SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to extract, modify, or delete database contents via the ID parameter in /ajax.php?action=save_sales endpoint. Publicly available exploit code exists (GitHub POC), enabling low-complexity attacks with no authentication barriers. EPSS data not available, but public exploit significantly lowers attacker skill threshold. CVSS 7.3 reflects network-exploitable vulnerability with moderate confidentiality, integrity, and availability impacts.
SQL injection in itsourcecode Courier Management System 1.0 via the ID parameter in /edit_parcel.php allows remote unauthenticated attackers to query, modify, or delete database contents. The CVSS 6.9 score reflects low confidentiality and integrity impact; however, the vulnerability is remotely exploitable with no authentication required and publicly available exploit code exists, making it a practical attack vector against exposed instances.
SQL injection in itsourcecode Courier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via manipulation of the ID parameter in /edit_branch.php. The vulnerability has publicly disclosed exploit code available and affects confidentiality, integrity, and availability of the underlying database.
SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate the address parameter in /locations.php, enabling arbitrary database queries with confidentiality and integrity impact. Publicly available exploit code exists, increasing real-world risk despite the moderate CVSS score of 6.9.
SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate the code parameter in /execute1.php, enabling database query manipulation and potential data exfiltration or modification. Publicly available exploit code exists, increasing real-world risk despite the moderate CVSS score of 6.9.
SQL injection in itsourcecode Construction Management System 1.0 via the code parameter in /execute.php allows remote unauthenticated attackers to execute arbitrary SQL queries and potentially access or modify database contents. The vulnerability has a publicly available exploit and is confirmed to have a low confidentiality, integrity, and availability impact according to CVSS v4.0 scoring.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in the Login component, leading to unauthorized database access and potential data exfiltration. The vulnerability has a publicly available exploit and CVSS 6.9 score reflecting low confidentiality, integrity, and availability impact without scope expansion. EPSS data unavailable, but public exploit availability elevates practical risk.
Remote SQL injection in CodePanda Source canteen_management_system 1.0 allows unauthenticated attackers to manipulate the Username parameter in /api/login.php, enabling arbitrary database queries. Public exploit code is available. The vulnerability affects confidentiality and integrity with low impact scope, making it a practical attack vector for credential harvesting or data exfiltration from the canteen management database.
Message header injection in Apache Camel's camel-mail component (3.0.0 before 4.14.6 and 4.15.0 before 4.18.1) lets an attacker who can email a monitored mailbox smuggle Camel-prefixed MIME headers into the Exchange. Because MailHeaderFilterStrategy filters only the outbound direction and never sets an inbound filter, inbound Camel headers reach downstream components such as camel-bean, camel-exec, or camel-sql where they can alter route behavior, potentially reaching command or query execution. There is no public exploit identified at time of analysis and EPSS is very low (0.02%), but the vendor rates it CVSS 9.4 and SSVC marks it automatable.
NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the category parameter. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated SQL injection in Directorist Booking WordPress plugin allows remote attackers to extract sensitive database contents and cause limited denial of service. The vulnerability affects all versions prior to 3.0.2 and can be exploited remotely with low complexity and no authentication (CVSS:3.1 AV:N/AC:L/PR:N/UI:N). Patchstack has published details confirming the vulnerability exists in version 2.4.1 and earlier, with a vendor-released patch available in version 3.0.2. No CISA KEV listing or public exploit code identified at time of analysis.
Authorization bypass in Milesight AIOT network cameras stems from weak cryptographic key generation in specific firmware builds, letting an adjacent attacker defeat authentication controls and gain unauthorized access to camera functions. The affected line spans a broad catalog of Milesight IP camera and NVR models (MS-Cxx and MS-Nxxxx series). No public exploit identified at time of analysis; EPSS is negligible at 0.01% and CISA SSVC records no observed exploitation, so this is a disclosed-but-not-yet-exploited ICS/IoT issue.
