Stored cross-site scripting in the Advanced Social Media Icons WordPress plugin through version 1.2 allows authenticated contributors and above to inject arbitrary JavaScript via insufficiently sanitized shortcode attributes, with execution occurring whenever any user views an affected page. The vulnerability affects all installations of the plugin up to and including version 1.2 and requires only Contributor-level WordPress access to exploit, making it a significant risk for multi-author sites.
Stored Cross-Site Scripting in Fancy Image Show plugin for WordPress up to version 9.1 allows authenticated contributors and above to inject arbitrary JavaScript via the `fancy-img-show` shortcode due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user viewing the affected page, affecting site integrity and potentially compromising administrative accounts. No public exploit code or active exploitation has been confirmed at time of analysis.
Stored Cross-Site Scripting in Scratchblocks for WP plugin for WordPress allows authenticated contributors and above to inject arbitrary JavaScript through the 'element' attribute of the 'scratchblocks' shortcode due to insufficient input sanitization and output escaping. The vulnerability affects all versions up to 1.0.1 and enables malicious scripts to execute in the browsers of all users viewing affected pages, with cross-site scope impact.
Stored Cross-Site Scripting in Credits Shortcode WordPress plugin up to version 1.2 allows authenticated contributors and above to inject arbitrary JavaScript via the 'link' attribute of the credits shortcode, which executes when other users view affected pages. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes. CVSS 6.4 reflects moderate risk with network vector and limited scope impact, though real-world risk depends on site contributor population and user awareness.
Stored Cross-Site Scripting in Voyage Plus WordPress plugin versions up to 1.0.6 allows authenticated contributors and above to inject malicious scripts via the 'class' attribute of the 'post-content' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users viewing affected pages, enabling credential theft, session hijacking, or malware distribution. No public exploit code or active KEV listing identified at time of analysis, but the vulnerability requires only contributor-level access and no user interaction, making it practical for insider threats or compromised contributor accounts.
Stored Cross-Site Scripting in Next Date WordPress plugin (all versions up to 1.0) allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'default' shortcode attribute due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, potentially compromising site visitors and administrators. No public exploit code or active exploitation has been identified at time of analysis.
SP Blog Designer plugin for WordPress versions up to 1.0.0 allows authenticated attackers with Contributor-level access to inject arbitrary web scripts via the 'design' attribute of the wpsbd_post_carousel shortcode, resulting in stored cross-site scripting (XSS) that executes for all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping in shortcode handling. No public exploit code or active exploitation has been confirmed at time of analysis.
Stored cross-site scripting in Quick Table plugin for WordPress allows authenticated contributors and above to inject malicious scripts via the 'style' attribute of the 'qtbl' shortcode, which execute when any user views the affected page. The vulnerability affects all versions up to 1.0.0 due to insufficient input sanitization and output escaping. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Bootstrap Shortcode plugin for WordPress allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages via the `box` shortcode, executing malicious scripts whenever users view affected pages. The vulnerability exists in all versions up to 1.0 due to insufficient input sanitization and output escaping. No public exploit code or active exploitation has been identified at this time.
Path traversal in Adobe Substance3D Designer 15.1.0 and earlier enables arbitrary file system reads when a victim opens a specially crafted malicious file. The vulnerability carries a scope change - the attacker can read files and directories outside the application's own data boundaries, potentially exposing OS-level sensitive content. No public exploit has been identified at time of analysis, EPSS sits at 0.02% (5th percentile), and CISA SSVC rates exploitation as none with non-automatable delivery, indicating limited real-world threat momentum despite the High confidentiality impact rating.
Missing authorization checks in SAP S/4HANA Condition Maintenance allow authenticated attackers to view and modify condition table records they should not have access to, compromising data confidentiality and integrity while potentially denying legitimate users access to those same records. The vulnerability requires valid user credentials but affects all versions of the affected module, with CVSS 6.3 reflecting its multi-faceted impact across three security dimensions.
Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables an authorized attacker with physical device access to execute arbitrary code, achieving full system compromise across a broad range of Windows 10, Windows 11, and Windows Server editions. Affected product versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, per EUVD-2026-29656 data. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.07% (22nd percentile) reflects the extremely low probability of widespread exploitation given the dual prerequisite of physical presence and high-privilege credentials.
