Stack-based buffer overflow in D-Link DIR-825 firmware 3.00b32's nmbd NetBIOS service allows adjacent network attackers to achieve complete device compromise without authentication. Public exploit code exists (SSVC: POC confirmed), though EPSS probability remains low (0.03%, 7th percentile) indicating limited observed exploitation attempts. This vulnerability affects end-of-life hardware no longer receiving vendor security updates, creating permanent risk for deployed devices.
Local privilege escalation in Cerberus FTP Server on Windows (all builds through 2025.4.2) lets a low-privileged local user leverage insecurely preserved inherited filesystem permissions to gain higher privileges on the host. The SSVC framework records a proof-of-concept exploit (published by Reversec Labs) with total technical impact, though EPSS estimates real-world exploitation probability at just 0.01%. The issue is fixed in release 2026.1.
Local privilege escalation in KDE's plasma-login-manager arises from its plasmaloginauthhelper component executing with unnecessary elevated privileges (CWE-250), allowing an authenticated local user with a graphical session to obtain full compromise of confidentiality, integrity, and availability. Disclosed via oss-security on 2026-04-27 by SUSE's Matthias Gerstner and tracked as EUVD-2026-29919, the weakness affects the privileged authentication helper backing the login manager. No public exploit identified at time of analysis, and EPSS is very low (0.01%), consistent with a local-only, interaction-dependent flaw rather than a mass-exploitation candidate.
A race condition in WinFsp enables local privilege escalation to SYSTEM through kernel heap overflow. Authenticated local attackers with low privileges can exploit this timing vulnerability to corrupt kernel memory and execute code at the highest privilege level. Patch available in WinFsp v2.2B1 per vendor release notes. EPSS data not available; no CISA KEV listing indicates exploitation not yet confirmed in the wild, though the vulnerability affects a Windows kernel-mode driver used for file system development.
SQL injection in Pimcore's DataObject composite index handling lets an authenticated administrative user (PR:H) escalate configuration-management rights into arbitrary SQL execution by importing or saving a crafted class definition. The vulnerable flow accepts compositeIndices from imported JSON and concatenates index_key and, more reliably, index_columns verbatim into ALTER TABLE ... DROP/ADD INDEX statements run through Doctrine DBAL. There is no public exploit identified at time of analysis and EPSS is 0.01%, but the GHSA advisory and PR #19108 fully document the root cause, so exploitation is well understood.
Authentication bypass in hermes-agent 0.8.0 webhook endpoint allows remote attackers to bypass authentication controls via manipulation of the _INSECURE_NO_AUTH parameter, resulting in limited confidentiality and integrity impact. The vulnerability requires high attack complexity and has publicly available exploit code; vendor patch is available but the project has not yet merged the fix despite early notification.
Improper authentication in the API_SERVER_KEY handler of NousResearch hermes-agent 0.8.0 allows remote attackers to bypass authentication checks in the _check_auth function via the API server component. The vulnerability has a CVSS score of 6.3 with high attack complexity, and publicly available exploit code exists. The project has not yet responded to early notification via pull request.
Elevation of Privileges in Dell Alienware Command Center (AWCC) versions prior to 6.13.8.0 allows a local low-privileged attacker to gain full system access by exploiting a component that executes with unnecessarily elevated rights (CWE-250). The attack requires high complexity and user interaction (CVSS AV:L/AC:H/PR:L/UI:R), placing real-world exploitability well below the theoretical maximum despite the total technical impact assessed by SSVC. No public exploit exists and EPSS places this in the 2nd percentile, confirming no public exploitation activity at time of analysis. Dell has released a fix in AWCC 6.13.8.0.
Apache Storm's TlsTransportPlugin silently assigns the principal CN=ANONYMOUS to unauthenticated TLS clients when client certificate authentication is not enforced - the default configuration - allowing unauthenticated network principals to interact with Storm services wherever the authorizer does not explicitly deny anonymous access. The fail-open behavior stems from suppressing SSLPeerUnverifiedException rather than rejecting the connection, and the condition is logged at debug level only, leaving the bypass invisible in most production monitoring setups. No public exploit has been identified and EPSS is 0.04% (11th percentile), but SSVC rates the vulnerability as automatable with partial technical impact, meaning tooling could systematically probe exposed clusters for permissive authorizer configurations.
