Authentication bypass in hermes-agent 0.8.0 webhook endpoint allows remote attackers to bypass authentication controls via manipulation of the _INSECURE_NO_AUTH parameter, resulting in limited confidentiality and integrity impact. The vulnerability requires high attack complexity and has publicly available exploit code; vendor patch is available but the project has not yet merged the fix despite early notification.
Improper authentication in the API_SERVER_KEY handler of NousResearch hermes-agent 0.8.0 allows remote attackers to bypass authentication checks in the _check_auth function via the API server component. The vulnerability has a CVSS score of 6.3 with high attack complexity, and publicly available exploit code exists. The project has not yet responded to early notification via pull request.
Cross-site scripting (XSS) in code-projects Employee Management System 1.0 allows remote attackers to inject malicious scripts via manipulation of the file 370project/mark.php. The vulnerability requires user interaction (UI:R) but can be exploited over the network without authentication. Publicly available exploit code exists and the flaw has moderate impact on integrity (CVSS 4.3).
Reflected cross-site scripting (XSS) in code-projects Employee Management System 1.0 allows remote unauthenticated attackers to inject malicious scripts via the ID parameter in 370project/edit.php. The vulnerability requires user interaction (link click) but has publicly available exploit code and a moderate CVSS score of 4.3, indicating limited but real integrity impact through client-side script execution.
Code-Projects Invoice System in Laravel 1.0 allows authenticated remote attackers to bypass authorization controls via manipulation of the ID parameter in the /invoice/ endpoint, enabling unauthorized access to invoice data with potential for modification and denial of service. The vulnerability has publicly available exploit code and is actively exploitable against default configurations.
Improper authorization in code-projects Invoice System in Laravel 1.0 allows authenticated remote attackers to bypass access controls via manipulation of the ID parameter in the Profile Handler (/profile/ endpoint), leading to unauthorized read, modification, and denial of service impacts. Public exploit code is available, elevating real-world exploitation risk despite the moderate CVSS score of 6.3.
Improper authorization in code-projects Invoice System in Laravel 1.0 allows authenticated remote attackers to bypass access controls on the User Management Handler (/user endpoint), gaining unauthorized read, write, and availability impact. The vulnerability has a published exploit available and affects all versions of the affected product line.
SQL injection in CodeAstro Online Classroom 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the deleteid parameter in the /guestdetails endpoint, enabling unauthorized data access, modification, or deletion. The vulnerability has publicly available exploit code and a CVSS score of 6.3 reflecting moderate risk with low attack complexity.
SQL injection in 1000 Projects Portfolio Management System MCA up to version 1.0 allows authenticated remote attackers to access and potentially modify database contents via the q parameter in /admin/block_status.php. Publicly available exploit code exists, though no confirmed active exploitation is documented. The vulnerability poses minimal real-world risk due to EPSS score of 0.03% and requirement for prior authentication, with impact limited to low-level data disclosure and modification.
SQL injection in code-projects Employee Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the id or token parameter in 370project/cancel.php, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has a publicly available proof-of-concept and CVSS score of 6.3 (medium severity) with low attack complexity, though exploitation requires valid user credentials.
SQL injection in code-projects Employee Management System 1.0 allows authenticated remote attackers to manipulate the id and token parameters in 370project/approve.php, enabling unauthorized database queries with low confidentiality, integrity, and availability impact. Publicly available exploit code exists and CVSS score of 6.3 reflects the attack's network accessibility despite requiring low-level authentication.
SQL injection in code-projects Employee Management System 1.0 allows authenticated remote attackers to manipulate the ID argument in 370project/delete.php, leading to unauthorized database queries with limited confidentiality and integrity impact. Publicly available exploit code exists; CVSS 5.3 reflects moderate risk limited by authentication requirement and restricted data access scope.
SQL injection in code-projects Employee Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in 370project/edit.php, potentially leading to unauthorized data access or modification. The vulnerability requires valid user credentials (PR:L per CVSS vector) and has publicly available exploit code; however, the limited scope (VC:L, VI:L, VA:L) and requirement for authentication reduce real-world risk compared to the base CVSS score of 5.3.
Authorization bypass in 1000 Projects Portfolio Management System MCA 1.0 allows authenticated remote attackers to modify other users' passwords via the `temp_user` parameter in `update_passwd_process.php`. The flaw is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), enabling horizontal privilege escalation at the application layer. A publicly available proof-of-concept exploit exists on GitHub, though EPSS at 0.03% (7th percentile) and SSVC's 'not automatable' designation indicate limited mass-exploitation risk; no active exploitation has been confirmed by CISA KEV.
