Cross-site request forgery (CSRF) in Dovestones AD Self Update versions before 4.0.0.5 allows unauthenticated attackers to modify authenticated user account information by crafting malicious requests that exploit missing CSRF token validation. The vulnerability affects state-changing endpoints that accept both POST and GET requests without proper anti-CSRF protections, enabling account takeover when a victim visits a malicious page while logged in. Publicly available exploit code exists.
Reflected cross-site scripting (XSS) in Dovestones ADPhonebook versions below 4.0.1.1 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via the search parameter of the /ADPhonebook?Department=HR endpoint. User input is reflected without proper encoding. Publicly available exploit code exists, though CISA KEV status is not confirmed, and CVSS 6.1 with UI:R indicates user interaction is required for successful exploitation.
Reflected cross-site scripting in Bludit CMS search plugin allows unauthenticated attackers to inject arbitrary JavaScript through malicious search queries. When users visit attacker-crafted URLs containing the XSS payload, malicious scripts execute in their browsers, enabling session cookie theft and actions performed on behalf of victims. Publicly available exploit code exists; patch available via commit 6732dde.
Forced Bluetooth pairing in Zero Motorcycles firmware versions 44 and prior enables an adjacent attacker to bypass device authentication and inject malicious over-the-air firmware updates onto affected motorcycles. Rooted in CWE-322 (Key Exchange without Entity Authentication), the flaw allows an unauthorized device to complete the pairing process without any credential verification, after which the attacker can abuse the legitimate OTA update channel to replace vehicle firmware with attacker-controlled code. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis, though the ICS-CERT advisory and physical-safety implications elevate the operational significance beyond the moderate CVSS 4.0 score of 5.9.
Custom authentication header leakage in follow-redirects before 1.16.0 exposes API keys and session tokens whenever an HTTP request follows a cross-domain redirect. The header-stripping regex at index.js:469-476 only covers `authorization`, `proxy-authorization`, and `cookie`, leaving headers such as `X-API-Key`, `X-Auth-Token`, and `Token` forwarded verbatim to the redirect destination. Because follow-redirects is the redirect-handling dependency for axios (105K+ GitHub stars), this flaw has broad reach across the Node.js ecosystem; no public exploit code has been identified at time of analysis, though a fully detailed GHSA advisory with a working attack scenario is publicly available.
RansomLook versions prior to 1.9.0 disclose non-public location information through an improper list-filtering logic error in the API layer. The vulnerability stems from removing elements from a list during iteration in website/web/api/genericapi.py, causing entries marked as private to persist in API responses. Unauthenticated remote attackers can retrieve sensitive location data that should remain hidden, with CVSS 6.9 indicating low confidentiality impact across the network.
Fail-open request handling in free5GC UDR's POST /nudr-dr/v2/policy-data/subs-to-notify endpoint allows Policy Data notification subscriptions to be created with invalid, empty, or partially processed input after HTTP body read or deserialization failures. The handler fails to return after sending error responses (HTTP 500 for body read failure, HTTP 400 for deserialization failure), causing execution to continue and invoke the subscription processor with an uninitialized or malformed PolicyDataSubscription object. This is a logic flaw rather than memory corruption or remote code execution, but it violates fail-secure design principles for a write-capable API and may result in inconsistent subscription state or unintended database entries depending on downstream validation behavior.
OpenClaw before version 2026.3.31 allows unauthenticated remote attackers to trigger resource-intensive audio transcription processing via Telegram without proper authorization, enabling denial-of-service through billing or infrastructure exhaustion. The vulnerability stems from insufficient allowlist enforcement that permits unauthorized group senders to initiate preflight transcription operations before authentication is validated, and no public exploit code has been identified at the time of analysis.
OpenClaw before version 2026.3.31 fails to properly invalidate attacker-discovered endpoints during trust decline operations in remote onboarding workflows, allowing attackers to route gateway credentials to malicious endpoints by preserving their URLs through the trust decline process into manual operator acceptance prompts. The vulnerability requires user interaction (UI:A) but affects gateway credential confidentiality (VC:H), posing a significant risk to organizations using OpenClaw's remote onboarding feature with CVSS 6.9 (medium-high severity).
