Authentication bypass in Relay Server 0.9.0-0.9.6 (the real-time collaboration backend for the Obsidian Relay plugin) lets unauthenticated network attackers read and modify synced documents. When authentication is enabled, the multi-document WebSocket endpoints incorrectly treated connections lacking a token query parameter as fully privileged, so anyone who knows or guesses a document ID can join the sync session without a valid document token. Publicly available exploit code exists per SSVC (POC), but EPSS is very low (0.04%) and it is not listed in CISA KEV, so there is no confirmed active exploitation.
Two-factor authentication bypass in Pingvin Share X (self-hosted file sharing) versions 1.14.1 through 1.16.2 lets an attacker who already possesses a victim's valid username and password skip the TOTP second-factor challenge entirely, defeating the primary purpose of 2FA and granting full account access. CVSS is rated 9.1 (High/Critical), but EPSS is only 0.04% (13th percentile) and there is no public exploit identified at time of analysis, and it is not on CISA KEV. The fix landed in 1.16.3.
Insecure Direct Object Reference (IDOR) in WHMCS lets a logged-in client area user access another customer's addon services and linked cPanel account by supplying a victim's `addonId` to `clientarea.php`, which never validates resource ownership. Affected releases span WHMCS 7.4.0 through 8.12.2, 8.13.0 before 8.13.3, and 9.0.0 before 9.0.4; a vendor patch is available. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and it is not on CISA KEV.
Unauthenticated remote attackers can completely destroy the mem0 v1.0.0 memory database by sending a DELETE request to the /memories endpoint, which executes DROP TABLE SQL statements without authentication or authorization checks. This causes irreversible data loss and total service denial for all users. EPSS score of 0.03% suggests low observed exploitation probability despite the CVSS 9.1 critical rating, likely due to mem0's limited deployment footprint. No public exploit code or active exploitation (CISA KEV) confirmed at time of analysis, but SSVC indicates the vulnerability is automatable with a single HTTP request.
Authorization bypass in Apache Tomcat (versions 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.117, 10.1.0-M1-10.1.54, and 11.0.0-M1-11.0.21) lets remote unauthenticated attackers reach protected resources when multiple security-constraint elements define an HTTP method for the same URL extension, causing method constraints to be misapplied. Per CVSS PR:N the flaw is exploitable without authentication, yielding high confidentiality and integrity impact but no availability impact (C:H/I:H/A:N). There is no public exploit identified at time of analysis; EPSS is very low (0.02%) and CISA SSVC records exploitation status as none, though the impact is rated total and the issue is automatable.
Authentication bypass in Pandora FMS versions 777-800 allows remote attackers to gain unauthorized API access via insecure default resource initialization. The vulnerability stems from CWE-1188 (default credentials or configuration), enabling attackers to bypass authentication mechanisms and access the API with high confidentiality and integrity impact. CVSS 4.0 scores this at 9.1 CRITICAL due to network attack vector requiring no privileges or user interaction, though attack complexity is high and specific timing conditions apply (AT:P). No CISA KEV listing or public POC identified at time of analysis, suggesting exploitation requires vendor-specific knowledge of the insecure defaults.
Man-in-the-middle attacks against Kura Sushi Official App for Android and iOS allow complete interception and modification of push notification traffic due to improper SSL/TLS certificate validation. Attackers on the network path between the mobile app and EPG's notification server can read confidential data (VC:H) and inject arbitrary notifications or commands (VI:H) without authentication or user interaction. The vulnerability affects both Android and iOS versions of the official ordering app from Japanese restaurant chain Kura Sushi. EPSS and KEV data not available; exploitation requires network position but no special credentials or app configuration.