Path traversal in HBAI-Ltd Toonflow-app up to version 1.1.1 allows authenticated remote attackers to read arbitrary files via manipulation of the url argument in the updateStoryboardUrl function of the Storyboard Export component. The vulnerability has a publicly available exploit, though the vendor disputes its practical exploitability, arguing the affected interface is designed to accept only local or trusted Docker-configured addresses. CVSS 4.3 reflects low confidence (RC:C) and unconfirmed exploitation probability (E:P).
Cross-site scripting (XSS) vulnerability in code-projects Home Service System 1.0 allows remote attackers to inject malicious scripts via the fname and lname parameters in the /booking.php Appointment Booking component. User interaction is required for exploitation. A public exploit is available, and the vulnerability carries moderate risk (CVSS 4.3) with integrity impact through malicious script execution in victim browsers.
SQL injection in CodeAstro Online Classroom 1.0 exposes the /addnewfaculty endpoint to database manipulation via the unsanitized fname parameter, accessible to authenticated remote attackers. A public exploit has been published on GitHub, though EPSS sits at 0.01% (1st percentile) and SSVC rates the attack as non-automatable with only partial technical impact - signals consistent with a niche, low-footprint application. No CISA KEV listing exists; real-world risk is constrained by the requirement for a low-privilege authenticated session and the limited deployment base of this product.
Unrestricted file upload in code-projects Online Lot Reservation System 1.0 allows an authenticated high-privilege user to upload arbitrary file types via the `image` parameter in /edithousepic.php, potentially enabling server-side code execution if the upload directory permits PHP execution. A publicly available proof-of-concept exploit exists on GitHub, though no active exploitation has been confirmed via CISA KEV. The mandatory high-privilege authentication barrier (PR:H per CVSS 4.0) substantially constrains the real-world attack surface despite the network-accessible vector.
Unrestricted file upload in code-projects Online Lot Reservation System 1.0 exposes the `/activity.php` endpoint to arbitrary file upload via the `directory` argument, enabling authenticated attackers to plant PHP webshells on the server. The CVSS 4.0 vector assigns PR:H, meaning exploitation is gated behind high-privilege administrative credentials - substantially narrowing the attack surface despite remote reachability. A public proof-of-concept is available on GitHub, but no confirmed active exploitation (CISA KEV) has been identified, and an EPSS of 0.03% signals very low opportunistic exploitation probability.
Cross-site scripting (XSS) in code-projects Invoice System in Laravel 1.0 allows authenticated remote attackers to inject malicious scripts via the item name/description parameter in the /item endpoint. The vulnerability requires user interaction (UI:P) and affects only the integrity of victim data (VI:L), but publicly available exploit code exists and the attack vector is network-accessible.
Stored cross-site scripting (XSS) in code-projects Chat System 1.0 allows high-privilege remote attackers to inject malicious scripts via the msg parameter in /admin/send_message.php, affecting the Chat Interface component. The vulnerability requires admin-level authentication and user interaction (viewing the crafted message), but publicly available exploit code exists and the issue is actively being leveraged. With a CVSS score of 2.4, the impact is limited to integrity violations with no confidentiality or availability loss, but the presence of public POC and active exploitation elevates practical risk despite low severity metrics.
Path traversal in OSPG binwalk 2.4.3 and earlier allows local low-privileged attackers to read or write files outside the intended extraction directory by supplying a crafted WinCE firmware image that manipulates the `self.file_name` argument in the `read_null_terminated_string` function of the WinCE Extraction Plugin. A public proof-of-concept exploit exists, though EPSS sits at 0.01% (2nd percentile) and CISA KEV lists no confirmed active exploitation, indicating negligible real-world uptake. The project maintainer has acknowledged the flaw but confirmed no patch will be released, as binwalk 2.x is end-of-life; migration to binwalk v3 is the only vendor-endorsed resolution.
Out-of-bounds read in GPAC's elng_box_read function allows local attackers to trigger partial information disclosure and potential availability impact by supplying a crafted MP4 file with an oversized Extended Language Tag (elng) box. The fix commit confirms the root cause: ptr->size is not validated against GF_UINT_MAX before use, permitting a read beyond allocated memory. A publicly available proof-of-concept exploit exists (GitHub issue #3516), though EPSS sits at 0.01% and SSVC classifies exploitation as non-automatable with only partial technical impact - placing real-world priority well below the noise floor for most organizations.
Stale KV cache data leakage in vllm's KV Block Handler (versions 0.1-0.19.0) allows partial disclosure of prior inference requests' attention key/value data to subsequent requests. The `needs_kv_cache_zeroing` property incorrectly returned `False` for FullAttention model configurations - relying solely on `has_mamba_layers` - causing recycled KV cache blocks to go unzeroed between requests; partial-block tail slots retaining NaN/Inf values from prior sessions could then leak into the masked softmax computation of the next request. A publicly available PoC exists per SSVC and CVSS 4.0 E:P, though EPSS at 0.05% (14th percentile) and absence from CISA KEV indicate very low observed exploitation in practice.
