String injection in Notepad++ 8.9.3 leads to memory address disclosure or application crash when processing maliciously crafted input. Attackers can leverage this remotely without authentication (CVSS 4.0 score 10.0, AV:N/PR:N), though desktop application context suggests user interaction required despite UI:N in vector. Publicly available exploit code exists per GitHub repository llgsjsm/cve-2026-3008. Fixed in version 8.9.4 release candidate per community forum discussion. EPSS data not available for 2026 CVE.
Path traversal in douinc mkdocs-mcp-plugin 0.4.0 and 0.4.1 exposes arbitrary server filesystem files to remote unauthenticated attackers via unsanitized docs_dir and file_path arguments in the read_document and list_documents functions of server.py. A public proof-of-concept is available on GitHub (issue #6), and SSVC classifies the attack as automatable, lowering the bar for mass exploitation. No patched version has been released at time of analysis; the vendor has acknowledged the issue and committed to publishing a fix within days.
Server-side request forgery in ChatGPTNextWeb NextChat 2.16.0-2.16.1 allows unauthenticated remote attackers to manipulate the proxyHandler function in app/api/[provider]/[...path]/route.ts to coerce the server into issuing arbitrary HTTP requests to attacker-controlled internal or external destinations. A public proof-of-concept exploit is confirmed available, and the vendor has not yet responded to responsible disclosure filed as GitHub issue #6742, leaving no patch available. Despite a low EPSS score of 0.04%, the zero-authentication requirement combined with public exploit code warrants prompt compensating controls for any internet-exposed deployment.
Server-side request forgery in ShadowCloneLabs GlutamateMCPServers allows remote unauthenticated attackers to manipulate the 'url' parameter in the puppeteer_navigate component (src/puppeteer/index.ts), potentially accessing internal resources or conducting network reconnaissance. A publicly available proof-of-concept exploit exists (GitHub). EPSS data not available, but CVSS 7.3 (High) with network vector, low complexity, and no authentication requirements indicates significant accessibility. The vendor has not responded to early disclosure via GitHub issue #8, and no patch timeline exists due to the project's rolling release model.
Path traversal in code-projects Online Lot Reservation System 1.0 allows unauthenticated remote attackers to read arbitrary files from the server by supplying directory traversal sequences in the unsanitized `File` parameter of `/download.php`. A public proof-of-concept exploit is available on GitHub, and SSVC classifies the attack as automatable with partial technical impact, though EPSS at 0.04% (13th percentile) indicates negligible observed exploitation activity to date. No CISA KEV listing exists, suggesting exploitation remains opportunistic rather than widespread.
Server-side request forgery in JoeCastrom mcp-chat-studio (all versions through 1.5.0) allows unauthenticated remote attackers to forge arbitrary server-initiated HTTP requests by injecting a malicious URL into the `base_url` query parameter of the LLM Models API (`server/routes/llm.js`). A public exploit exists via GitHub issue report, and SSVC classifies this as automatable - meaning it can be scripted for broad scanning. No patch has been issued; the maintainer has not responded to the coordinated disclosure.
Improper authorization in code-projects Invoice System in Laravel 1.0 allows remote unauthenticated attackers to bypass authentication and access the /item API endpoint, resulting in limited confidentiality impact. The vulnerability has a CVSS score of 5.5 (network-accessible, low attack complexity, no privileges required), and publicly available exploit code exists, increasing real-world risk despite the moderate base score.
CodeAstro Online Job Portal 1.0 exposes file and directory information through the /users/user-cvs/ endpoint via remote unauthenticated access, allowing attackers to enumerate and retrieve sensitive resume and user data. The vulnerability has publicly available exploit code and affects all versions of the application via the CPE cpe:2.3:a:codeastro:online_job_portal:*:*:*:*:*:*:*:*. CVSS 5.5 with confirmed public exploit availability and EPSS exploitation probability indicates moderate real-world risk for deployments accessible over the network.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to execute arbitrary database queries via the ID parameter in /ajax.php?action=delete_product. Publicly available exploit code exists (GitHub POC), enabling unauthorized data access, modification, or deletion without authentication. EPSS data not available, but the combination of network attack vector, no authentication requirement, and public exploit significantly elevates real-world exploitation risk for internet-exposed instances.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 exposes the `/ajax.php?action=save_product` endpoint to unauthenticated remote attackers who can manipulate the `id` parameter to inject arbitrary SQL commands against the backend database. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is needed, and a public proof-of-concept exploit is available per VulDB and a referenced GitHub issue. Despite straightforward exploitability, the EPSS score of 0.03% (9th percentile) reflects the product's niche deployment footprint rather than any exploitation difficulty, and no CISA KEV listing has been confirmed.