Improper access control in M365 Copilot for Desktop (all versions before 19.2604.43111.0) enables a local attacker without system privileges to perform identity spoofing, resulting in high confidentiality impact with no integrity or availability consequences. The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires only local access - no authentication, elevated privileges, or user interaction is needed. No public exploit code has been identified; EPSS stands at 0.04% (12th percentile) and SSVC designates exploitation as 'none,' placing this firmly in the category of a patched but currently low-threat-activity vulnerability.
Denial-of-service in Adobe CAI Content Credentials versions 0.7.0 and earlier (and additionally 0.78.2 per the CVE description) stems from improper input validation (CWE-20) that allows a local unprivileged attacker to crash the application without requiring user interaction. The vulnerability carries a CVSS 6.2 base score with local attack vector and high availability impact, but no confidentiality or integrity compromise is possible. No public exploit has been identified, EPSS exploitation probability is 0.01%, and CISA SSVC reports exploitation status as none - placing this squarely in routine patch cycle territory.
Adobe CAI Content Credentials SDK versions 0.7.0 and earlier contain an improper input validation flaw that enables a local, unprivileged attacker to crash the application and cause a denial-of-service condition without any user interaction. The local attack vector (AV:L) confines exploitation to hosts where the SDK is installed and accepting input, which materially limits the threat surface despite the SSVC Automatable:yes classification. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.01% (1st percentile) confirms near-zero empirical exploitation probability.
Local denial-of-service in Adobe CAI Content Credentials SDK versions 0.7.0 and earlier (including 0.78.2) allows an attacker with local access to crash the application by supplying maliciously crafted input, triggering an improper input validation flaw (CWE-20). No user interaction is required to exploit the vulnerability, though exploitation is constrained to local attack vectors per the CVSS:3.1 AV:L designation. EPSS sits at 0.01% (1st percentile) and SSVC exploitation status is confirmed 'none', indicating no public exploit or active exploitation identified at time of analysis.
Improper input validation in Adobe's CAI Content Credentials SDK (versions 0.78.2 and 0.7.0 and earlier) allows a local attacker to crash the application by supplying malformed content credential data, resulting in a denial-of-service condition. The flaw requires no user interaction and no special privileges beyond local access to provide input to the application. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog, but SSVC flags exploitation as automatable once access is achieved.
Denial-of-service via improper input validation in Adobe's CAI Content Credentials SDK (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker to crash the application without requiring any privileges or user interaction. The root cause is CWE-20 (Improper Input Validation), meaning the SDK fails to adequately reject or sanitize malformed input before processing it. No active exploitation has been identified (SSVC: Exploitation none; EPSS: 0.01%), and impact is limited strictly to availability - there is no confidentiality or integrity exposure.
Improper input validation in Adobe CAI Content Credentials (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker to crash the application, producing a denial-of-service condition without requiring user interaction. The vulnerability stems from insufficient validation of attacker-supplied input processed by the SDK, classified under CWE-20. With an EPSS of 0.01% (1st percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is currently low, though SSVC notes the attack is automatable once local access is achieved.
Integer underflow in Adobe's CAI Content Credentials SDK (versions 0.7.0 and earlier, with version 0.78.2 also cited) allows an attacker supplying crafted credential payloads to crash the application, producing a denial-of-service condition. The vendor advisory APSB26-53 confirms no user interaction is required for exploitation, though the local attack vector (AV:L) means the malicious payload must reach the SDK through a local processing channel. EPSS sits at 0.01% and CISA SSVC reports exploitation status as none, indicating no public exploit activity at time of analysis.
Integer overflow in Adobe CAI Content Credentials SDK versions 0.78.2 and 0.7.0 and earlier allows a local attacker to crash the application, producing a denial-of-service condition without requiring any user interaction. The flaw is classified under CWE-190 and carries a CVSS 6.2 score with local attack vector, meaning exploitation requires the attacker to be operating in the same local environment as the affected application. No active exploitation has been identified (SSVC: Exploitation: none), and EPSS places this at the 0th percentile, indicating near-zero observed exploitation probability.
Uncontrolled resource consumption in Adobe CAI Content Credentials SDK (versions 0.7.0 and earlier, and 0.78.2) allows a local attacker without authentication to exhaust system resources, causing application-level denial of service. Rooted in CWE-400, the SDK imposes no sufficient limits on resource consumption when processing input, with the entire impact confined to availability - no confidentiality or integrity exposure exists. No public exploit code has been identified, EPSS sits at 0.01% (0th percentile), SSVC characterizes exploitation as 'none', and the vulnerability is absent from CISA's KEV catalog, collectively indicating low real-world exploitation probability at time of analysis.