Incomplete PEM parsing in Oxia's TLS subsystem silently drops all but the first certificate from CA bundle files, breaking mutual TLS chain validation in all Oxia deployments prior to 0.16.2 that use the `trustedCaFile` option with a multi-certificate bundle. Legitimate clients presenting certificates signed by an intermediate CA are rejected with `x509: certificate signed by unknown authority`, creating operator pressure to disable client certificate verification entirely - degrading the mTLS security posture rather than enabling direct exploitation. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.02% (6th percentile), but the indirect risk of operators weakening authentication to restore connectivity is the primary concern.
OpenClaw 2026.3.22 through 2026.3.30 contain a signature verification bypass in the Nostr direct message (DM) ingress handler that processes pairing challenges before validating event signatures. Remote unauthenticated attackers can send forged DMs to create bogus pending pairing entries, exhaust shared pairing capacity, and trigger unbounded relay and logging work on the Nostr channel, causing denial of service. No public exploit code or active exploitation has been confirmed; a vendor patch is available in version 2026.3.31 and later.
Privilege escalation in KDE Kleopatra before 26.08.0 on Windows allows any local user to assume the operating system privileges of a currently-running Kleopatra process by exploiting a control-flow defect in the KUniqueService single-instance enforcement mechanism. The CVSS 6.9 rating reflects high confidentiality and integrity impact - access to private cryptographic keys and certificates is plausible - but is substantially offset by the local-only attack vector and high complexity (AC:H). No public exploit code has been identified and SSVC confirms exploitation is currently none, with an EPSS of 0.01% placing this in the bottom 2% of CVEs by exploitation likelihood; a vendor patch at 26.08.0 is available via the April 2026 KDE security advisory.
Improper access control in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) Platform component allows a low-privileged remote attacker to bypass authorization controls and gain unauthorized read and write access to all financial data managed by the platform. Versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 are confirmed affected. No public exploit code has been identified at time of analysis, and EPSS at 0.03% (9th percentile) signals very low observed exploitation probability, though the SSVC technical impact is rated 'total' given the full confidentiality and integrity exposure.
Indefinite OIDC session persistence in the Data Sharing Framework (DSF) FHIR and BPE servers prior to 2.1.0 allows any person with physical access to an authenticated browser session to access DSF resources under the original user's permissions, even after the OIDC access token has expired. The root cause is the absence of a maximum inactivity timeout in the Jetty-based session handler for OIDC browser sessions. No public exploit code exists and no active exploitation has been identified; EPSS stands at 0.02% (4th percentile), consistent with the physical access requirement.
Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 contain an improper access control flaw (CWE-284) in the User Interface component that permits a locally authenticated low-privileged attacker - contingent on inducing a second user to interact - to bypass access controls and obtain complete read access to all OFSAAI-accessible financial data, perform limited data modification, and trigger a full denial-of-service by crashing or hanging the platform. Disclosed in Oracle's April 2026 Critical Patch Update, this vulnerability carries no public exploit code and no active exploitation per CISA KEV, SSVC, or EPSS (0.01%, 2nd percentile), situating it as a medium-priority insider threat relevant to financial institutions running these specific versions.
October CMS versions prior to 3.7.14 and 4.1.10 allow backend developers with Developer permissions to bypass Twig sandbox restrictions and execute unauthorized database write operations (insert, update, delete) via the query builder when cms.safe_mode is enabled. This privilege escalation vulnerability enables data manipulation on any database table despite sandbox security policies intended to restrict template functionality.
Improper access control in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools 8.61-8.62 allows a high-privileged network attacker to perform unauthorized data reads, writes, and partial denial-of-service with scope change affecting adjacent PeopleSoft products. Despite a network-accessible attack vector and no user interaction required, exploitation is gated by the requirement for high-privilege credentials, and SSVC signals (exploitation: none, automatable: no) confirm no active exploitation at time of analysis. Oracle disclosed this through its April 2026 Critical Patch Update; no public exploit code has been identified.
Path traversal fix bypass in WWBN AVideo 29.0 and below allows authenticated uploaders to read arbitrary files from the server and exfiltrate them through a public GIF media URL. The partial fix in commit 2375eb5e0 validated only the URL path component via PHP's `parse_url()`, but the downstream `try_get_contents_from_local()` function in `objects/functionsFile.php` parses the full URL string - including query parameters - using `explode('/videos/', $url)`, enabling traversal payloads embedded in the query string to bypass the check entirely. A detailed proof-of-concept is publicly available in the GHSA-f4f9-627c-jh33 advisory; no CISA KEV listing exists, and EPSS at 0.20% reflects low automated exploitation probability consistent with the required authentication barrier.