Authentication-layer injection in OX Dovecot Pro (versions up to and including 2.4.3 and 3.1.4) arises from a flaw in the 'safe' template filter: when 'safe' is applied during variable expansion, every subsequent pipeline stage on the same string inherits the 'safe' designation, so attacker-controlled data that should be escaped is passed through unescaped. Because variable expansion is used to build authentication backend queries, this enables SQL or LDAP injection by remote unauthenticated attackers. There is no public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker with low-level site privileges to run arbitrary code across the network by submitting maliciously crafted serialized data (CWE-502). Microsoft has released a patch; there is no public exploit identified at time of analysis, and the EPSS score is low (0.31%, 55th percentile), with CISA's SSVC framework rating exploitation status as 'none' but technical impact as 'total'. The combination of authenticated-but-low privilege access and full compromise of confidentiality, integrity, and availability makes this a meaningful escalation-to-RCE risk in enterprise collaboration environments.
Improper authorization in Subnet Solutions PowerSYSTEM Center 2024 (6.0.x-6.1.x) and 2026 (7.0.x) lets an authenticated, low-privileged user delete device project groups they should not be able to remove, causing integrity loss to the managed device inventory. The flaw stems from missing permission enforcement on the project-group deletion function rather than an authentication bypass at the perimeter. There is no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC scores exploitation as 'none.'
Command injection in Zyxel WRE6505 v2 firmware V1.00(ABDV.3)C0 allows unauthenticated adjacent network attackers to execute arbitrary operating system commands via crafted HTTP requests to the CGI interface. This vulnerability affects an end-of-life product with no vendor support, meaning no security patches will be released. Exploitation requires adjacent network access (same LAN segment) but no authentication, making it exploitable by any device on the local network including compromised IoT devices or malicious insiders.
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V11.0), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V11.0), SIPROTEC 5. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PowerSYSTEM Center 2020 (versions 5.11.x through 5.28.x) by SUBNET Solutions exposes a REST API device endpoint that fails to enforce operational role-based permissions, allowing any low-privilege authenticated user to retrieve device information that should be restricted to higher-permission roles. Reported through ICS-CERT advisory ICSA-26-132-02, this is an OT/ICS supervisory control product for power distribution environments, where unauthorized access to device-level data may carry operational sensitivity well beyond what a standard CVSS score conveys. No public exploit code exists and exploitation probability is near-zero (EPSS 0.01%), with SSVC assessing exploitation status as none and the attack requiring both network adjacency and a valid user credential.
Improper access control in all versions of Intel Vision software allows a remote, unauthenticated attacker to trigger denial of service and, under low-complexity conditions, achieve remote code execution against the Ring 3 user-application layer. The CVSS 4.0 base score of 8.8 reflects high confidentiality impact with lesser integrity and availability effects; there is no public exploit identified at time of analysis, and EPSS is low at 0.20% (42nd percentile). Intel published advisory SA-01457 and CISA's SSVC framework rates exploitation as none but technical impact as total.
Cross-site scripting in the web-based management interface of Aruba Access Points running AOS-10 and AOS-8 Instant allows an unauthenticated attacker on the adjacent local network to inject arbitrary JavaScript that executes in an authenticated administrator's browser. Successful exploitation can lead to theft of session/user data and manipulation of device configuration by riding the victim admin's privileges. No public exploit has been identified at time of analysis, and EPSS is low (0.12%), consistent with the SSVC assessment of no observed exploitation.
Type confusion vulnerability in Windows Ancillary Function Driver for WinSock enables local authenticated users to escalate privileges to SYSTEM level on Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server 2012. Microsoft has released patches through their March 2026 security update cycle. The vulnerability requires low-privilege local access but no user interaction, making it a high-value target for post-compromise lateral movement and persistence. CVSS 7.8 reflects complete system compromise potential, though EPSS data and KEV status are not available for this future-dated CVE.
Heap-based buffer overflow in Windows Message Queuing (MSMQ) allows remote unauthenticated attackers on adjacent networks to execute arbitrary code with high impact to confidentiality, integrity, and availability across multiple Windows versions. Microsoft released patches via their May 2026 security update. The vulnerability requires adjacent network access (same subnet/VLAN) but no authentication, user interaction, or special configuration, making it exploitable against default Windows installations where MSMQ service is enabled. EPSS data not available; no CISA KEV listing or public POC identified at time of analysis.