SQL injection in code-projects Online Lot Reservation System 1.0 exposes the pre-authentication login endpoint `/loginuser.php` to unauthenticated remote database manipulation via the `email` and `password` parameters. A public POC has been disclosed on GitHub, though real-world exploitation risk is tempered by an EPSS of 0.03% (9th percentile), SSVC 'Exploitation: none', and the product's obscure deployment footprint. Successful exploitation yields partial compromise of confidentiality, integrity, and availability of the underlying database - consistent with CVSS 4.0 impact ratings of VC:L/VI:L/VA:L.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to read, modify, or delete database records via the ID parameter in /ajax.php?action=delete_receiving. Publicly available exploit code (GitHub POC) demonstrates working attack against default installations with no authentication required (CVSS AV:N/AC:L/PR:N). EPSS data not available, but POC publication significantly lowers exploitation barrier for opportunistic attacks against internet-exposed instances.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in /ajax.php?action=save_category. Public exploit code exists on GitHub (y1shiny1shin/vuldb-project), enabling immediate weaponization against unpatched systems. CVSS 7.3 reflects potential for confidentiality, integrity, and availability compromise through database manipulation. No remediation release identified at time of analysis.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via the ID parameter in /ajax.php?action=save_receiving. Publicly available exploit code (GitHub PoC) enables immediate weaponization. CVSS 7.3 reflects network-accessible attack with no authentication required, enabling confidentiality/integrity/availability impact across database operations. EPSS data not provided, but public exploit availability significantly elevates real-world risk for unpatched installations of this open-source PHP application.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to extract, modify, or delete database contents via the ID parameter in /ajax.php?action=save_sales endpoint. Publicly available exploit code exists (GitHub POC), enabling low-complexity attacks with no authentication barriers. EPSS data not available, but public exploit significantly lowers attacker skill threshold. CVSS 7.3 reflects network-exploitable vulnerability with moderate confidentiality, integrity, and availability impacts.
SQL injection in itsourcecode Courier Management System 1.0 via the ID parameter in /edit_parcel.php allows remote unauthenticated attackers to query, modify, or delete database contents. The CVSS 6.9 score reflects low confidentiality and integrity impact; however, the vulnerability is remotely exploitable with no authentication required and publicly available exploit code exists, making it a practical attack vector against exposed instances.
SQL injection in itsourcecode Courier Management System 1.0 allows remote unauthenticated attackers to execute arbitrary SQL commands via manipulation of the ID parameter in /edit_branch.php. The vulnerability has publicly disclosed exploit code available and affects confidentiality, integrity, and availability of the underlying database.
SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate the address parameter in /locations.php, enabling arbitrary database queries with confidentiality and integrity impact. Publicly available exploit code exists, increasing real-world risk despite the moderate CVSS score of 6.9.
SQL injection in itsourcecode Construction Management System 1.0 allows remote unauthenticated attackers to manipulate the code parameter in /execute1.php, enabling database query manipulation and potential data exfiltration or modification. Publicly available exploit code exists, increasing real-world risk despite the moderate CVSS score of 6.9.
SQL injection in itsourcecode Construction Management System 1.0 via the code parameter in /execute.php allows remote unauthenticated attackers to execute arbitrary SQL queries and potentially access or modify database contents. The vulnerability has a publicly available exploit and is confirmed to have a low confidentiality, integrity, and availability impact according to CVSS v4.0 scoring.
SQL injection in code-projects Inventory Management System 1.0 allows remote unauthenticated attackers to manipulate the Username parameter in the Login component, leading to unauthorized database access and potential data exfiltration. The vulnerability has a publicly available exploit and CVSS 6.9 score reflecting low confidentiality, integrity, and availability impact without scope expansion. EPSS data unavailable, but public exploit availability elevates practical risk.