DOM-based cross-site scripting (XSS) in CodexThemes TheGem Theme Elements plugin for Elementor allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers when user interaction occurs. The vulnerability affects versions before 5.12.1.1 and requires authenticated access and user interaction to exploit, limiting real-world risk compared to network-vector XSS but still enabling session hijacking, credential theft, or unauthorized admin actions on WordPress sites using this plugin.
SQL Injection vulnerability exists in Sourcecodester Online Job Portal phppdo 1.0 ivia the category parameter in /jobportal/index.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial of service in MERCURY IP camera MIPC252W version 1.0.5 Build 230306 allows unauthenticated local attackers to trigger persistent authentication failure in the RTSP service by sending repeated requests with invalid Digest authentication parameters, preventing legitimate clients from authenticating and causing service unavailability.
Cross-site scripting (XSS) in code-projects Employee Management System 1.0 allows remote attackers to inject malicious scripts via manipulation of the file 370project/mark.php. The vulnerability requires user interaction (UI:R) but can be exploited over the network without authentication. Publicly available exploit code exists and the flaw has moderate impact on integrity (CVSS 4.3).
Reflected cross-site scripting (XSS) in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to inject malicious scripts via the ID parameter in 370project/edit.php. The vulnerability requires user interaction (link click) but has publicly available exploit code and a moderate CVSS score of 4.3, indicating limited but real integrity impact through client-side script execution.
Code-Projects Invoice System in Laravel 1.0 allows authenticated remote attackers to bypass authorization controls via manipulation of the ID parameter in the /invoice/ endpoint, enabling unauthorized access to invoice data with potential for modification and denial of service. The vulnerability has publicly available exploit code and is actively exploitable against default configurations.
Improper authorization in code-projects Invoice System in Laravel 1.0 allows authenticated remote attackers to bypass access controls via manipulation of the ID parameter in the Profile Handler (/profile/ endpoint), leading to unauthorized read, modification, and denial of service impacts. Public exploit code is available, elevating real-world exploitation risk despite the moderate CVSS score of 6.3.
Improper authorization in code-projects Invoice System in Laravel 1.0 allows authenticated remote attackers to bypass access controls on the User Management Handler (/user endpoint), gaining unauthorized read, write, and availability impact. The vulnerability has a published exploit available and affects all versions of the affected product line.
SQL injection in CodeAstro Online Classroom 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the deleteid parameter in the /guestdetails endpoint, enabling unauthorized data access, modification, or deletion. The vulnerability has publicly available exploit code and a CVSS score of 6.3 reflecting moderate risk with low attack complexity.
SQL injection in 1000 Projects Portfolio Management System MCA up to version 1.0 allows authenticated remote attackers to access and potentially modify database contents via the q parameter in /admin/block_status.php. Publicly available exploit code exists, though no confirmed active exploitation is documented. The vulnerability poses minimal real-world risk due to EPSS score of 0.03% and requirement for prior authentication, with impact limited to low-level data disclosure and modification.
SQL injection in code-projects Employee Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the id or token parameter in 370project/cancel.php, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has a publicly available proof-of-concept and CVSS score of 6.3 (medium severity) with low attack complexity, though exploitation requires valid user credentials.
SQL injection in code-projects Employee Management System 1.0 allows authenticated remote attackers to manipulate the id and token parameters in 370project/approve.php, enabling unauthorized database queries with low confidentiality, integrity, and availability impact. Publicly available exploit code exists and CVSS score of 6.3 reflects the attack's network accessibility despite requiring low-level authentication.
SQL injection in code-projects Employee Management System 1.0 allows authenticated remote attackers to manipulate the ID argument in 370project/delete.php, leading to unauthorized database queries with limited confidentiality and integrity impact. Publicly available exploit code exists; CVSS 5.3 reflects moderate risk limited by authentication requirement and restricted data access scope.