Remote code execution in superduper (Python library) through version 0.10.0 allows unauthenticated network attackers to execute arbitrary system commands by submitting malicious query strings with embedded Python code. The _parse_op_part() function in query.py uses unsafe eval() with inadequate context restrictions, enabling attackers to import modules (such as os) and achieve complete server compromise. EPSS score is low (0.07%, 20th percentile) and no active exploitation is confirmed (CISA KEV absent), but SSVC framework rates technical impact as total. User interaction is required (CVSS UI:R), reducing automated exploitation risk. Authentication requirements not confirmed from available data - CVSS vector shows PR:N (no privileges required) but UI:R suggests user-triggered queries.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an already-authenticated low-privileged user to elevate to SYSTEM across Windows 10, Windows 11 (21H2 through 26H1), and Windows Server 2022/2025. The flaw stems from external control of a file name or path (CWE-73) inside the kernel-mode WinSock support driver, yielding total confidentiality, integrity, and availability impact per CVSS 7.8. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and CISA SSVC records exploitation as none, but the total technical impact and near-universal Windows footprint make it a standard Patch Tuesday priority.
Path traversal in Azure Monitor Agent enables low-privileged local attackers to escalate to SYSTEM/root privileges via malicious file path manipulation. Microsoft has released security patches. Attack vector is local (AV:L) with low complexity (AC:L), requiring only basic local credentials (PR:L) but no user interaction. EPSS exploitation probability is 0.04% (4th percentile), indicating low likelihood of mass exploitation, though the attack is straightforward once local access is obtained.
Remote code execution in Snorkel machine learning library (≤v0.10.0) occurs when users load untrusted model files via MultitaskClassifier.load(). The vulnerability exploits insecure Python object deserialization through torch.load(), allowing attackers to embed malicious code in model weight files that executes upon loading. EPSS score of 0.06% (19th percentile) suggests low observed exploitation probability in the wild, though SSVC framework indicates total technical impact once exploited. No public exploit code or active exploitation confirmed at time of analysis, but exploitation requires only that a data scientist or ML engineer load a malicious .pkl model file.
Insecure deserialization in Optimate's neural_magic_training.py script enables remote code execution when loading PyTorch model files. The _load_model() function uses torch.load() without the weights_only=True security parameter, allowing attackers with low privileges to execute arbitrary Python code by providing malicious .pt or .pth files via the --model command-line argument. EPSS indicates low exploitation probability at 0.06% with no active exploitation confirmed.
Arbitrary code execution in Snorkel library (Python) through version 0.10.0 enables remote attackers to execute code by supplying malicious pickle files to the BaseLabeler.load() method. The vulnerability stems from unsafe deserialization using pickle.load() without input validation, allowing attackers to craft serialized objects that execute arbitrary commands during deserialization. With EPSS at 6th percentile, exploitation probability remains relatively low despite the critical CVSS score, and no active exploitation (KEV) or public proof-of-concept has been identified at time of analysis.
Arbitrary code execution in Snorkel machine learning library (≤v0.10.0) occurs when users load malicious model checkpoint files through the Trainer.load() method. The vulnerability stems from unsafe PyTorch deserialization that processes untrusted Pickle objects without the weights_only security parameter. Attackers can embed malicious Python code in model files distributed through repositories, shared datasets, or social engineering campaigns. Despite the 8.8 CVSS score indicating critical severity, EPSS scoring at 0.06% (19th percentile) suggests very low real-world exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis.
Remote code execution in Optimate's neural_magic_training.py script allows authenticated attackers to execute arbitrary code via malicious PyTorch model files. The vulnerability stems from unsafe deserialization when loading model state dictionaries without PyTorch's weights_only=True security flag, enabling pickle-based arbitrary object execution. With an EPSS score of 0.06% and no confirmed exploitation, this represents a moderate risk primarily in environments where users can upload or specify model files.
Arbitrary code execution in Microsoft Excel (and the broader Office family through Microsoft 365 Apps, Office 2019, LTSC 2021/2024, Office for Mac, and Office Online Server) is possible when a user opens a maliciously crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122), running attacker code in the context of the current user. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.06%, 18th percentile), but the technical impact is total (full confidentiality, integrity, and availability loss). Microsoft has released patches; exploitation requires the victim to open a file, so it is a phishing/social-engineering-driven local vulnerability rather than a remotely wormable one.