Remote SQL injection in CodePanda Source canteen_management_system 1.0 allows unauthenticated attackers to manipulate the Username parameter in /api/login.php, enabling arbitrary database queries. Public exploit code is available. The vulnerability affects confidentiality and integrity with low impact scope, making it a practical attack vector for credential harvesting or data exfiltration from the canteen management database.
Stored cross-site scripting in ProjeQtor 7.0 through 12.4.3 allows authenticated attackers to upload HTML or HTM files via the image upload or attachment endpoints, bypassing the defective checkValidFileName() filter, and achieve arbitrary JavaScript execution in any victim's browser who subsequently accesses the uploaded file URL. The vulnerability affects a wide version range spanning five major releases. A publicly available proof-of-concept exists, though SSVC assessment and EPSS of 0.03% (9th percentile) indicate no confirmed real-world exploitation at time of analysis. No actively exploited status per CISA KEV.
Stored cross-site scripting in ProjeQtor 7.0 through 12.4.3 enables authenticated users to inject persistent malicious HTML payloads that execute in the browsers of other users viewing the affected content. The root cause is an incomplete pattern-based allowlist in the `checkValidHtmlText()` function within `Security.php`, which detects only specific dangerous constructs and returns unsanitized input without output encoding, allowing bypass via alternative syntax such as `<img>` tags with event handlers. No active exploitation has been confirmed in CISA KEV; however, a public proof-of-concept is available per VulnCheck, and EPSS at 0.03% (9th percentile) indicates low current automated exploitation activity.
Elevation of Privileges in Dell Alienware Command Center (AWCC) versions prior to 6.13.8.0 allows a local low-privileged attacker to gain full system access by exploiting a component that executes with unnecessarily elevated rights (CWE-250). The attack requires high complexity and user interaction (CVSS AV:L/AC:H/PR:L/UI:R), placing real-world exploitability well below the theoretical maximum despite the total technical impact assessed by SSVC. No public exploit exists and EPSS places this in the 2nd percentile, confirming no public exploitation activity at time of analysis. Dell has released a fix in AWCC 6.13.8.0.
Apache Storm's TlsTransportPlugin silently assigns the principal CN=ANONYMOUS to unauthenticated TLS clients when client certificate authentication is not enforced - the default configuration - allowing unauthenticated network principals to interact with Storm services wherever the authorizer does not explicitly deny anonymous access. The fail-open behavior stems from suppressing SSLPeerUnverifiedException rather than rejecting the connection, and the condition is logged at debug level only, leaving the bypass invisible in most production monitoring setups. No public exploit has been identified and EPSS is 0.04% (11th percentile), but SSVC rates the vulnerability as automatable with partial technical impact, meaning tooling could systematically probe exposed clusters for permissive authorizer configurations.
DOM-based cross-site scripting (XSS) in CodexThemes TheGem Theme Elements plugin for Elementor allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers when user interaction occurs. The vulnerability affects versions before 5.12.1.1 and requires authenticated access and user interaction to exploit, limiting real-world risk compared to network-vector XSS but still enabling session hijacking, credential theft, or unauthorized admin actions on WordPress sites using this plugin.
SQL Injection vulnerability exists in Sourcecodester Online Job Portal phppdo 1.0 ivia the category parameter in /jobportal/index.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial of service in MERCURY IP camera MIPC252W version 1.0.5 Build 230306 allows unauthenticated local attackers to trigger persistent authentication failure in the RTSP service by sending repeated requests with invalid Digest authentication parameters, preventing legitimate clients from authenticating and causing service unavailability.
Reflected XSS in diskover-community 2.3.5 and earlier allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser session by tricking an authenticated user into clicking a crafted URL with a malicious namecontains parameter targeting public/selectindices.php. A public proof-of-concept writeup exists on GitHub, though EPSS rates exploitation probability at 0.01% (1st percentile) and CISA has not added this to the Known Exploited Vulnerabilities catalog. SSVC confirms the exploit exists but flags the attack as non-automatable due to required user interaction, limiting realistic risk to targeted phishing scenarios.