SQL injection in code-projects Employee Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in 370project/edit.php, potentially leading to unauthorized data access or modification. The vulnerability requires valid user credentials (PR:L per CVSS vector) and has publicly available exploit code; however, the limited scope (VC:L, VI:L, VA:L) and requirement for authentication reduce real-world risk compared to the base CVSS score of 5.3.
Authorization bypass in 1000 Projects Portfolio Management System MCA 1.0 allows authenticated remote attackers to modify other users' passwords via the `temp_user` parameter in `update_passwd_process.php`. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), enabling horizontal privilege escalation at the application layer. A publicly available proof-of-concept exploit exists on GitHub, though EPSS at 0.03% (7th percentile) and SSVC's 'not automatable' designation indicate limited mass-exploitation risk; no active exploitation has been confirmed by CISA KEV.
Path traversal in HBAI-Ltd Toonflow-app up to version 1.1.1 allows authenticated remote attackers to read arbitrary files via manipulation of the url argument in the updateStoryboardUrl function of the Storyboard Export component. The vulnerability has a publicly available exploit, though the vendor disputes its practical exploitability, arguing the affected interface is designed to accept only local or trusted Docker-configured addresses. CVSS 4.3 reflects low confidence (RC:C) and unconfirmed exploitation probability (E:P).
Cross-site scripting (XSS) vulnerability in code-projects Home Service System 1.0 allows remote attackers to inject malicious scripts via the fname and lname parameters in the /booking.php Appointment Booking component. User interaction is required for exploitation. A public exploit is available, and the vulnerability carries moderate risk (CVSS 4.3) with integrity impact through malicious script execution in victim browsers.
SQL injection in CodeAstro Online Classroom 1.0 exposes the /addnewfaculty endpoint to database manipulation via the unsanitized fname parameter, accessible to authenticated remote attackers. A public exploit has been published on GitHub, though EPSS sits at 0.01% (1st percentile) and SSVC rates the attack as non-automatable with only partial technical impact - signals consistent with a niche, low-footprint application. No CISA KEV listing exists; real-world risk is constrained by the requirement for a low-privilege authenticated session and the limited deployment base of this product.
Reflected XSS in diskover-community 2.3.5 and earlier allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session by tricking an authenticated user into clicking a crafted URL with a malicious namecontains parameter targeting public/selectindices.php. A public proof-of-concept writeup exists on GitHub, though EPSS rates exploitation probability at 0.01% (1st percentile) and CISA has not added this to the Known Exploited Vulnerabilities catalog. SSVC confirms the exploit exists but flags the attack as non-automatable due to required user interaction, limiting realistic risk to targeted phishing scenarios.
Reflected XSS in diskover-community's public/view.php allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in the doctype parameter of a crafted URL. Affected versions are 2.3.5 and below of this PHP-based open-source file indexing application. A proof-of-concept exploit is confirmed per SSVC assessment, though EPSS sits at the 1st percentile and active exploitation has not been confirmed by CISA KEV, suggesting opportunistic rather than widespread targeting.
Reflected cross-site scripting (XSS) in WebFileSys 2.31.1 allows remote attackers to execute arbitrary JavaScript in victims' browsers via unencoded user input reflected into HTML and JavaScript contexts. Attack requires victim interaction (UI:R) but affects cross-site scope, enabling session hijacking, credential theft, or malware delivery. EPSS score of 0.01% indicates extremely low baseline exploitation probability despite public exploit code availability on GitHub.
Path traversal in CPython's `shutil.unpack_archive()` on Windows allows arbitrary file writes outside the intended extraction directory when processing ZIP archives containing Windows drive-letter absolute paths (e.g., `C:\...`, `D:\...`). The existing sanitization in `_unpack_zipfile()` rejected only Unix-style absolute paths (`/`) and directory traversal sequences (`..`), leaving Windows drive specifiers completely unchecked. No public exploit has been identified at time of analysis; EPSS of 0.05% (14th percentile) and SSVC exploitation status of 'none' indicate no observed exploitation, though the high integrity impact warrants patching in environments that process untrusted ZIP archives on Windows.