Stored cross-site scripting in ProjeQtor 7.0 through 12.4.3 allows authenticated attackers to upload HTML or HTM files via the image upload or attachment endpoints, bypassing the defective checkValidFileName() filter, and achieve arbitrary JavaScript execution in any victim's browser who subsequently accesses the uploaded file URL. The vulnerability affects a wide version range spanning five major releases. A publicly available proof-of-concept exists, though SSVC assessment and EPSS of 0.03% (9th percentile) indicate no confirmed real-world exploitation at time of analysis. No actively exploited status per CISA KEV.
Stored cross-site scripting in ProjeQtor 7.0 through 12.4.3 enables authenticated users to inject persistent malicious HTML payloads that execute in the browsers of other users viewing the affected content. The root cause is an incomplete pattern-based allowlist in the `checkValidHtmlText()` function within `Security.php`, which detects only specific dangerous constructs and returns unsanitized input without output encoding, allowing bypass via alternative syntax such as `<img>` tags with event handlers. No active exploitation has been confirmed in CISA KEV; however, a public proof-of-concept is available per VulnCheck, and EPSS at 0.03% (9th percentile) indicates low current automated exploitation activity.
Spring Boot's RabbitMQ auto-configuration omits TLS hostname verification when an SSL bundle is configured, enabling a man-in-the-middle attack on the message broker connection. Affected are Spring Boot 4.0.0-4.0.5 and 3.5.0-3.5.13; fixed in 4.0.6 and 3.5.14 respectively per the vendor advisory at spring.io. No active exploitation has been confirmed - CISA KEV status is absent, EPSS is 0.01% (3rd percentile), and SSVC classifies exploitation as none - making this a medium-priority patch for deployments that use SSL bundles with RabbitMQ.
OS command injection in TOTOLINK A8000RU router firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary operating-system commands via the CsteSystem function in /cgi-bin/cstecgi.cgi. Attacker-controlled input passed through the CGI Handler's HTTP argument is concatenated into a system command without sanitization. Publicly available exploit code exists (SSVC exploitation status: poc); there is no public exploit identified as being used in active attacks, and EPSS is modest at 0.89% (76th percentile).
OS command injection in Totolink A8000RU firmware 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'enable' parameter in the setUPnPCfg function of /cgi-bin/cstecgi.cgi. Publicly available exploit code exists (POC confirmed), increasing immediate risk for exposed devices. EPSS data not available, but CVSS 8.9 with network vector (AV:N), no authentication (PR:N), and low complexity (AC:L) indicates trivial remote exploitation against default configurations.
OS command injection in Totolink A8000RU 7.1cu.643_b20200521 allows remote unauthenticated attackers to execute arbitrary system commands via the 'wizard' parameter in the setWizardCfg function of /cgi-bin/cstecgi.cgi. Public exploit code exists (CVSS E:P), significantly lowering the barrier to exploitation. EPSS data not available, but the combination of network attack vector (AV:N), no authentication (PR:N), low complexity (AC:L), and published POC indicates elevated real-world risk for internet-exposed devices.
Unsafe Java deserialization in Apache Camel's camel-consul component (ConsulRegistry / ConsulRegistryUtils.deserialize) lets an attacker who can write to the backing Consul KV store achieve arbitrary code execution inside the Camel process. Any deployment using a Consul-backed Camel registry on versions 3.0.0 up to 4.14.6 or 4.15.0 up to 4.18.1 is affected. There is no public exploit identified at time of analysis, EPSS is low (0.08%), and this is a missed instance of the same deserialization class fixed in CVE-2024-22369, CVE-2024-23114 and CVE-2026-25747.