Reflected XSS in diskover-community's public/view.php allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in the doctype parameter of a crafted URL. Affected versions are 2.3.5 and below of this PHP-based open-source file indexing application. A proof-of-concept exploit is confirmed per SSVC assessment, though EPSS sits at the 1st percentile and active exploitation has not been confirmed by CISA KEV, suggesting opportunistic rather than widespread targeting.
Reflected cross-site scripting (XSS) in WebFileSys 2.31.1 allows remote attackers to execute arbitrary JavaScript in victims' browsers via unencoded user input reflected into HTML and JavaScript contexts. Attack requires victim interaction (UI:R) but affects cross-site scope, enabling session hijacking, credential theft, or malware delivery. EPSS score of 0.01% indicates extremely low baseline exploitation probability despite public exploit code availability on GitHub.
Path traversal in CPython's `shutil.unpack_archive()` on Windows allows arbitrary file writes outside the intended extraction directory when processing ZIP archives containing Windows drive-letter absolute paths (e.g., `C:\...`, `D:\...`). The existing sanitization in `_unpack_zipfile()` rejected only Unix-style absolute paths (`/`) and directory traversal sequences (`..`), leaving Windows drive specifiers completely unchecked. No public exploit has been identified at time of analysis; EPSS of 0.05% (14th percentile) and SSVC exploitation status of 'none' indicate no observed exploitation, though the high integrity impact warrants patching in environments that process untrusted ZIP archives on Windows.
Improper ownership management in Moxa Secure Router allows low-privileged authenticated users to access exported configuration files containing hashed administrative passwords, enabling credential disclosure. The vulnerability is confined to scenarios where configuration files have been exported and requires valid user credentials to exploit; no impact to system integrity or availability has been identified.
Command injection in disler's aider-mcp-server allows remote unauthenticated attackers to execute arbitrary OS commands by supplying malicious input to the `relative_editable_files` argument in `src/aider_mcp_server/server.py`. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special conditions are required, and SSVC classifies exploitation as automatable with a public proof-of-concept already published. No vendor patch exists at time of analysis, as the maintainer has not responded to the coordinated disclosure filed in issue #16.
Command injection in D-Link DIR-822 A_101 udhcpd DHCP service allows remote unauthenticated attackers to execute arbitrary commands via a malicious Hostname parameter in DHCP requests. The vulnerability affects an end-of-life product with publicly disclosed exploit code available, creating significant risk for organizations unable to migrate away from legacy hardware.
OPPO Wallet APP contains a trusted domain validation bypass flaw that allows local attackers with user interaction to hijack account tokens and disclose sensitive information. The vulnerability affects all versions of OPPO Wallet APP and exploits improper domain verification in protected interface access controls, enabling token theft through local attack vector.
Uncaught exception in UERANSIM up to v3.2.7 allows remote unauthenticated attackers to crash the Radio Link Simulation (RLS) message decoder by sending a crafted PDU with an oversized or malformed pduLength field, causing denial of service against 5G simulation sessions. The SSVC framework marks this as automatable with a POC exploit available, though real-world impact is constrained to research and testing environments given the product's deployment profile. A vendor patch (v3.2.8) was released promptly after responsible disclosure, confirmed by the upstream GitHub release tag.
Path traversal in kaggle-mcp's `prepare_kaggle_dataset` function exposes the host filesystem to remote unauthenticated attackers via unsanitized `competition_id` input. Any deployment of this Model Context Protocol server at commit 406127ff or earlier is affected across all platforms. A publicly disclosed exploit exists and SSVC confirms the attack is automatable, meaning attackers can read, write, or partially disrupt arbitrary server files without credentials or user interaction; the maintainer has not responded to the coordinated disclosure issue filed on GitHub.
Server-side request forgery in ChatGPTNextWeb NextChat through version 2.16.1 allows remote unauthenticated attackers to make the server issue arbitrary HTTP requests by manipulating the ID parameter in the storeUrl function of the Artifacts Endpoint. A public proof-of-concept exists (GitHub Gist), and SSVC confirms the attack is automatable with no authentication required. No vendor patch is available; the project has not responded to responsible disclosure via GitHub issue #6741.
