PackageManagerService on Samsung Mobile Devices running Android 14, 15, and 16 allows local attackers without elevated privileges to bypass application installation restrictions by exploiting insufficient verification of data authenticity. The affected component fails to adequately validate the integrity of data governing app installation policies, enabling unauthorized modification of those restrictions on unpatched devices. No public exploit code has been identified and SSVC rates exploitation as none, but the impact is significant in enterprise MDM and parental-control deployments where installation restrictions are an active security control.
Admidio's OIDC SSO module (versions ≤ 5.0.8) ships stub placeholder implementations for both token introspection and token revocation that unconditionally return success responses without performing any validation, enabling any attacker to fabricate a bearer token and gain unauthorized access to all resource servers federated through Admidio as their OIDC provider. The introspection handler in `src/SSO/Service/OIDCService.php` (lines 604-619) is marked `// TODO_RK` and bypasses all three mandatory RFC 7662 requirements - resource server authentication, token database validation, and returning `active:false` for invalid tokens. A public proof-of-concept using simple curl commands is included in the GitHub Security Advisory GHSA-9xx5-cv6j-x533; no CISA KEV listing exists and EPSS sits at 0.04%, reflecting the product's niche footprint rather than low attack difficulty.
Local denial-of-service in Netskope Client's Endpoint DLP Module on Windows allows an unprivileged local user to crash the operating system via a kernel-level out-of-bounds read in a driver, producing a Blue-Screen-of-Death. Exploitation requires the Endpoint DLP module to be active in the client configuration, limiting the exposed population to deployments where that feature is intentionally enabled. No public exploit code exists and no active exploitation has been identified; EPSS is 0.01% and SSVC rates exploitation as none, consistent with the local-only attack vector.
Path traversal in SonicWall SonicOS enables authenticated attackers on adjacent networks to access services that are normally restricted to privileged system internals. Affecting multiple SonicOS branches (6.x, 7.0.x, 7.3.x, 8.x), successful exploitation can result in high availability impact alongside limited confidentiality and integrity gains, per the CVSS impact metrics. No public exploit code has been identified and CISA SSVC confirms exploitation status as none, with EPSS at 0.01% (2nd percentile), indicating negligible in-the-wild exploitation pressure at time of analysis.
Local privilege escalation in Acronis DeviceLock DLP on Windows (all builds before 9.0.93212) is achievable via DLL hijacking, granting an attacker full confidentiality, integrity, and availability impact over the affected system. Exploitation requires a low-privileged local account, high attack complexity, and user interaction - all factors that meaningfully constrain real-world exploitability despite the severe potential impact. No public exploit code and no active exploitation have been identified at time of analysis; EPSS at 0.01% (3rd percentile) and SSVC Exploitation status of 'none' both confirm negligible mass-exploitation probability.
CKAN fails to validate SMTP server certificates, allowing attackers to spoof the configured mail server with any certificate including self-signed ones and intercept SMTP credentials and email content via man-in-the-middle attack. Versions below 2.10.10 and 2.11.0 through 2.11.4 are affected. Vendor-released patches are available in CKAN 2.10.10 and 2.11.5.
Cockpit CMS versions 2.13.5 and earlier allow authenticated attackers to write files to arbitrary locations within the uploads directory or overwrite assets via directory traversal in the Buckets component. The vulnerability requires valid user authentication and does not impact confidentiality, but enables integrity compromise through malicious file placement or asset replacement. A proof-of-concept exists, though the SSVC framework rates automatable exploitation as unlikely, suggesting manual attack steps are required.
Stack-based buffer overflow in wazuh-remoted's print_hex_string() function exposes Wazuh 4.8.0 through 4.14.3 to unauthenticated remote exploitation via TCP/1514, reachable before any agent authentication logic executes. The overflow stems from a C signed-char sign-extension defect where bytes ≥ 0x80 are rendered as 8-character hex strings instead of 2, overflowing a fixed 2049-byte stack buffer; a secondary unauthenticated path independently enables remote log amplification capable of exhausting disk and I/O on the monitoring host. No public exploit has been confirmed as actively exploited (not in CISA KEV), though SSVC assesses a proof-of-concept exists and the attack is automatable at scale.