Privilege escalation in the LatePoint booking plugin for WordPress (versions ≤ 5.4.1) lets an authenticated user holding the built-in latepoint_agent role hijack any WordPress administrator account. The connect-customer-to-wp-user ability's execute() method performs no check that the target WP user ID is a privileged account, so an agent can bind a controlled LatePoint customer record to an admin's account and then trigger the standard customer password-reset flow to seize it. CVSS is 8.8; EPSS is very low (0.05%, 15th percentile) and there is no public exploit identified at time of analysis, but the technical impact is total site takeover.
Authenticated attackers with Subscriber-level privileges can escalate to Administrator role in Highland Software Custom Role Manager for WordPress via profile update exploitation. The hscrm_save_user_roles() function lacks capability checks on the personal_options_update hook, allowing low-privilege users to modify arbitrary user roles including their own. Version 1.0.1 released with authorization fixes. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. EPSS data not provided, no CISA KEV listing identified, indicating limited widespread exploitation despite the severity of self-service privilege escalation to site administrator.
Cross-site request forgery in diskover-community (diskover) version 2.3.5 and earlier lets a remote attacker forge state-changing requests to public/settings_process.php, escalating privileges and exposing sensitive configuration data when an authenticated user is lured into triggering the request. The flaw carries a CVSS 8.8 rating and total technical impact per CISA SSVC, though publicly available exploit code exists rather than confirmed active exploitation, and the EPSS probability is very low (0.02%).
Local privilege escalation in the Fan Control (FanControl) desktop application V251 for Windows allows a low-privileged local user to gain administrator-level execution by abusing the application's Open File Dialog, which processes user-supplied paths under the app's elevated security context (CWE-269). Because Fan Control requires elevated permissions to access hardware sensors and fan controllers, an attacker who can interact with the running elevated instance can pivot from limited user rights to full SYSTEM/administrator control. There is no public exploit identified in the structured input, though a referenced GitHub gist likely contains a technical write-up; EPSS is very low (0.01%) and CISA SSVC lists exploitation status as none, indicating no observed in-the-wild activity.
Command injection in LogonTracer versions prior to 2.0.0 allows authenticated users to execute arbitrary OS commands on the server. LogonTracer, a JPCERT/CC-developed log analysis tool for investigating lateral movement in Windows Active Directory environments, contains an insufficiently sanitized input handler that permits shell command injection. Authentication is required (PR:L), but once logged in, attackers can achieve complete system compromise with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). No active exploitation confirmed at time of analysis, though the CVSS 4.0 score of 8.7 and low attack complexity (AC:L) indicate significant risk for organizations running vulnerable versions.
Buffer overflow in Moxa Secure Router's HTTPS management interface allows unauthenticated remote attackers to crash the web service via specially crafted requests with malformed length parameters. Exploitation causes denial-of-service requiring device reboot, with no confidentiality or integrity impact. CVSS 8.7 reflects high availability impact to the vulnerable component only. No public exploit code identified at time of analysis, and no evidence of active exploitation (not in CISA KEV).
Atom table exhaustion in plug_cowboy 2.0.0-2.8.0 allows remote denial of service via HTTP/2. Unauthenticated attackers can crash the Erlang VM by sending HTTP/2 requests with unique :scheme pseudo-header values, permanently filling the non-garbage-collected atom table until the system_limit is reached. Affects only HTTP/2 connections; HTTP/1.1 is not vulnerable. CVSS 8.7 (High) with network attack vector, low complexity, and no required privileges. No active exploitation confirmed (not in CISA KEV), but exploit is trivial given the publicly documented attack mechanism in the GitHub advisory.
Arbitrary code execution in AWS QnABot on AWS (versions 7.2.4 and earlier) allows an authenticated administrator to break out of the intended expression sandbox by abusing the static-eval npm package. By injecting a crafted conditional chaining expression through the Content Designer interface, an admin escapes the sandbox via JavaScript prototype manipulation and runs code inside the fulfillment Lambda, reaching backend resources not normally exposed. No public exploit has been identified at time of analysis, and EPSS is very low (0.07%), consistent with the SSVC assessment that no exploitation has been observed.
