%, 12th percentile), but SSVC framework confirms proof-of-concept availability and automatable exploitation with partial technical impact. Vendor patch released in version 4.5.4.
SFTP authentication in GoAnywhere MFT prior to 7.10.0 allows remote unauthenticated attackers to bypass login attempt limits when targeting accounts configured with SSH key authentication, enabling brute force attacks against SSH private keys. The vulnerability affects the SFTP service specifically when Web Users are configured for SSH key-based login, exposing organizations to credential stuffing attacks. EPSS exploitation probability data not available; no evidence of active exploitation or public exploit code at time of analysis, though the attack vector is straightforward given network accessibility and low complexity (AV:N/AC:L/PR:N).
TYPO3 CMS 14.2.0 stores backend user passwords in cleartext within database fields (uc, user_settings) when passwords are changed through the user settings module. Remote attackers with database read access or exploiting SQL injection vulnerabilities can retrieve plaintext credentials for backend administrator accounts. Vendor patch available via GitHub commit 9a6e913f. No active exploitation confirmed at time of analysis, though high CVSS subsequent system impact scores (SC:H/SI:H/SA:H) indicate potential for privilege escalation if database is compromised.
Remote attackers can execute code and corrupt memory in Firefox (versions prior to 150) and Firefox ESR (prior to 140.10) by exploiting boundary condition errors in the WebRTC component. The vulnerability permits network-based exploitation without authentication or user interaction, enabling partial confidentiality, integrity, and availability impact. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability despite the high CVSS 7.3 rating. No public exploit identified at time of analysis, though the vulnerability is classified as automatable with total technical impact per SSVC framework. Mozilla has released patches in Firefox 150 and Firefox ESR 140.10.
Arbitrary file deletion in Hermes WebUI (nesquena/hermes-webui, all versions prior to the PR #409 fix) allows an authenticated attacker to delete arbitrary writable JSON files on the host by supplying an absolute path or path-traversal sequence in the session_id parameter of the /api/session/delete endpoint. Because the endpoint concatenates the unvalidated identifier onto SESSION_DIR without canonicalization, an attacker can escape the intended session directory and destroy files outside it. Publicly available exploit code exists (VulnCheck advisory and upstream regression tests demonstrate the payloads), but it is not listed in CISA KEV and EPSS is low (0.09%, 26th percentile), indicating no evidence of widespread automated exploitation.
Remote code execution in Visitor Management System 1.0 allows authenticated administrators to upload PHP webshells via two unvalidated file upload endpoints (admin_user_insert.php and update_1.php). The move_uploaded_file() function lacks MIME type, extension, and content validation, enabling direct server compromise. Public proof-of-concept exists (SSVC exploitation: POC). EPSS data not available, but the combination of network-accessible attack vector (AV:N) and total technical impact (SSVC) against a specific niche product suggests targeted exploitation risk rather than widespread automated attacks.