Information disclosure in Firefox's IndexedDB storage component allows remote unauthenticated attackers to leak sensitive data through a network-accessible vulnerability with no user interaction required. Affected versions include Firefox prior to 150 and Firefox ESR prior to 140.10. The vulnerability has a CVSS score of 6.5 reflecting moderate severity with confidentiality impact and limited availability risk.
Incorrect boundary conditions in Firefox's DOM Device Interfaces component allow remote attackers to cause limited data corruption and browser instability without authentication or user interaction, per CVSS vector AV:N/AC:L/PR:N/UI:N. Vendor-released patches are confirmed in Firefox 150 and Firefox ESR 140.10, with downstream Red Hat and SUSE advisories also issued. No public exploit has been identified at time of analysis, and EPSS at 0.04% (13th percentile) alongside SSVC exploitation status of 'none' indicate low real-world exploitation likelihood despite the moderate CVSS score.
Authentication bypass in frp (fast reverse proxy) versions 0.43.0 through 0.68.0 allows network-accessible attackers to reach backends protected by httpUser/httpPassword access controls without valid credentials, when the routeByHTTPUser routing feature is in use. The flaw stems from a credential-source mismatch in pkg/util/vhost/http.go: route selection reads the username from the Proxy-Authorization header, while the access control check validates against the separate Authorization header, enabling an attacker who knows the routeByHTTPUser username to bypass authentication entirely. A proof-of-concept has been confirmed by the reporter against official release binaries; no active exploitation is recorded in CISA KEV.
User-controlled HTTP headers in Fortra GoAnywhere MFT prior to version 7.10.0 enable remote unauthenticated attackers to trigger arbitrary DNS lookups and execute DNS rebinding attacks, leading to information disclosure and potential service degradation. The vulnerability exploits improper handling of attacker-supplied header values in network requests, allowing reconnaissance of internal infrastructure and circumvention of network segmentation controls.
Unbounded memory allocation in Tekton Pipelines' HTTP resolver allows any authenticated tenant to crash the shared resolver pod for an entire Kubernetes cluster. The `FetchHttpResource` function reads HTTP response bodies without a byte-level size cap, so a low-privileged user who can create TaskRuns or PipelineRuns can direct the resolver at an attacker-controlled server delivering multi-gigabyte responses, exhausting the pod's 4 GiB memory limit and triggering an OOM-kill. Because all resolver types - Git, Hub, Bundle, Cluster, and HTTP - share the same `tekton-pipelines-resolvers` pod, repeated exploitation causes a sustained crash loop that denies CI/CD pipeline resolution to every tenant on the cluster. A PoC is included in the GHSA advisory and SSVC confirms exploit code exists; however, no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.
Denial-of-service in Oracle MySQL Server's JSON component allows authenticated low-privileged network users to hang or repeatedly crash the database server across all three supported release branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The flaw is classified as CWE-400 (Uncontrolled Resource Consumption), meaning specially crafted JSON-related queries exhaust server resources without adequate bounds checking. No public exploit code or active exploitation has been identified; EPSS of 0.04% at the 12th percentile and SSVC 'Exploitation: none' together confirm this is not under active threat at time of analysis.
Denial of service in Oracle MySQL Server's Optimizer component allows a low-privileged authenticated attacker with network access to crash or hang the database server across three major version branches (8.0.0-8.0.45, 8.4.0-8.4.8, 9.0.0-9.6.0). The attack is network-reachable over multiple protocols but requires valid database credentials, limiting the exposed surface to authenticated users. No public exploit code exists and EPSS probability sits at 0.04% (12th percentile), making this a meaningful patch-cycle priority rather than an emergency response item, though availability impact for business-critical databases warrants timely remediation.