Authentication bypass in Apache Camel's camel-platform-http-main component (versions 4.14.1–4.14.5 and 4.18.0–4.18.1) allows remote unauthenticated attackers to reach protected business routes and management endpoints when a non-root context path is configured. Because the Vert.x sub-router registers the auth handler at the exact context path rather than its subpaths, requests to paths like /api/route or /admin/observe/info evade the credential challenge, exposing runtime metadata (user, working directory, PID, JVM and OS details) via /observe/info. No public exploit identified at time of analysis; EPSS is low (0.04%) and CISA SSVC records no known exploitation, though the flaw is assessed as automatable.
Sharing-token forgery in SmarterTools SmarterMail builds before 9610 lets remote unauthenticated attackers decrypt and access arbitrary emails, attachments, and file-storage contents. The file/email sharing endpoints protect tokens with DES-CBC keys and IVs derived from System.Random seeded with only ~19,000 possible values, and the attachment download endpoint leaks enough information to act as an oracle for recovering the seed. No public exploit is identified at time of analysis, and EPSS is low (0.03%), consistent with the high-complexity, non-automatable oracle attack it requires.
Arbitrary code execution in Apache Camel's PQC component (camel-pqc) arises because FileBasedKeyLifecycleManager deserializes `<keyId>.key` files with java.io.ObjectInputStream and no ObjectInputFilter or class allow-listing. Because the KeyPair cast happens only after readObject() returns, malicious gadget-chain side effects execute before any type check, letting an attacker who can plant a crafted serialized object in the key directory run code as the application. It affects Camel 4.19.0 before 4.20.0 and 4.18.0 before 4.18.2, carries CVSS 7.8, and has no public exploit identified at time of analysis; EPSS is very low at 0.07%.
Double-free memory corruption in the Linux kernel's KASAN shadow-teardown path (mm/kasan) affects kernels built with KASAN on architectures where page-table pages are not struct-page aligned - notably PowerPC with 64K page size, where the PUD table is allocated from the pgtable-2^9 slab cache. When device-managed memory is unmapped (e.g. unbinding a PMEM/nvdimm device via ndctl), kasan_remove_zero_shadow() frees the same slab object twice, corrupting the slab allocator. This is a local, KASAN-build-only defect with no public exploit identified at time of analysis; EPSS is negligible (0.02%) and it is not in CISA KEV.
Memory corruption in Foxit PDF Reader and Foxit PDF Editor allows local attackers to crash the application or potentially execute arbitrary code through specially crafted PDF files with malformed form field hierarchies. The vulnerability triggers when parsing logic misidentifies non-signature data as valid signatures, causing invalid memory writes during internal data structure construction. User interaction is required to open the malicious PDF document. No active exploitation has been identified at time of analysis, though the local attack vector and high CVSS score (7.8) warrant attention for endpoint security in environments handling untrusted PDF files.
Use-after-free in Linux kernel driver core allows local authenticated users to execute arbitrary code, escalate privileges, or crash the system via race condition in device-driver binding operations. The vulnerability stems from inconsistent locking in driver_match_device() function calls, specifically affecting driver_override functionality where device_lock was not held during bind_store() and __driver_attach() operations. EPSS probability is very low (0.02%, 5th percentile), indicating minimal real-world exploitation observed. No active exploitation confirmed - no CISA KEV listing identified. Patch available in kernel 7.0+ and backport commit dc23806a7c47.
Buffer overflow in TH1520 AON firmware protocol driver allows local authenticated attackers with low privileges to execute arbitrary code and gain elevated system access. The vulnerability stems from unsafe pointer arithmetic when accessing the 'mode' field through the 'resource' pointer with unchecked offsets in the T-HEAD firmware driver. Patches available across stable kernel branches (6.18.23, 6.19.13, 7.0) with low EPSS score (0.02%) indicating minimal observed exploitation attempts, though CVSS 7.8 reflects high impact if exploited on affected T-HEAD TH1520 systems.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows arbitrary code execution when specially crafted PDF documents trigger UI refresh operations after comment deletion via scripting. Local attackers can deliver malicious PDFs and achieve code execution with high integrity and confidentiality impact once a user opens the file. CVSS 7.8 indicates high severity but requires user interaction, limiting automated exploitation. No public exploit code or active exploitation confirmed at time of analysis.