Local code execution in Microsoft Office Excel (Excel 2016, Office 2019/LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) arises from a use-after-free memory corruption flaw that an attacker triggers by convincing a user to open a specially crafted spreadsheet. Successful exploitation yields full compromise of the current user's context (high confidentiality, integrity, and availability impact). There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records exploitation status as none, indicating this is a patch-in-cycle issue rather than an active threat.
Local code execution in Microsoft Office (LTSC for Mac 2021/2024 and Office for Android) via a heap-based buffer overflow (CWE-122) that an unauthorized attacker triggers when a victim opens a maliciously crafted document, yielding full confidentiality, integrity, and availability impact in the user's context. Exploitation requires user interaction (UI:R) and local access (AV:L), so weaponization depends on social engineering rather than remote reachability. This is no public exploit identified at time of analysis, with a very low EPSS score of 0.06% and CISA SSVC rating exploitation as 'none', indicating no observed activity despite the 'total' technical impact.
Information disclosure in Microsoft Excel (and the broader Office family - Office 2019, Office LTSC 2021/2024, Office for Mac, Microsoft 365 Apps for Enterprise, and Office Online Server) allows an attacker to read memory beyond an allocated buffer when a victim opens a crafted spreadsheet, potentially leaking sensitive in-process data. Exploitation is local and requires user interaction (opening the malicious file); there is no public exploit identified at time of analysis and CISA SSVC scores exploitation as 'none'. EPSS is very low (0.06%, 18th percentile), indicating negligible observed exploitation activity, though the technical impact is rated 'total'.
Remote code execution in CosyVoice (FunAudioLLM's open-source text-to-speech toolkit) up to commit 6e01309 allows an attacker to run arbitrary Python on a victim's host when the victim loads an attacker-supplied model directory. The flaw stems from calling torch.load() without weights_only=True, so malicious pickle payloads embedded in .pt model files execute during model loading via the web interface. There is no public exploit identified at time of analysis and EPSS is very low (0.05%, 17th percentile), but SSVC rates the technical impact as total.
Local code execution in Microsoft Visual Studio Code before 1.119.1 stems from improper neutralization of script-related HTML tags (basic XSS, CWE-80) rendered within the editor's webview surfaces, letting an attacker who tricks a user into opening crafted content run code in the victim's context. Exploitation requires user interaction (opening a malicious file/workspace) and is reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and EPSS is negligible at 0.05% (16th percentile).
Local privilege escalation in the Windows Server Data Deduplication feature (dedup.sys / associated services) lets an authenticated low-privileged user corrupt kernel memory to gain SYSTEM-level rights. Reported by Microsoft across Windows Server 2012 R2 through 2025, it carries a CVSS 7.8 and total technical impact per CISA SSVC, but has no public exploit identified at time of analysis and a very low EPSS of 0.04% (13th percentile). It is not listed in CISA KEV and shows no evidence of active exploitation.
Local privilege elevation in Microsoft Office (Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024) stems from a use-after-free memory corruption flaw (CWE-416) that an already-authorized local attacker can trigger to gain higher privileges on the host. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is very low (0.04%, 13th percentile) and CISA SSVC records exploitation as none, indicating no observed in-the-wild activity. The CVSS 3.1 base score is 7.8 with total technical impact (C:H/I:H/A:H) once triggered.
Local privilege escalation in the Windows Kernel affects a broad range of Windows Server releases (2012 through 2025, including Server Core installations), where a heap-based buffer overflow (CWE-122) lets an already-authenticated local user corrupt kernel heap memory to gain SYSTEM-level privileges. Microsoft has released patches and rates it CVSS 7.8; there is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as none but technical impact as total. EPSS is very low (0.04%, 13th percentile), consistent with the local-only attack vector that requires prior code execution on the host.
Local privilege escalation in Windows Application Identity (AppID) Subsystem allows low-privileged authenticated users to execute code as SYSTEM via heap buffer overflow. Microsoft has released security patches across Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server 2012. CVSS 7.8 score reflects high impact to confidentiality, integrity, and availability. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis. Requires existing local access with standard user privileges, limiting remote attack surface.