Uncontrolled resource consumption in the Group Replication Plugin of Oracle MySQL Server (versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0) allows a low-privileged network attacker to hang or repeatedly crash the database server, resulting in complete denial of service. Oracle patched this issue in the April 2026 Critical Patch Update; no active exploitation has been confirmed (absent from CISA KEV), and EPSS of 0.04% (12th percentile) reflects very low current exploitation probability. Downstream distribution advisories from Red Hat and SUSE indicate broad ecosystem acknowledgement of the issue.
MySQL Server's Optimizer component in versions 9.0.0 through 9.6.0 is susceptible to uncontrolled resource consumption triggered by a low-privileged authenticated attacker over the network, resulting in a complete denial of service via hang or repeated crash. The attack surface spans multiple protocols and requires no user interaction beyond valid database credentials. No public exploit code has been identified and exploitation probability is minimal (EPSS 0.04%, SSVC exploitation: none), but the low complexity and broad version range make it relevant for any organization running MySQL 9.x in multi-tenant or externally reachable deployments.
Uncontrolled resource consumption in Oracle MySQL Server's Group Replication Plugin allows a low-privileged authenticated network attacker to cause a complete denial of service - server hang or repeatable crash - across three major release lines (8.0.x, 8.4.x, and 9.x). The vulnerability carries a CVSS 3.1 score of 6.5 with network attack vector and low attack complexity, though real-world exploitation pressure is minimal: EPSS sits at 0.04% (12th percentile), SSVC marks exploitation status as none and the attack as non-automatable, and no public exploit code has been identified at time of analysis. Oracle has released a patch via the April 2026 Critical Patch Update.
Uncontrolled resource consumption in the MySQL Server Group Replication Plugin enables low-privileged, network-accessible attackers to cause a complete denial of service - forcing MySQL Server into a hang or repeatedly reproducible crash across versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. Oracle has released a patch via its April 2026 Critical Patch Update, and no active exploitation has been identified at time of analysis. EPSS stands at 0.04% (12th percentile) and SSVC classifies exploitation as 'none' and the attack as non-automatable, indicating low real-world exploitation probability despite a medium CVSS score.
MySQL Server's Optimizer component allows a low-privileged, network-connected attacker to repeatedly crash or hang the database server across three active release trains. Affected versions span 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0, representing a wide swath of currently deployed MySQL installations. Oracle confirmed a patch in the April 2026 Critical Patch Update; no public exploit code exists and EPSS remains at 0.04% with SSVC exploitation status of none, though the breadth of affected versions and low attack complexity make patching a meaningful operational priority for any network-accessible deployment.
MySQL Server's Optimizer component allows any low-privileged authenticated user with network access to trigger a complete denial of service via an uncontrolled resource consumption flaw. Affected across three active release lines - 8.0.x through 8.0.45, 8.4.x through 8.4.8, and 9.0.x through 9.6.0 - this vulnerability is broadly deployed given MySQL's ubiquity, but real-world exploitation risk is low: EPSS sits at 0.04% (12th percentile), SSVC marks exploitation as 'none' and the attack as non-automatable, and no public exploit code exists at time of analysis. Oracle released a patch in the April 2026 Critical Patch Update.
Mitigation bypass in Mozilla Firefox's File Handling component allows remote network-reachable attackers to circumvent a security protection mechanism (CWE-693), resulting in partial confidentiality and integrity compromise. All Firefox stable versions prior to 150 and Firefox ESR versions prior to 140.10 are affected across platforms, with downstream impact confirmed for Red Hat Enterprise Linux and SUSE Linux packaging. No active exploitation has been confirmed - CISA KEV listing is absent, EPSS sits at 0.04% (12th percentile), and SSVC classifies exploitation status as none - making this a medium-priority patching item rather than an emergency response trigger.
Jupyter nbconvert 6.5 through 7.17.0 allows unauthenticated remote attackers to read arbitrary files from the conversion host when HTMLExporter.embed_images is enabled, by embedding malicious image references with path traversal sequences in a crafted notebook. A malicious actor can exfiltrate sensitive files as base64-encoded data URIs in the output HTML, achieving confidentiality breach with no integrity or availability impact. Vendor-released patch: version 7.17.1.