Use-after-free in Foxit PDF Reader and Foxit PDF Editor allows local attackers to execute arbitrary code or crash the application via specially crafted PDF documents. When scripts modify document structures, the software fails to maintain valid object references during page information queries, enabling pointer dereference of freed memory. Successful exploitation requires user interaction to open a malicious PDF file, achieving high confidentiality, integrity, and availability impact with CVSS 7.8. No active exploitation or public exploit code identified at time of analysis, though CVSS vector indicates low attack complexity once victim interaction occurs.
Sensitive data exposure in Templately WordPress plugin ≤3.6.1 allows authenticated attackers to retrieve embedded sensitive information via network requests. The vulnerability exhibits scope change (S:C) indicating potential cross-boundary impact, with high confidentiality impact but no integrity or availability effects. CVSS 7.7 severity driven by network accessibility and low attack complexity. No CISA KEV listing indicates no confirmed widespread exploitation. Reported by Patchstack's audit team with reference to their vulnerability database entry.
Timing attack against Spring Boot DevTools remote secret comparison allows adjacent network attackers to recover the shared secret and achieve remote code execution by uploading malicious classes. Affects Spring Boot 2.7.x through 4.0.x when DevTools remote feature is enabled. Attacker must be on same network segment (AV:A) and overcome high attack complexity (timing-based cryptographic weakness), but requires no authentication or user interaction. CVSS 7.5 severity reflects adjacent vector limitation; real-world risk depends heavily on whether DevTools remote restart is enabled in production (not recommended practice) and network segmentation. No confirmed active exploitation (not in CISA KEV). Vendor-released patches available across all affected branches.
Denial of service in the Perl module Text::Minify::XS (v0.3.0 up to but excluding v0.7.8) arises because its minify functions mishandle certain malformed UTF-8 byte sequences, corrupting the heap. A remote attacker who can supply crafted text to an application that calls minify (or its alias minify_utf8) can trigger heap corruption and crash the process. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.04%), and the flaw is not in CISA KEV.
Unauthenticated directory traversal in Pro-Bit versions before 1.77.4 exposes sensitive directories and subdirectories to remote attackers without authentication. The vulnerability allows direct access to protected file system locations via network requests, enabling unauthorized information disclosure. EPSS score of 0.02% (6th percentile) indicates low observed exploitation probability in the wild, and no CISA KEV listing exists at time of analysis, suggesting limited active exploitation despite the CVSS 7.5 severity rating.
Arbitrary file read in leonvanzyl autocoder (commit 79d02a) lets remote unauthenticated attackers retrieve files outside the intended web root by embedding directory-traversal sequences in URL paths served by the UI/static file component. The flaw carries CVSS 7.5 (confidentiality-only impact) and is trivially automatable, but EPSS is negligible (0.01%, 3rd percentile) and there is no public exploit identified at time of analysis. A second reference (a syphonetic gist) may contain proof-of-concept detail, though its contents are not confirmed from the provided data.
Denial of service in Aegra, an open-source Agent Protocol server (vulnerable at commit e9a89f), lets remote unauthenticated attackers exhaust server resources by sending a crafted POST request to the /store/items/search endpoint. The flaw is classified as uncontrolled resource consumption (CWE-400) and carries CVSS 7.5 with an availability-only impact; publicly available exploit code exists via a referenced gist, but there is no evidence of active exploitation and the EPSS probability is negligible (0.01%).