Integer overflow in Adobe's CAI Content Credentials SDK (versions ≤0.7.0 per EUVD; version 0.78.2 also cited in NVD description) enables a local, unprivileged attacker to crash the application by supplying crafted input, producing a denial-of-service condition with no confidentiality or integrity exposure. The root cause is a CWE-190 integer wraparound flaw confined entirely to availability impact. No active exploitation has been reported: EPSS sits at the 0th percentile, CISA SSVC rates exploitation status as 'none', and no public exploit code or CISA KEV listing exists at time of analysis.
Uncontrolled resource consumption in Adobe CAI Content Credentials (versions 0.78.2, 0.7.0, and earlier) allows a local unprivileged attacker to exhaust system resources and crash the application. No user interaction is required, and the attack vector is local with no privilege prerequisites per the CVSS:3.1 vector. With an EPSS of 0.01% and SSVC exploitation status of none, this is currently a low-priority operational concern despite the high availability impact rating, though the SSVC automatable classification suggests the condition could be triggered programmatically once local access is available.
Integer underflow (CWE-191) in Adobe's CAI Content Credentials SDK versions 0.78.2 and 0.7.0 and earlier allows a local attacker to crash the application and cause a denial-of-service condition. No user interaction is required, and the SSVC assessment classifies the vulnerability as automatable, meaning reliable exploitation can be scripted. EPSS sits at 0.01% with SSVC exploitation status of 'none', and no active exploitation or public exploit code has been identified at time of analysis - real-world risk is correspondingly low despite the 'Automatable: yes' SSVC flag.
Uncontrolled resource consumption in Adobe CAI Content Credentials versions 0.78.2, 0.7.0 and earlier allows a local attacker without credentials to exhaust system resources and crash the application. The vulnerability (CWE-400) is limited to a denial-of-service impact with no confidentiality or integrity exposure. No public exploit code has been identified at time of analysis, and CISA SSVC records exploitation status as none, though the SSVC also rates the issue as automatable, suggesting that once triggered, the resource exhaustion path requires minimal attacker effort.
Reflected Cross-Site Scripting (XSS) in WP Google Maps Integration plugin for WordPress versions up to 1.2 allows unauthenticated attackers to inject arbitrary web scripts via the `page` parameter due to insufficient input sanitization and output escaping. Exploitation requires tricking an administrator into clicking a malicious link, but successful attacks can hijack admin sessions, modify site content, or steal credentials with medium attack complexity and limited immediate confidentiality and integrity impact.
Reflected Cross-Site Scripting in AzonPost WordPress plugin versions up to 1.3 allows unauthenticated attackers to inject arbitrary JavaScript via the `editpos_hidden` parameter, executing in the browsers of administrators who click malicious links. The vulnerability stems from insufficient input sanitization and output escaping, requiring user interaction but affecting all versions of the plugin without requiring authentication or special configuration.
Reflected Cross-Site Scripting in Pricing Tables for WP plugin allows unauthenticated attackers to inject arbitrary JavaScript via the 'page' parameter. The vulnerability affects all versions up to 1.1.0 due to insufficient input sanitization and output escaping. Exploitation requires social engineering (e.g., tricking an administrator into clicking a malicious link), but no public exploit code or active exploitation has been identified at time of analysis.
SAP Business Server Pages TAF_APPLAUNCHER contains a cross-site scripting vulnerability that allows unauthenticated attackers to craft malicious links redirecting users to attacker-controlled sites, potentially exposing or altering sensitive information. The vulnerability requires user interaction (clicking the link) and affects confidentiality and integrity with a CVSS score of 6.1. No active exploitation has been publicly confirmed at time of analysis.
Cross-Site Request Forgery (CSRF) in Tm - WordPress Redirection plugin for WordPress versions up to 1.2 allows unauthenticated attackers to update plugin settings and inject malicious web scripts by tricking a site administrator into clicking a malicious link. The vulnerability stems from missing or incorrect nonce validation on sensitive functions, enabling attackers to forge requests that execute administrative actions without the admin's explicit consent. CVSS score is 6.1 with network attack vector and low complexity, though exploitation requires user interaction (tricking administrator). No public exploit code or active exploitation has been identified at the time of analysis.