SQL injection in Frappe HR (HRMS) exposes sensitive human resources data to authenticated remote attackers via a specially crafted request to an undisclosed endpoint. Affected installations running versions prior to 15.54.0 (v15 branch) or 14.38.1 (v14 branch) are vulnerable to unauthorized data extraction through unsanitized query parameters. No public exploit code has been identified and CISA KEV does not list this CVE; EPSS at 0.03% (10th percentile) and SSVC exploitation status of 'none' collectively indicate low current threat actor interest, though the C:H CVSS impact reflects meaningful data exposure risk for organizations handling employee records.
Unauthorized data exposure in Oracle Financial Services Analytical Applications Infrastructure (OFSAAI) versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 allows a low-privileged, network-authenticated attacker to read critical or complete data accessible within the platform via HTTP. The Platform component contains a CWE-200 information disclosure flaw that, per Oracle's April 2026 CPU, is classified as 'easily exploitable' under authenticated low-privilege conditions. No public exploit code has been identified and CISA has not listed this in KEV; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Unauthorized full data disclosure in PeopleSoft Enterprise FIN Project Costing 9.2 allows a low-privileged authenticated attacker to read all data accessible to the Projects component via a network-reachable HTTP endpoint. The root cause is improper access control (CWE-284), tagged by Oracle as an authentication bypass - most likely an authorization boundary failure that permits privilege escalation within the application rather than a bypass of the initial login gate, consistent with a PR:L CVSS vector. No public exploit code has been identified and EPSS is 0.03% (9th percentile), indicating negligible automated exploitation activity at this time.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2 allows an authenticated low-privileged attacker with HTTP network access to read all data accessible within the Work Order Management component, including potentially sensitive financial maintenance records. The flaw is rooted in improper access control (CWE-284) and is tagged as an authentication bypass, suggesting a low-privileged session can circumvent authorization checks to access data scoped to higher-privilege roles. No active exploitation is confirmed (absent from CISA KEV), and EPSS of 0.03% at the 9th percentile indicates very low real-world exploitation probability; remediation is addressed in Oracle's April 2026 Critical Patch Update.
Unauthorized financial contract data disclosure in Oracle PeopleSoft Enterprise FIN Contracts 9.2 allows low-privileged authenticated users to access all contract records via HTTP without integrity or availability impact. The CWE-200 classification and 'Authentication Bypass' tag together suggest the flaw is an intra-session authorization control bypass - not a login bypass - permitting users to read contract data beyond their assigned permissions. No public exploit exists and EPSS sits at 0.03% (9th percentile), consistent with SSVC's 'Exploitation: none' assessment, though the high confidentiality impact to sensitive financial data warrants prompt patching for affected enterprises.
Unauthorized read access to sensitive financial data is possible in Oracle PeopleSoft Enterprise FIN Maintenance Management 9.2 through an improper access control flaw (CWE-284) in the Work Order Management component. An authenticated low-privileged attacker with network access over HTTP can exploit this to gain complete access to all data within the PeopleSoft FIN Maintenance Management system. No public exploit exists and SSVC classifies exploitation as 'none,' with EPSS at 0.03% (9th percentile), indicating negligible opportunistic exploitation risk despite Oracle's own classification of the vulnerability as 'easily exploitable.'
PeopleSoft Enterprise SCM Purchasing 9.2 exposes critical procurement data to low-privileged authenticated attackers over HTTP, enabling complete unauthorized read access to all data within the Purchasing module. The flaw is rooted in improper access control (CWE-284), allowing a low-privileged PeopleSoft account holder to bypass post-authentication authorization restrictions and retrieve sensitive purchasing records they should not have access to. No public exploit code exists and EPSS sits at a very low 0.03%, but Oracle's April 2026 Critical Patch Update addresses the vulnerability and should be applied to any internet-facing or multi-tenant PeopleSoft deployment.
Arbitrary file write in Jupyter nbconvert 6.5 through 7.17.0 allows unauthenticated attackers to write files to arbitrary filesystem locations outside the intended output directory by crafting malicious cell attachment filenames in notebooks. The ExtractAttachmentsPreprocessor fails to sanitize attachment filenames, enabling path traversal that provides full control over destination paths and file extensions. Requires user interaction (opening a malicious notebook) and is patched in version 7.17.1.