Improper ownership management in Moxa Secure Router allows low-privileged authenticated users to access exported configuration files containing hashed administrative passwords, enabling credential disclosure. The vulnerability is confined to scenarios where configuration files have been exported and requires valid user credentials to exploit; no impact to system integrity or availability has been identified.
Unrestricted file upload in code-projects Online Lot Reservation System 1.0 allows an authenticated high-privilege user to upload arbitrary file types via the `image` parameter in /edithousepic.php, potentially enabling server-side code execution if the upload directory permits PHP execution. A publicly available proof-of-concept exploit exists on GitHub, though no active exploitation has been confirmed via CISA KEV. The mandatory high-privilege authentication barrier (PR:H per CVSS 4.0) substantially constrains the real-world attack surface despite the network-accessible vector.
Unrestricted file upload in code-projects Online Lot Reservation System 1.0 exposes the `/activity.php` endpoint to arbitrary file upload via the `directory` argument, enabling authenticated attackers to plant PHP webshells on the server. The CVSS 4.0 vector assigns PR:H, meaning exploitation is gated behind high-privilege administrative credentials - substantially narrowing the attack surface despite remote reachability. A public proof-of-concept is available on GitHub, but no confirmed active exploitation (CISA KEV) has been identified, and an EPSS of 0.03% signals very low opportunistic exploitation probability.
Cross-site scripting (XSS) in code-projects Invoice System in Laravel 1.0 allows authenticated remote attackers to inject malicious scripts via the item name/description parameter in the /item endpoint. The vulnerability requires user interaction (UI:P) and affects only the integrity of victim data (VI:L), but publicly available exploit code exists and the attack vector is network-accessible.
Stored cross-site scripting (XSS) in code-projects Chat System 1.0 allows high-privilege remote attackers to inject malicious scripts via the msg parameter in /admin/send_message.php, affecting the Chat Interface component. The vulnerability requires admin-level authentication and user interaction (viewing the crafted message), but publicly available exploit code exists and the issue is actively being leveraged. With a CVSS score of 2.4, the impact is limited to integrity violations with no confidentiality or availability loss, but the presence of public POC and active exploitation elevates practical risk despite low severity metrics.
Path traversal in OSPG binwalk 2.4.3 and earlier allows local low-privileged attackers to read or write files outside the intended extraction directory by supplying a crafted WinCE firmware image that manipulates the `self.file_name` argument in the `read_null_terminated_string` function of the WinCE Extraction Plugin. A public proof-of-concept exploit exists, though EPSS sits at 0.01% (2nd percentile) and CISA KEV lists no confirmed active exploitation, indicating negligible real-world uptake. The project maintainer has acknowledged the flaw but confirmed no patch will be released, as binwalk 2.x is end-of-life; migration to binwalk v3 is the only vendor-endorsed resolution.
Out-of-bounds read in GPAC's elng_box_read function allows local attackers to trigger partial information disclosure and potential availability impact by supplying a crafted MP4 file with an oversized Extended Language Tag (elng) box. The fix commit confirms the root cause: ptr->size is not validated against GF_UINT_MAX before use, permitting a read beyond allocated memory. A publicly available proof-of-concept exploit exists (GitHub issue #3516), though EPSS sits at 0.01% and SSVC classifies exploitation as non-automatable with only partial technical impact - placing real-world priority well below the noise floor for most organizations.
Command injection in disler's aider-mcp-server allows remote unauthenticated attackers to execute arbitrary OS commands by supplying malicious input to the `relative_editable_files` argument in `src/aider_mcp_server/server.py`. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, and SSVC classifies exploitation as automatable with a public proof-of-concept already published. No vendor patch exists at time of analysis, as the maintainer has not responded to the coordinated disclosure filed in issue #16.
Command injection in D-Link DIR-822 A_101 udhcpd DHCP service allows remote unauthenticated attackers to execute arbitrary commands via a malicious Hostname parameter in DHCP requests. The vulnerability affects an end-of-life product with publicly disclosed exploit code available, creating significant risk for organizations unable to migrate away from legacy hardware.