Weak cryptographic hash usage in code-projects Chat System 1.0 allows remote attackers to compromise password security through the MD5 Hash Handler in update_user.php. The vulnerability stems from use of MD5 for password hashing, a cryptographically broken algorithm that enables rapid offline cracking of password hashes. Publicly disclosed exploit code exists, though exploitation requires high attack complexity. The vulnerability impacts password confidentiality with low direct severity but creates substantial downstream risks for user account compromise.
Command injection in Tenda F456 1.0.0.5 httpd allows authenticated remote attackers to execute arbitrary commands via the mac parameter in the /goform/WriteFacMac endpoint. The vulnerability has a publicly available exploit and CVSS 5.3 score with authenticated access requirement (PR:L), limiting immediate widespread risk but affecting exposed or compromised administrative accounts.
Improper authorization in Wooey versions up to 0.13.2 permits any authenticated non-staff user to upload or update Python scripts via the add_or_update_script API endpoint in wooey/api/scripts.py, bypassing the intended staff-only privilege boundary. Because Wooey executes uploaded scripts on the underlying server, this flaw carries escalation potential beyond the limited CVSS 4.0 base score of 2.1 in multi-tenant or internet-facing deployments. A proof-of-concept has been publicly disclosed; the vulnerability is not in CISA KEV, and EPSS is negligible at 0.04% (13th percentile), suggesting exploitation remains opportunistic rather than widespread.
Unrestricted file upload in code-projects Invoice System Laravel 1.0 allows authenticated attackers to upload arbitrary files via the logo parameter in the /company endpoint, enabling remote code execution or malicious file distribution. Public exploit code is available, and the vulnerability requires only low-privilege authenticated access with no user interaction.
Server-side request forgery in the auto-favicon MCP tool's generate_favicon_from_url function enables authenticated remote attackers to coerce the server into issuing arbitrary outbound HTTP requests, potentially reaching internal network resources, cloud metadata endpoints, or other services inaccessible from the internet. All versions of dh1011/auto-favicon-mcp up to commit f189116a9259950c2393f114dbcb94dde0ad864b are affected, with no vendor patch available. A public exploit has been disclosed; however, EPSS sits at 0.03% (10th percentile) and CISA SSVC rates it non-automatable with partial technical impact, placing real-world exploitation risk at the lower end of the threat spectrum.
Reflected cross-site scripting (XSS) in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote attackers to inject malicious scripts via the ID parameter in /index.php?page=categories. The vulnerability requires user interaction (clicking a crafted link) but has publicly available exploit code and a low CVSS score (5.3) reflecting limited impact scope, with only low integrity consequences to the victim's session or data.
Cross-site request forgery (CSRF) in code-projects Invoice System 1.0 for Laravel allows remote attackers to perform unauthorized actions via crafted requests. The vulnerability requires user interaction (clicking a malicious link) but affects the system's integrity through unvalidated state-changing operations. Exploit code is publicly available, and the CVSS 5.3 score reflects moderate severity with limited integrity impact but no confidentiality or availability harm.
Server-side request forgery in HBAI-Ltd Toonflow-app up to version 1.1.1 allows authenticated remote attackers to manipulate the Link parameter in the getCodeByLink endpoint, enabling arbitrary HTTP requests from the server. The vendor acknowledges the /getCodeByLink interface is inherently high-risk and designed to fetch and execute TypeScript code locally; public exploit code exists but vendor questions the practical exploitability of the reported vulnerability.
Transient execution side-channel exposure in AMD EPYC 7001 Series and EPYC Embedded 3000 Series processors permits a local low-privileged attacker to leak limited sensitive data through the floating point divisor unit's microarchitectural state during speculative execution. Exploitation is constrained to local access with specific attack conditions present (CVSS 4.0 AT:P), placing this firmly in the Spectre/Meltdown class of hardware-level vulnerabilities. No public exploit code or active exploitation has been identified; EPSS sits at 0.01% (1st percentile) and CISA SSVC rates exploitation as none with non-automatable attack path.
SQL injection in likeadmin_php up to version 1.9.6 allows high-privilege remote attackers to manipulate SQL queries through the queryResult function in the dataTable Admin API component, potentially exposing or modifying sensitive database content. Public exploit code exists and the vendor has not yet responded to early notification, elevating risk despite the CVSS score of 5.1 reflecting high-privilege authentication requirements.
Path traversal in HBAI-Ltd Toonflow-app up to version 1.1.1 allows authenticated remote attackers to access files outside intended directories via the url parameter in the downloadApp endpoint (src/routes/setting/about/downloadApp.ts). The vulnerability requires high attack complexity and authenticated access; vendor mitigation notes that the update URL is statically compiled in official code and exploitation would require users to modify source code. Publicly disclosed exploit code exists, but real-world exploitability is disputed by the vendor and remains uncertain.