Improper authorization in Oracle WebLogic Server's Web Services component allows unauthenticated remote attackers to perform unauthorized creation, deletion, or modification of critical data - but only when a victim user interacts with attacker-controlled content. Affecting four actively supported versions (12.2.1.4.0 through 15.1.1.0.0), this flaw carries a CVSS 6.5 Medium rating reflecting the mandatory human-interaction prerequisite that prevents fully automated exploitation. No public exploit code exists and CISA has not listed this in the Known Exploited Vulnerabilities catalog; SSVC assessment confirms exploitation status as none at time of analysis.
Unauthorized employee data disclosure in Frappe HRMS allows any authenticated user holding only a default role to retrieve private employee fields via an insufficiently access-controlled API endpoint in the Roster shift assignment module. Affected versions span the v15 branch prior to 15.58.1 and the v16 branch prior to 16.4.1. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile), and CISA SSVC rates exploitation as none with partial technical impact.
Tekton Pipelines 0.43.0 through 1.11.0 allows authenticated attackers to bypass trusted resource verification policies via unanchored regular expression patterns that match substrings rather than exact resource sources, enabling policy manipulation and unauthorized verification mode changes. The vulnerability stems from Go's regexp.MatchString function matching patterns anywhere within a string rather than requiring full anchoring, permitting attackers to craft source URIs containing trusted patterns as substrings to trigger unintended policy matches and potentially apply weaker verification keys or modes.
Unauthenticated network exploitation of the Oracle Life Sciences InForm App Server (versions 7.0.1.0 and 7.0.1.1) allows remote attackers to read a subset of clinical trial application data and perform unauthorized insert, update, or delete operations via HTTP - with no credentials or user interaction required. Rooted in CWE-284 (Improper Access Control) and tagged as an Authentication Bypass, the App Server fails to enforce access controls on certain endpoints, confirmed by Oracle in the April 2026 Critical Patch Update. No public exploit code or active exploitation has been identified; EPSS sits at 0.03% (8th percentile), though SSVC flags the attack as automatable.
PeopleSoft Enterprise HCM Human Resources 9.2 exposes critical HR data to unauthorized access and modification through a missing authentication control (CWE-306) in the Job Profile Manager component. High-privileged authenticated attackers with network HTTP access can read or modify all data accessible within the HCM module, including sensitive employee records and job profile configurations. No active exploitation is confirmed (CISA KEV absent, EPSS 0.03%), but the SSVC technical impact is rated 'total', indicating full data compromise potential upon successful exploitation.
PeopleSoft Enterprise HCM Absence Management version 9.2 exposes a missing-authentication function (CWE-306) in its Absence Management component, accessible over HTTP by network-reachable, high-privileged attackers. Successful exploitation grants unauthorized read and write access to critical HR absence data - including creation, deletion, or modification of all data accessible within the component. No active exploitation has been confirmed (not in CISA KEV), EPSS is 0.03% (8th percentile), and no public proof-of-concept code has been identified, positioning this as a targeted risk rather than an opportunistic threat.
Insecure Direct Object Reference in AVideo's live restream list endpoint exposes any victim user's RTMP stream keys and OAuth tokens - including access_token and refresh_token for YouTube Live, Facebook Live, and Twitch - to any peer with a streaming-permission account on the same instance. The flaw exists in versions 29.0 and prior, where the authorization guard in list.json.php is trivially bypassed by supplying an explicit users_id GET parameter, routing directly to an attacker-controlled database query. Publicly available exploit code exists per SSVC; EPSS is 0.03% (8th percentile), indicating limited opportunistic exploitation at this time, and the vulnerability is not listed in CISA KEV.
Unauthorized file access in Frappe HRMS allows any authenticated user to retrieve files attached to documents they are not permitted to view by calling the attachment API endpoint without proper authorization enforcement. Affected versions span both the v15 branch (prior to 15.58.2) and v16 branch (prior to 16.4.2); patched releases are available from the vendor. No public exploit exists and EPSS is 0.03% (8th percentile), though the confidentiality impact is significant given that HR systems routinely store payroll records, employment contracts, and personal employee data.
SQL injection in the CMS für Motorrad Werkstätten WordPress plugin (versions up to 1.0.0) allows authenticated attackers with subscriber-level privileges to extract sensitive database information via an unsanitized 'arttype' parameter. The vulnerability requires valid WordPress user credentials but no special configuration, making it exploitable against any WordPress installation running the affected plugin. No public exploit code or active exploitation has been identified at the time of analysis.