Wazuh's server API brute-force protection on POST /security/user/authenticate is bypassable via concurrent request flooding in versions 4.0.0 through 4.14.3, allowing unauthenticated remote attackers to submit substantially more credential guesses than the configured max_login_attempts policy (default: 50) permits. The race condition in the IP-block enforcement logic processes parallel HTTP bursts before the counter triggers a block, effectively multiplying password guessing capacity - for example, processing 100 attempts where only 50 should be permitted. No public exploit is confirmed in KEV, but SSVC classifies exploitation status as POC and automatable, while EPSS at 0.05% (14th percentile) indicates limited observed in-the-wild activity. Vendor-released patch version 4.14.4 resolves the issue.
Path traversal in Admidio ecard_preview.php allows authenticated users to read arbitrary server files including database credentials by bypassing filename validation on the ecard_template POST parameter. An authenticated attacker can supply path traversal payloads such as ../config.php to read adm_my_files/config.php containing unencrypted database host, username, and password, or traverse further to access system files. Exploitation requires only a regular member account with no special privileges, making this a high-impact vulnerability accessible to any registered user.
Heap buffer underwrite vulnerabilities in Wazuh Manager's remoted component allow an authenticated agent to corrupt the manager process heap, causing denial of service and potential code execution. Wazuh versions 4.0.0 through 4.14.3 are affected across all platforms where the manager role is deployed. A public proof-of-concept exists per SSVC data, though EPSS remains very low at 0.04% (12th percentile) and the vulnerability has not been confirmed as actively exploited in CISA KEV, suggesting exploitation is feasible but has not yet reached widespread use.
WP User Frontend plugin for WordPress (versions through 4.3.1) exposes a Missing Authorization flaw that allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, resulting in limited integrity and availability impact. Reported by Patchstack and tagged as an authentication bypass, the vulnerability stems from the plugin's failure to verify user authorization before permitting certain privileged actions on WordPress frontends. No active exploitation has been confirmed (not in CISA KEV) and EPSS probability is very low at 0.04%, though SSVC classifies it as automatable - meaning exploitation, once scripted, requires no manual interaction per target.
Unsafe deserialization in Jenkins Matrix Authorization Strategy Plugin versions 2.0-beta-1 through 3.2.9 allows an authenticated user with Item/Configure permission to instantiate arbitrary Java classes from the Jenkins classpath by specifying class names in job configuration. The vulnerability arises because the plugin invokes parameterless constructors of user-specified classes when deserializing inheritance strategies without type restriction. No public exploit is identified at time of analysis, and SSVC signals exploitation as none, but the real-world impact depends on the richness of the Jenkins classpath - gadget classes available in that environment determine the attacker's effective reach.
Disk exhaustion via undeleted temp files in Spring WebFlux multipart processing affects all actively maintained Spring Framework branches, allowing an authenticated remote attacker to consume available disk space on the host. Affected branches span 5.3.x, 6.1.x, 6.2.x, and 7.0.x, with fixed releases available for all. No public exploit exists and EPSS sits at the 9th percentile, but the network-accessible attack surface and potential for cascading host-level impact make this a meaningful availability risk for any Spring WebFlux deployment that handles multipart uploads.
Admidio inventory module allows any authenticated user to permanently delete inventory items and modify associated data by bypassing authorization checks present only in the UI layer. The backend handlers for item_delete, item_retire, item_reinstate, and picture operations validate CSRF tokens but never verify the requesting user is an inventory administrator, enabling destructive operations on any item visible to the user. This affects Admidio versions through 5.0.8, and no active exploitation has been reported at the time of analysis.
n8n Chat Trigger's Hosted Chat feature fails to verify WebSocket connection authorization on the /chat endpoint, allowing unauthenticated remote attackers to hijack workflow executions in waiting state by obtaining the execution ID, intercept intended user prompts, and submit arbitrary input to influence downstream workflow behavior. This affects instances configured with authentication set to None. Vendor-released patches: versions 1.123.32, 2.17.4, and 2.18.1. No public exploit code identified at time of analysis.