Stack overflow in Zephyr RTOS network stack allows local attackers to trigger a denial of service by issuing an ICMP ping to the device's own IPv4 address via the `net ping` shell command, causing recursive re-entry of the input path on the same work-queue stack and exhausting stack memory. The vulnerability requires local access and user interaction to execute the shell command, affecting systems with Zephyr network functionality enabled.
Command injection in Axis OS ACAP configuration file processing allows privilege escalation when unsigned ACAP applications are enabled and a user installs a malicious application. The vulnerability requires high-privileged user interaction and local access but bypasses normal code signing protections to achieve code execution with elevated privileges.
Zulip's message history API endpoint fails to enforce the `message_edit_history_visibility_policy` when set to 'moves', exposing full prior message text to low-privilege authenticated users via `/api/v1/messages/{id}/history`. Administrators who deliberately configured this policy to limit edit history visibility to move-events only will find that the underlying content is still recoverable through the API, bypassing the intended access control. No public exploit has been identified and EPSS is 0.04% (12th percentile), but the confidentiality impact is rated High in the CVSS 4.0 assessment for instances operating under this configuration.
Arbitrary file read and write on the Nomad client host is achievable through a symlink attack in HashiCorp Nomad's exec2 task driver prior to version 0.1.2. An attacker operating as the Nomad process user with high local privileges can exploit CWE-59 link-following behavior to redirect file operations outside the intended task sandbox, reading or writing arbitrary files on the underlying host. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, but the integrity impact is significant given the scope change to the host system.
Arbitrary file read and write on Nomad client hosts is possible through a symlink attack (CWE-59) affecting HashiCorp Nomad and Nomad Enterprise versions 0.9.0 through 1.x and 2.x prior to fixed releases. A local attacker operating with high privileges - such as a Nomad operator - can plant a malicious symlink that Nomad follows without proper validation, causing the Nomad process to read or write files outside its intended scope on the host filesystem, constituting a scope change per the CVSS vector (S:C). No public exploit exists and CISA has not added this to the KEV catalog; EPSS at 0.01% (1st percentile) and SSVC exploitation status of 'none' confirm this as low active-exploitation risk despite the scope change elevating CVSS to 6.0.
SQL injection in KACO Meteor server affecting all versions of blueplanet inverter product line allows authorized attackers on the local network to elevate privileges and modify system data. The vulnerability requires high-privilege credentials and abnormal configuration access (AC:H), limiting exploitation to insider threats or attackers who have already compromised administrative access. CVSS 6.0 with integrity and availability impact reflects significant risk within trusted network environments.
SSO login flow in Warpgate bastion host prior to 0.23.3 omits validation of the OAuth state parameter, enabling a cross-site request forgery attack that forces a victim to authenticate into the attacker's account instead of their own. Once logged in as the attacker, the victim may unknowingly write sensitive data to attacker-controlled SSH targets or interact with attacker-configured HTTP targets, resulting in high integrity impact with scope change. No confirmed active exploitation (not in CISA KEV), though SSVC assessment indicates a proof-of-concept exists; EPSS at 0.01% reflects low real-world exploitation probability at time of analysis.
Improper initialization in Intel UEFI firmware (Ring 0 / Bare Metal OS layer) enables information disclosure on some Intel platforms. A system software-level adversary already holding high privileges can exploit this flaw under high-complexity, prerequisite-dependent conditions to expose sensitive memory contents, with confidentiality impact rated high but no integrity or availability effect. No public exploit exists and EPSS sits at 0.01% (2nd percentile), and SSVC classifies exploitation status as none - signals that are mutually consistent and indicate this is a low-urgency finding for most organizations.
Null pointer dereference in the Windows LDAP (Lightweight Directory Access Protocol) component enables a low-privileged local attacker to crash the LDAP service, causing a denial of service on all affected Windows 10, Windows 11, and Windows Server releases. The vulnerability carries a CVSS 3.1 score of 5.5 with a strictly local attack vector (AV:L/PR:L), confining impact to availability only - no data exfiltration or code execution is possible. With EPSS at 0.04% (11th percentile), SSVC exploitation status of 'none,' no KEV listing, and no public exploit identified, real-world exploitation risk is currently low despite the enormous Windows install base.