Denial of service in MERCURY MIPC252W IP camera firmware 1.0.5 Build 230306 Rel.79931n allows remote unauthenticated attackers to crash the device via malformed RTSP SETUP request. Exploitation triggers a null pointer dereference in the RTSP service during Transport header parsing, forcing an automatic reboot. EPSS score of 0.01% indicates very low observed exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis beyond the researcher's GitHub documentation.
OS command injection in Tenda HG3 router version 2.0 allows authenticated remote attackers to execute arbitrary commands with device privileges via the 'countrystr' parameter in /boaform/formCountrystr endpoint. Public exploit code exists (CVSS 4.0 E:P modifier confirms POC availability), enabling authenticated attackers to fully compromise router confidentiality, integrity, and availability. EPSS data unavailable; not currently in CISA KEV catalog, suggesting exploitation may be targeted rather than widespread despite public POC.
Buffer overflow in Tenda F456 router firmware version 1.0.0.5 allows authenticated remote attackers to achieve code execution via crafted requests to the /goform/WrlclientSet endpoint. The vulnerability exists in the fromWrlclientSet function of the httpd component. Public exploit code is available on GitHub, increasing practical exploitation risk despite requiring low-privilege authentication (CVSS 7.4, EPSS data not provided).
Buffer overflow in Tenda F456 router firmware 1.0.0.5 allows authenticated remote attackers to execute arbitrary code or crash the device via crafted HTTP requests to the /goform/Natlimit endpoint. Public exploit code exists on GitHub (Litengzheng/vuldb_new), demonstrating practical exploitability. EPSS data unavailable, but with POC published and AV:N/AC:L indicating straightforward network exploitation, this poses significant risk to internet-exposed router management interfaces with weak or default credentials.
Remote code execution in Tenda F456 router firmware 1.0.0.5 allows authenticated attackers to trigger buffer overflow via crafted mit_linktype parameter to /goform/QuickIndex endpoint in httpd service. Public exploit code exists on GitHub (Litengzheng/vuldb_new), enabling memory corruption with high impact to confidentiality, integrity, and availability. CVSS 7.4 reflects low attack complexity with network access requiring only low-privilege authentication. No vendor patch identified at time of analysis.
Remote authenticated attackers can execute arbitrary code on Tenda F456 router version 1.0.0.5 via buffer overflow in the DhcpListClient function of the httpd component. Exploitation requires low-privilege HTTP authentication and targets the web management interface. A public proof-of-concept exploit exists on GitHub (Litengzheng/vuldb_new), enabling straightforward weaponization. EPSS data unavailable, but the combination of remote attack vector, low complexity (AC:L), and publicly disclosed exploit code indicates elevated real-world exploitation risk for internet-exposed devices with default or weak credentials.
Remote authenticated buffer overflow in Tenda F456 1.0.0.5 httpd allows attackers to compromise router integrity and availability via crafted WrlExtraSet requests. Exploitation occurs through the formWrlExtraSet function when manipulating the 'Go' parameter at /goform/WrlExtraSet endpoint. Public exploit code is available on GitHub (Litengzheng/vuldb_new), enabling straightforward weaponization. CVSS 7.4 (High) with CVSS v4.0 Exploit Maturity: Proof-of-Concept confirms exploitability. While requiring low-privilege authentication (PR:L), the network attack vector (AV:N) and low complexity (AC:L) make this accessible to remote attackers with basic router credentials, commonly obtained via credential stuffing or default password exploitation.
Remote authenticated buffer overflow in Tenda F456 1.0.0.5 router allows complete device compromise via the DHCP server configuration handler. A low-privileged attacker can send a crafted HTTP request with malicious 'dips' parameter to /goform/GstDhcpSetSer, triggering a buffer overflow in the httpd service that enables arbitrary code execution with full system control. Public exploit code is available on GitHub (EPSS exploitation probability data not provided, not listed in CISA KEV at time of analysis).