Arbitrary file write via symlink following in Dell/Alienware Purchased Apps (versions prior to 1.1.31.0) allows a local low-privileged attacker to redirect application file operations to unintended targets, potentially overwriting sensitive system files and causing integrity or availability damage. The high attack complexity (AC:H) indicates a race condition or precise timing requirement, limiting opportunistic exploitation. No active exploitation has been identified - SSVC assessment rates exploitation as none and the vulnerability is absent from CISA KEV - though successful exploitation could yield significant local impact.
Stored Cross-Site Scripting in WP Meteor Website Speed Optimization Addon for WordPress (all versions through 3.4.16) allows unauthenticated attackers to permanently inject arbitrary JavaScript into pages via the WPMETEOR[N]WPMETEOR placeholder processed by the frontend_rewrite function. The injected script executes in the browser of any user who subsequently visits the compromised page, enabling session hijacking, credential theft, or malicious redirects. No active exploitation is confirmed (SSVC: none; EPSS 0.07%, 21st percentile), though unauthenticated stored XSS with a scope change carries meaningful real-world risk on publicly accessible WordPress sites.
Reflected cross-site scripting (XSS) in Admidio's msg_window.php endpoint allows unauthenticated attackers to execute arbitrary JavaScript in any user's browser by exploiting incomplete output encoding. The vulnerability chains htmlspecialchars() (which does not encode square brackets) with a subsequent Language::prepareTextPlaceholders() call that converts brackets to angle brackets, producing executable HTML markup. Publicly available proof-of-concept demonstrates the attack requires only victim click (no authentication), and Admidio sets no Content-Security-Policy headers to block inline script execution.
Path traversal in ZMCPTools up to version 0.2.2 allows authenticated remote attackers to read or manipulate files outside intended directories via the dirname argument in the MCP Log Resource Handler component. The vulnerability is exploitable over the network by authenticated users with low privileges, has publicly available exploit code, and carries a CVSS score of 2.1 reflecting low confidentiality and integrity impact with no scope expansion.
Stored cross-site scripting in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows unauthenticated remote attackers to inject persistent malicious scripts via the student registration endpoint, which subsequently execute in the context of authenticated users - most critically, administrators - who view the submitted registration data. The exploit title in the public GitHub repository explicitly identifies the admin dashboard as the execution context, meaning a low-privilege registration action can target privileged session holders. No public exploitation confirmed in CISA KEV, but a proof-of-concept exploit is publicly available.
Reflected cross-site scripting in WSO2 Identity Server's authentication endpoint allows remote unauthenticated attackers to inject arbitrary JavaScript into victims' browsers by luring them to click a crafted URL. Versions 7.1.0 prior to 7.1.0.28 are confirmed affected; a vendor patch is available. While the attack can enable browser redirection, UI manipulation, and theft of browser-accessible data, the explicit use of the httpOnly flag on session cookies prevents session hijacking, partially constraining real-world impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places exploitation probability at 0.03%.
Stored cross-site scripting in OpenNebula v6.10.0.1 allows an attacker to persist a malicious payload inside the virtual network template parameter, which then executes in the browser of any user who views the affected template. The Changed scope (S:C) in the CVSS vector confirms the injected script runs in the victim's browsing context, enabling session theft, credential harvesting, or UI redressing against platform administrators. A public proof-of-concept is confirmed by SSVC data; exploitation is not confirmed in CISA KEV, and the EPSS score of 0.03% (8th percentile) indicates low observed exploitation activity despite the POC's existence.
Stored cross-site scripting in OpenNebula 6.10.0.1 allows attackers to inject persistent malicious scripts via the user information parameter, which subsequently execute in the browsers of any user who views the affected content. The scope change in the CVSS vector (S:C) reflects that execution escapes the application's trust boundary into victims' browser sessions, enabling session hijacking or unauthorized UI actions. A proof-of-concept is publicly available on GitHub (SSVC confirms exploitation status as poc), though EPSS at 0.03% (8th percentile) and SSVC's non-automatable classification indicate this has not seen broad opportunistic exploitation.