Server-side request forgery in AlejandroArciniegas mcp-data-vis allows unauthenticated remote attackers to cause the server to issue arbitrary outbound HTTP requests via the `axios`-based HTTP Request Handler in `src/servers/web-scraper/server.js`. Attackers can leverage this to probe internal network services, cloud metadata endpoints, or bypass perimeter controls from the server's network context. A public proof-of-concept exploit exists (SSVC: poc, Automatable: yes), though EPSS remains low at 0.04% (12th percentile), consistent with the tool's obscure deployment footprint.
Server-Side Request Forgery in dmitryglhf's mcp-url-downloader MCP server allows unauthenticated remote attackers to manipulate the url argument passed to the _validate_url_safe function, causing the server to issue arbitrary outbound HTTP requests on the attacker's behalf. The flaw exposes any internal network resources reachable by the host - including cloud instance metadata endpoints - to external actors with network access to the service. A public proof-of-concept has been disclosed (SSVC: poc, Automatable: yes); the vendor has not yet responded to responsible disclosure, and no patched release exists.
Denial of service in Linux kernel GPIO OMAP driver allows local authenticated users to crash the system via a deadlock condition triggered by improper driver registration from probe() callback. The vulnerability stems from registering the omap_mpuio_driver within omap_gpio_probe(), which violates driver core locking rules and creates a potential deadlock when device_lock enforcement was strengthened in commit dc23806a7c47. EPSS score of 0.03% reflects low exploitation probability despite availability of patched kernel versions.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /ajax.php?action=delete_category, enabling arbitrary SQL query execution with confidentiality and integrity impact. CVSS 6.9 reflects network accessibility and low privilege requirements; publicly available exploit code exists per description.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote unauthenticated attackers to manipulate the ID parameter in /ajax.php?action=save_type, enabling arbitrary SQL query execution with confidentiality and integrity impact. Publicly disclosed exploit code is available, significantly increasing real-world risk despite the moderate CVSS score of 6.9.
Denial of service in the Linux kernel EDAC (Error Detection and Correction) subsystem due to improper initialization ordering in edac_mc_alloc(). When memory allocation fails during EDAC memory controller initialization, the error path calls put_device() before device_initialize() is executed, triggering a null pointer dereference in kobject_put() that causes a kernel panic or system crash. This affects Linux systems with EDAC support enabled across multiple kernel versions from 5.19 through 7.0.
Indefinite deadlock in the Linux kernel's igb Gigabit Ethernet driver causes permanent TX queue stall when an AF_XDP zero-copy application is killed abruptly. Affected systems using Intel igb-family NICs (82575, 82576, I350) experience a hang in igb_down() because napi_synchronize() waits for NAPI_STATE_SCHED to clear - a state that igb_clean_rx_irq_zc() prevents from clearing by continuously returning the full NAPI budget after the XSK buffer pool is destroyed. The TX watchdog fires and the network interface becomes permanently unavailable until reboot. No public exploit has been identified (EPSS 0.02%, 4th percentile), and upstream patches are available in stable kernel branches 6.18.23, 6.19.13, and 7.0.
Use-after-free memory corruption in Foxit PDF Editor and Foxit PDF Reader allows local attackers to crash the application or execute arbitrary code by opening a crafted XFA PDF file during calculate event processing. The vulnerability requires user interaction (opening a malicious PDF) but impacts both products across all versions listed in CPE data. No public exploit code or active exploitation has been confirmed at this time.
Modal dialog reentry vulnerability in Foxit PDF Editor and Reader allows local attackers to trigger UI freeze and denial of service by supplying a crafted PDF document with a malicious action chain, requiring user interaction to open the file. The vulnerability stems from improper control flow management in document action handling and results in application unresponsiveness on the main thread. No public exploit code or active exploitation has been identified at the time of analysis.
Unhandled exception in Foxit PDF Editor and Foxit PDF Reader allows local denial of service when a user opens a maliciously crafted PDF file with insufficient parameter verification, causing the application to crash via an uncaught std::invalid_argument exception. The vulnerability requires user interaction (opening a file) and local file access but affects all versions of both products without authentication requirements.