Out-of-bounds read in the Windows Desktop Window Manager (DWM) Core Library exposes memory contents to a locally authenticated attacker on Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025. The flaw carries a CVSS score of 5.5 with high confidentiality impact but no integrity or availability consequence, making it a pure information disclosure primitive. No public exploit code has been identified and CISA SSVC marks exploitation status as none, with EPSS at 0.04% (11th percentile), indicating very low near-term exploitation probability.
Out-of-bounds read in Adobe Illustrator 29.8.6, 30.3 and earlier exposes sensitive process memory to disclosure when a victim opens a specially crafted file. The CVSS vector confirms a local-execution context with high confidentiality impact and no integrity or availability impact, consistent with a file-parser memory leak rather than code execution. No public exploit code or active exploitation has been identified at time of analysis, and EPSS at 0.02% (6th percentile) reflects minimal observed exploitation pressure.
Adobe Illustrator versions 29.8.6, 30.3 and earlier are vulnerable to a NULL Pointer Dereference (CWE-476) in file parsing that crashes the application, resulting in a denial-of-service condition. Exploitation requires a victim to open a specially crafted malicious file, making this a file-borne, local-vector threat with no code execution capability. No public exploit code exists and EPSS places exploitation probability at 0.01% (3rd percentile), consistent with the SSVC assessment of no active exploitation and non-automatable delivery.
Improper export of Android application components in Fortinet FortiToken Android 5.2, 6.1, and 6.2 allows local authenticated attackers to gain unauthorized access to sensitive information via exposed application components that lack proper access control. The vulnerability has a CVSS score of 5.0 with local attack vector and requires low privileges, enabling information disclosure without user interaction. No public exploit code has been identified, and the vulnerability is not listed in active exploitation databases at the time of analysis.
Improper input validation in an Axis OS configuration file allows authenticated SSH users to execute code and potentially escalate privileges. The vulnerability requires valid SSH credentials but affects all Axis OS versions, making it a significant risk for organizations running Axis network devices with SSH access exposed or shared credentials.
Out-of-bounds read in the Windows Telnet Client exposes memory contents and minor availability degradation to network-based attackers who control a Telnet server endpoint. Affected systems span Windows 10 (1607 through 22H2), Windows 11 (22H3 through 26H1), and Windows Server 2012 through 2025, all requiring user interaction to initiate a Telnet session against a malicious server. No public exploit identified at time of analysis and no active exploitation confirmed (not in CISA KEV); EPSS stands at 0.05% (16th percentile), reinforcing that real-world exploitation risk is low despite the broad platform footprint.
Privilege escalation via injection (CWE-74) in Microsoft Edge (Chromium-based) versions prior to 148.0.3967.55 allows an unauthenticated remote attacker to elevate privileges within the browser context through specially crafted content requiring user interaction. The attack is network-delivered at low complexity but carries only limited confidentiality and integrity impact (C:L/I:L), with scope remaining unchanged. No active exploitation is evidenced - EPSS sits at 0.04% (13th percentile) and SSVC reports exploitation status of none with non-automatable delivery.
Missing authorization in Broadstreet Ads WordPress plugin through version 1.52.2 allows authenticated users to bypass access controls and modify data, resulting in integrity and availability impact. The vulnerability stems from incorrectly configured access control security levels that fail to properly validate user permissions before executing sensitive operations. Exploitation requires valid user authentication but no special configuration or interaction.
Session persistence in HPE Aruba Networking Wireless Operating System (AOS-8) allows an attacker who has obtained valid user credentials to retain network access even after an administrator has disabled the associated account. The flaw affects AOS versions across the 8.10, 8.12, and 8.13 branches and stems from the platform's failure to invalidate active sessions upon credential revocation. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.03% at the 10th percentile, placing this squarely in the low-real-world-risk tier despite its medium CVSS score.
Stored cross-site scripting (XSS) in FluentCMS 1.2.3 File Management module allows authenticated administrators to upload SVG files with embedded malicious JavaScript that executes when any user-including unauthenticated visitors-accesses the image URL directly. The vulnerability has public proof-of-concept code available via GitHub pull request, and CISA SSVC framework confirms exploitability is feasible but requires user interaction and is not automatable. CVSS 5.4 reflects the attack complexity introduced by authentication requirement and user interaction, but the cross-origin scope and ability to affect multiple users elevates real-world risk.