Reflected cross-site scripting in OpenNebula 6.10.0.1 allows unauthenticated remote attackers to inject arbitrary JavaScript into the zone attribute parameter of the web management interface, executing in the security context of a victim user's browser session upon interaction. A public proof-of-concept exploit exists on GitHub, confirmed by SSVC classification of 'poc'. EPSS probability sits at 0.03% (8th percentile), indicating low observed exploitation activity, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in OpenNebula v6.10.0.1's custom authenticator driver enables unauthenticated remote attackers to inject arbitrary JavaScript or HTML into victims' browsers via a crafted payload delivered through the authentication interface. A public proof-of-concept exploit exists (SSVC exploitation: poc, GitHub PoC referenced), though EPSS at 0.03% indicates minimal current exploitation activity and CISA KEV listing is absent. Because the vulnerable component is the authenticator driver - the portal login surface - successful exploitation could facilitate session token theft or credential phishing targeting cloud administrators, making impact disproportionate to the Medium CVSS score in privileged-user scenarios.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the pid parameter in /admin/ajax.php?action=add_to_cart, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has publicly available exploit code and may be actively exploited.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 enables low-privilege authenticated attackers to manipulate backend database queries via the unsanitized `id` parameter in the `delete_supplier` function at `/ajax.php?action=delete_supplier`. Exploitation yields partial confidentiality, integrity, and availability impact against the application database, consistent with the CVSS 4.0 VC:L/VI:L/VA:L scope. A public proof-of-concept is available on GitHub, though EPSS at 0.03% (8th percentile) and SSVC's 'not automatable' designation indicate negligible real-world exploitation pressure at this time; no CISA KEV listing exists.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 permits a low-privileged authenticated remote attacker to manipulate the `ID` parameter in the `save_supplier` function at `/ajax.php?action=save_supplier`, enabling arbitrary SQL command execution against the backend database. A publicly available proof-of-concept exploit has been published on GitHub, though EPSS probability is extremely low at 0.03% (8th percentile) and SSVC rates both automatability and technical impact as limited, reflecting the narrow real-world deployment footprint of this educational PHP application. No active exploitation has been confirmed by CISA KEV.
Heap buffer overflow in FreeRTOS-Plus-TCP's IPv6 Router Advertisement parser allows an unauthenticated adjacent network actor to corrupt device memory by sending a crafted RA packet containing an oversized prefix length field exceeding the 128-bit maximum valid for IPv6. Affected versions span two branches: 4.0.0-4.2.5 and 4.3.0-4.4.0, with fixes released as V4.2.6 and V4.4.1 respectively. No public exploit code has been identified, EPSS stands at 0.01% (3rd percentile), and SSVC confirms no active exploitation - making this a patch-priority issue rather than an emergency response.
CKAN versions 2.10.0 through 2.10.9 and 2.11.0 through 2.11.4 allow unauthenticated requests to permanently disable CSRF protection on endpoints for the lifetime of the server process by triggering a state mutation in the flask-wtf CSRFProtect middleware. Combined with cross-site scripting, an attacker can exploit this to perform authenticated actions using other users' credentials. The vulnerability affects network-accessible CKAN instances with default configurations and has CVSS 6.1 with user interaction required.
Stored XSS in the beets music library web UI (versions prior to 2.10.0) allows arbitrary JavaScript execution in a victim's browser when metadata fields such as title, lyrics, or comments contain attacker-controlled HTML payloads. The flaw stems from Underscore.js raw template interpolation (`<%= ... %>`) feeding untrusted metadata directly into jQuery's `.html()` DOM insertion method in `beetsplug/web/static/beets.js`. No active exploitation is confirmed - SSVC rates exploitation as none and EPSS sits at 0.05% (14th percentile) - but the attack is persistent once metadata is poisoned and does not require repeated attacker access.
Code injection in EyouCMS versions 1.7.0 through 1.7.9 allows authenticated administrators to execute arbitrary PHP code via the Template File Handler's editFile function in FilemanagerLogic.php, enabling remote code execution on the underlying server. All versions across the entire 1.7.x branch are affected, and a proof-of-concept exploit is publicly available on Gitee. This vulnerability is not listed in CISA KEV; EPSS at 0.04% and SSVC automatable:no reflect the high-privilege prerequisite that limits mass exploitation, though the public POC lowers the bar for targeted insider or credential-compromise attacks.