OPPO Wallet APP contains a trusted domain validation bypass flaw that allows local attackers with user interaction to hijack account tokens and disclose sensitive information. The vulnerability affects all versions of OPPO Wallet APP and exploits improper domain verification in protected interface access controls, enabling token theft through local attack vector.
Uncaught exception in UERANSIM up to v3.2.7 allows remote unauthenticated attackers to crash the Radio Link Simulation (RLS) message decoder by sending a crafted PDU with an oversized or malformed pduLength field, causing denial of service against 5G simulation sessions. The SSVC framework marks this as automatable with a POC exploit available, though real-world impact is constrained to research and testing environments given the product's deployment profile. A vendor patch (v3.2.8) was released promptly after responsible disclosure, confirmed by the upstream GitHub release tag.
Path traversal in kaggle-mcp's `prepare_kaggle_dataset` function exposes the host filesystem to remote unauthenticated attackers via unsanitized `competition_id` input. Any deployment of this Model Context Protocol server at commit 406127ff or earlier is affected across all platforms. A publicly disclosed exploit exists and SSVC confirms the attack is automatable, meaning attackers can read, write, or partially disrupt arbitrary server files without credentials or user interaction; the maintainer has not responded to the coordinated disclosure issue filed on GitHub.
Server-side request forgery in ChatGPTNextWeb NextChat through version 2.16.1 allows remote unauthenticated attackers to make the server issue arbitrary HTTP requests by manipulating the ID parameter in the storeUrl function of the Artifacts Endpoint. A public proof-of-concept exists (GitHub Gist), and SSVC confirms the attack is automatable with no authentication required. No vendor patch is available; the project has not responded to responsible disclosure via GitHub issue #6741.
Server-side request forgery in AlejandroArciniegas mcp-data-vis allows unauthenticated remote attackers to cause the server to issue arbitrary outbound HTTP requests via the `axios`-based HTTP Request Handler in `src/servers/web-scraper/server.js`. Attackers can leverage this to probe internal network services, cloud metadata endpoints, or bypass perimeter controls from the server's network context. A public proof-of-concept exploit exists (SSVC: poc, Automatable: yes), though EPSS remains low at 0.04% (12th percentile), consistent with the tool's obscure deployment footprint.
Server-Side Request Forgery in dmitryglhf's mcp-url-downloader MCP server allows unauthenticated remote attackers to manipulate the url argument passed to the _validate_url_safe function, causing the server to issue arbitrary outbound HTTP requests on the attacker's behalf. The flaw exposes any internal network resources reachable by the host - including cloud instance metadata endpoints - to external actors with network access to the service. A public proof-of-concept has been disclosed (SSVC: poc, Automatable: yes); the vendor has not yet responded to responsible disclosure, and no patched release exists.
Denial of service in Linux kernel GPIO OMAP driver allows local authenticated users to crash the system via a deadlock condition triggered by improper driver registration from probe() callback. The vulnerability stems from registering the omap_mpuio_driver within omap_gpio_probe(), which violates driver core locking rules and creates a potential deadlock when device_lock enforcement was strengthened in commit dc23806a7c47. EPSS score of 0.03% reflects low exploitation probability despite availability of patched kernel versions.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /ajax.php?action=delete_category, enabling arbitrary SQL query execution with confidentiality and integrity impact. CVSS 6.9 reflects network accessibility and low privilege requirements; publicly available exploit code exists per description.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /ajax.php?action=save_type, enabling arbitrary SQL query execution with confidentiality and integrity impact. Publicly disclosed exploit code is available, significantly increasing real-world risk despite the moderate CVSS score of 6.9.
Denial of service in the Linux kernel EDAC (Error Detection and Correction) subsystem due to improper initialization ordering in edac_mc_alloc(). When memory allocation fails during EDAC memory controller initialization, the error path calls put_device() before device_initialize() is executed, triggering a null pointer dereference in kobject_put() that causes a kernel panic or system crash. This affects Linux systems with EDAC support enabled across multiple kernel versions from 5.19 through 7.0.