Path traversal in ZMCPTools up to version 0.2.2 allows authenticated remote attackers to read or manipulate files outside intended directories via the dirname argument in the MCP Log Resource Handler component. The vulnerability is exploitable over the network by authenticated users with low privileges, has publicly available exploit code, and carries a CVSS score of 2.1 reflecting low confidentiality and integrity impact with no scope expansion.
Stored cross-site scripting in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows unauthenticated remote attackers to inject persistent malicious scripts via the student registration endpoint, which subsequently execute in the context of authenticated users - most critically, administrators - who view the submitted registration data. The exploit title in the public GitHub repository explicitly identifies the admin dashboard as the execution context, meaning a low-privilege registration action can target privileged session holders. No public exploitation confirmed in CISA KEV, but a proof-of-concept exploit is publicly available.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers to execute arbitrary SQL commands via the pid parameter in /admin/ajax.php?action=add_to_cart, potentially leading to unauthorized data access, modification, or deletion. The vulnerability has publicly available exploit code and may be actively exploited.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 enables low-privilege authenticated attackers to manipulate backend database queries via the unsanitized `id` parameter in the `delete_supplier` function at `/ajax.php?action=delete_supplier`. Exploitation yields partial confidentiality, integrity, and availability impact against the application database, consistent with the CVSS 4.0 VC:L/VI:L/VA:L scope. A public proof-of-concept is available on GitHub, though EPSS at 0.03% (8th percentile) and SSVC's 'not automatable' designation indicate negligible real-world exploitation pressure at this time; no CISA KEV listing exists.
SQL injection in SourceCodester Pharmacy Sales and Inventory System 1.0 permits a low-privileged authenticated remote attacker to manipulate the `ID` parameter in the `save_supplier` function at `/ajax.php?action=save_supplier`, enabling arbitrary SQL command execution against the backend database. A publicly available proof-of-concept exploit has been published on GitHub, though EPSS probability is extremely low at 0.03% (8th percentile) and SSVC rates both automatability and technical impact as limited, reflecting the narrow real-world deployment footprint of this educational PHP application. No active exploitation has been confirmed by CISA KEV.
Code injection in EyouCMS versions 1.7.0 through 1.7.9 allows authenticated administrators to execute arbitrary PHP code via the Template File Handler's editFile function in FilemanagerLogic.php, enabling remote code execution on the underlying server. All versions across the entire 1.7.x branch are affected, and a proof-of-concept exploit is publicly available on Gitee. This vulnerability is not listed in CISA KEV; EPSS at 0.04% and SSVC automatable:no reflect the high-privilege prerequisite that limits mass exploitation, though the public POC lowers the bar for targeted insider or credential-compromise attacks.
Unrestricted file upload in Pizzafy Ecommerce System 1.0 allows authenticated administrators to upload arbitrary PHP files via the `img` argument in the `save_menu` function of `/admin/admin_class_novo.php`, leading to remote code execution on the server. A public proof-of-concept on GitHub explicitly demonstrates the complete exploit chain from file upload to RCE. No public exploitation has been confirmed in CISA KEV, and EPSS at 0.03% reflects negligible real-world targeting, consistent with the product's obscure deployment footprint and the PR:H authentication barrier.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated remote attackers with high privileges to manipulate the save_user function in /admin/ajax.php via crafted input, enabling data exfiltration and modification. The vulnerability requires administrative credentials, has publicly available exploit code, and poses moderate risk (CVSS 4.7) primarily to systems where admin accounts are compromised or weak.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated admin users to manipulate the `id` GET parameter in `/admin/view_order.php`, executing arbitrary SQL queries against the backend database. A proof-of-concept exploit has been publicly disclosed on GitHub, though EPSS sits at just 0.03% (8th percentile) and no CISA KEV listing exists, indicating minimal observed exploitation activity. The CVSS 4.0 score of 2.0 with PR:H reflects the significant barrier of requiring valid admin credentials prior to exploitation.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege attackers to manipulate the save_menu function via the /admin/ajax.php endpoint, enabling database queries with limited confidentiality and integrity impact. The vulnerability requires administrative credentials and carries a moderate CVSS score of 4.7; publicly available exploit code exists but active exploitation at scale has not been confirmed.
SQL injection in SourceCodester Pizzafy Ecommerce System 1.0 allows authenticated high-privilege users to manipulate the save_settings function via the /pizzafy/admin/ajax.php endpoint, enabling database query modification with confidentiality, integrity, and availability impact. The vulnerability requires high-level authentication and is not remotely exploitable by unauthenticated attackers despite network-accessible endpoint; publicly available exploit code exists and the vulnerability has been disclosed.
Symlink following in NousResearch hermes-agent 0.8.0 allows local low-privileged users to bypass sensitive filesystem path protections and write to restricted system files. The `_check_sensitive_path` function in `tools/file_tools.py` validated only the fully-resolved real path, not the original expanded path, enabling bypass on platforms where system directories are themselves symlinks (e.g., macOS `/etc` → `/private/etc`). A publicly available PoC exists; no confirmed active exploitation (not in CISA KEV), and the CVSS 4.0 score of 1.9 with EPSS at the 2nd percentile indicates low real-world risk.
CSRF in Admidio's preferences module (versions ≤ 5.0.8) enables a remote attacker to trick an authenticated administrator into triggering sensitive server-side operations - database backup generation, .htaccess file overwriting, and test email dispatch - by luring them to a single malicious webpage. These state-changing operations are handled via unprotected GET requests in modules/preferences.php, and SameSite=Lax browser cookie behavior allows session cookies to travel on top-level cross-origin navigations, making exploitation trivial with a JavaScript redirect. A working proof-of-concept is published in the GitHub security advisory; there is no CISA KEV entry and EPSS stands at 0.01%, consistent with opportunistic rather than mass exploitation.
Cache poisoning in Spring Framework's static resource handler allows network-accessible unauthenticated attackers to corrupt the resource cache with wrongly-encoded content, causing a denial of service for clients consuming the front-end. Affected are Spring MVC and Spring WebFlux applications across Spring Framework 5.3.x, 6.1.x, 6.2.x, and 7.0.x that explicitly configure the resource chain with both caching and encoded resource resolution enabled. No public exploit exists and no active exploitation has been identified; EPSS at 0.06% (17th percentile) and SSVC exploitation rating of 'none' confirm very low real-world risk at this time.
Admidio members_assignment_data.php endpoint leaks hidden profile field values through a blind search oracle attack. Role leaders with ROLE_LEADER_MEMBERS_ASSIGN permissions can infer exact values of hidden PII fields (birthdays, street addresses, cities, postal codes, countries) by observing which users appear in search results, despite these fields being suppressed from JSON output. The vulnerability affects Admidio versions up to 5.0.8 and is fixed in 5.0.9.
Stored or reflected cross-site scripting in SourceCodester Pharmacy Sales and Inventory System 1.0 allows remote low-privileged attackers to inject malicious JavaScript via the Name parameter of the Customer function at /index.php?page=customer. A public proof-of-concept exploit is confirmed via GitHub and VulDB, but the CVSS 4.0 score of 2.0 and EPSS of 0.03% (9th percentile) reflect the constrained exploitation conditions: authentication and victim interaction are both required. No KEV listing indicates no confirmed active exploitation at time of analysis.