Insecure Direct Object Reference (IDOR) in n8n's public API variables endpoint allows authenticated users with variable:list API key scope to read project variables from any project regardless of membership by manipulating the projectId query parameter. The API handler bypassed project membership authorization checks present in the enterprise service layer, enabling cross-project secret disclosure. This affects only licensed enterprise or team deployments with multiple projects and variables feature enabled. Vendor-released patches: versions 1.123.32, 2.17.4, and 2.18.1.
Unrestricted file upload in Pizzafy Ecommerce System 1.0 allows authenticated administrators to upload arbitrary PHP files via the `img` argument in the `save_menu` function of `/admin/admin_class_novo.php`, leading to remote code execution on the server. A public proof-of-concept on GitHub explicitly demonstrates the complete exploit chain from file upload to RCE. No public exploitation has been confirmed in CISA KEV, and EPSS at 0.03% reflects negligible real-world targeting, consistent with the product's obscure deployment footprint and the PR:H authentication barrier.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers with high privileges to manipulate the save_user function in /admin/ajax.php via crafted input, enabling data exfiltration and modification. The vulnerability requires administrative credentials, has publicly available exploit code, and poses moderate risk (CVSS 4.7) primarily to systems where admin accounts are compromised or weak.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated admin users to manipulate the `id` GET parameter in `/admin/view_order.php`, executing arbitrary SQL queries against the backend database. A proof-of-concept exploit has been publicly disclosed on GitHub, though EPSS sits at just 0.03% (8th percentile) and no CISA KEV listing exists, indicating minimal observed exploitation activity. The CVSS 4.0 score of 2.0 with PR:H reflects the significant barrier of requiring valid admin credentials prior to exploitation.
Denial of service via crafted ICMPv6 Router Advertisement in FreeRTOS-Plus-TCP affects embedded devices running versions 4.0.0-4.2.5 and 4.3.0-4.4.0, crashing the device when a truncated PREFIX_INFORMATION option triggers an out-of-bounds read in the IPv6 RA parser. An adjacent-network attacker with no privileges or user interaction can repeatedly crash affected IoT/embedded devices, causing persistent availability loss. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.01% (3rd percentile), but vendor-confirmed patches exist for both affected branches.
Integer underflow in FreeRTOS-Plus-TCP's ICMP and ICMPv6 echo reply handlers enables an adjacent network attacker to crash any affected embedded or IoT device that has outgoing ping support enabled. The flaw spans two active release branches - 4.0.0 through 4.2.5 and 4.3.0 through 4.4.0 - and can trigger a heap out-of-bounds read of up to approximately 65KB, resulting in device denial of service. No public exploit has been identified and EPSS sits at 0.01% (3rd percentile), but the impact on resource-constrained embedded devices can be severe given their limited fault tolerance.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege attackers to manipulate the save_menu function via the /admin/ajax.php endpoint, enabling database queries with limited confidentiality and integrity impact. The vulnerability requires administrative credentials and carries a moderate CVSS score of 4.7; publicly available exploit code exists but active exploitation at scale has not been confirmed.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege users to manipulate the save_settings function via the /pizzafy/admin/ajax.php endpoint, enabling database query modification with confidentiality, integrity, and availability impact. The vulnerability requires high-level authentication and is not remotely exploitable by unauthenticated attackers despite network-accessible endpoint; publicly available exploit code exists and the vulnerability has been disclosed.
Unbounded HTTP response buffering in OpenTelemetry.Resources.Azure (NuGet, versions ≤ 1.15.0-beta.1) allows an attacker who controls or can MitM the Azure VM Instance Metadata Service endpoint at http://169.254.169.254 to cause heap exhaustion and crash the consuming .NET process via OutOfMemoryException. The AzureVmMetaDataRequestor class calls HttpClient.GetStringAsync() with no response-size limit, meaning an adversarial IMDS response of arbitrary size is fully buffered into managed memory before deserialization. No public exploit exists and EPSS is 0.04%, but the DoS impact is process-terminating if the MitM prerequisite can be satisfied.
Stored XSS in StellarWP's Image Widget WordPress plugin (all versions through 4.4.11) allows a high-privileged attacker to plant persistent malicious JavaScript into widget configuration fields, which then executes in the browsers of any visitor loading pages that render the widget. The CVSS scope-change indicator (S:C) confirms the payload crosses from the admin backend into the victim's browser context. No public exploit code or active exploitation has been observed; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate negligible current threat activity.
Symlink following in NousResearch hermes-agent 0.8.0 allows local low-privileged users to bypass sensitive filesystem path protections and write to restricted system files. The `_check_sensitive_path` function in `tools/file_tools.py` validated only the fully-resolved real path, not the original expanded path, enabling bypass on platforms where system directories are themselves symlinks (e.g., macOS `/etc` → `/private/etc`). A publicly available PoC exists; no confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 score of 1.9 with EPSS at the 2nd percentile indicates low real-world risk.
Roadiz OpenID Connect authentication fails to store and validate the nonce parameter, allowing attackers to replay valid ID tokens or inject tokens from compromised identity providers to impersonate users. The package generates a nonce during authorization request initiation but never validates the returned nonce claim in the ID token, violating OIDC Core 1.0 specification requirements. Publicly available proof-of-concept demonstrates token replay within the token's validity window, affecting all Roadiz applications using the roadiz/openid package versions before 2.7.18, 2.6.31, 2.5.45, or 2.3.43.
SQL injection in EyouCMS versions 1.7.0 through 1.7.9 allows remote unauthenticated attackers to manipulate database queries by passing malicious input via the sort_asc argument to the GetSortData function in application/common.php. A public proof-of-concept has been disclosed on Gitee, and SSVC classifies the attack as automatable with partial technical impact, though EPSS remains very low at 0.03% (8th percentile), indicating limited observed mass exploitation. No vendor patch exists - the project was notified via responsible disclosure but has not responded, leaving all 1.7.x deployments exposed.
Server-Side Request Forgery in the ILLID Share This Image WordPress plugin (all versions through 2.14) allows unauthenticated remote attackers to induce the WordPress server to issue arbitrary HTTP requests to internal or external destinations, potentially exposing internal network topology and services. The scope-changed CVSS vector (S:C) confirms that exploitation can extend impact beyond the vulnerable WordPress instance to backend systems reachable by the server. No public exploit code has been identified and SSVC assessment classifies exploitation as none at time of analysis, placing real-world urgency below the raw CVSS 5.4 score suggests.
MongoDB Server's user management command contains an authorization flaw allowing authenticated low-privilege users to make limited modifications to authentication-related data belonging to other user accounts. Affected across three active release branches (7.0.x, 8.0.x, 8.2.x), this could allow one MongoDB user to interfere with how authentication is processed for another account - a form of limited horizontal privilege escalation. No public exploit exists and SSVC confirms no observed exploitation, but the network-accessible attack vector and low authentication requirement warrant timely patching in multi-tenant or shared MongoDB environments.
Denial of Service in Spring Framework's static resource serving affects Spring MVC and Spring WebFlux applications running on Windows, where crafted HTTP requests trigger abnormally slow Windows file system resolution, exhausting HTTP connection pools. Affected branches span 5.3.x through 7.0.x; fixed versions are available from VMware/Spring. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.05% at the 16th percentile, and SSVC rates exploitation as 'none' - but the attack is automatable and unauthenticated, making it meaningful for any qualifying Windows Spring deployment.
SQL injection in n8n's SeaTable node allows remote unauthenticated attackers to bypass row-level access controls and retrieve unintended data from SeaTable databases when workflows accept user-controlled input via expressions in search or row retrieval parameters. The vulnerability affects n8n versions before 1.123.32, 2.17.4, and 2.18.1, and requires specific workflow configuration combining the SeaTable node with external user input passed through expressions. No public exploit code or active exploitation has been confirmed at time of analysis.