Local privilege escalation in Windows Kernel across Windows 10, Windows 11 (versions 22H3 through 26H1), and Windows Server 2022 allows authenticated local attackers to gain SYSTEM-level privileges through heap corruption. Microsoft has released patches addressing this CWE-122 heap-based buffer overflow. EPSS data not available for risk quantification, and no CISA KEV listing indicates exploitation has not been publicly confirmed, though the vulnerability's low attack complexity (AC:L) and minimal prerequisites (PR:L) make it attractive for post-compromise privilege escalation in targeted attacks.
1-click remote code execution in AntSword before 2.1.16 lets a malicious web server or webshell endpoint execute arbitrary code on the operator's machine by injecting jquery.terminal format codes that the incomplete noxss() filter fails to sanitize. Because AntSword is an Electron-based client, cross-site scripting in the terminal renderer escalates to full RCE in the desktop application. Rated CVSS 8.8; no public exploit is identified at time of analysis, EPSS is only 0.04%, and SSVC records exploitation status as none.
Local privilege escalation in Microsoft's Azure Connected Machine Agent (versions 1.0.0 through 1.62) allows a low-privileged authenticated user on an Azure Arc-enabled machine to gain SYSTEM-level privileges by abusing an improper access control weakness. Microsoft has released a fixed build (1.63) and this is currently classified with no known exploitation (SSVC: none), consistent with an EPSS score of just 0.04%; no public exploit identified at time of analysis. The flaw is tagged as an authentication bypass and carries full technical impact (total) across confidentiality, integrity, and availability.
Local privilege escalation in Microsoft Office Click-To-Run (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024) allows an authenticated local attacker to elevate privileges due to improper access control in the update/servicing component. A successful attack results in total compromise of confidentiality, integrity, and availability with a scope change beyond the vulnerable component. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%, 12th percentile), but the vendor rates technical impact as total.
Local privilege escalation in Microsoft Office Click-To-Run (the servicing/update engine behind Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024) lets an already-authenticated low-privileged user escalate to higher privileges on the host due to insufficiently granular access control (CWE-1220). The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows a scope change with total confidentiality, integrity, and availability impact, meaning a successful attacker crosses a security boundary from the Office servicing context to the wider system. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none', so this is a serious-but-not-actively-exploited local EoP that should be patched on the normal accelerated cycle.
Local privilege escalation in Microsoft Dynamics 365 Business Central (2024 Release Wave 2 through 2026 Release Wave 1) lets an already-authenticated, low-privileged user elevate to higher privileges on the host through a weak authentication mechanism (CWE-1390). Successful exploitation yields total compromise of confidentiality, integrity, and availability of the affected instance. There is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as 'none' with an EPSS of just 0.04% (12th percentile), indicating low near-term exploitation likelihood.
Privilege escalation in Turboard FOR-S allows remote unauthenticated attackers to gain elevated access by exploiting incorrect authorization checks, requiring only user interaction. The vulnerability affects versions 7.01.2026 through 17.02.2026, with fix available in version 18.02.2026. Turkish national CERT (TR-CERT) reported this authorization bypass vulnerability (CWE-863), which enables attackers to compromise confidentiality, integrity, and availability of the affected business intelligence platform.
Authorization bypass in BAPSİS web application enables unauthenticated remote attackers to exploit trusted identifiers through user-controlled keys when victims interact with crafted requests. ABIS Technology's BAPSİS platform (versions before v.202604152042) contains a CWE-639 flaw where authorization checks rely on client-controlled key values, allowing attackers to manipulate trust relationships and gain unauthorized access with high impact to confidentiality, integrity, and availability. TR-CERT published advisory but no public exploit code identified at time of analysis, with CVSS 8.8 reflecting network-exploitable attack requiring only user interaction.
Local privilege escalation in the Windows Remote Desktop component (CWE-122 heap-based buffer overflow) allows an authenticated low-privileged user to gain SYSTEM-level control across virtually all supported Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has released patches; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC rating exploitation as 'none'. The flaw is a serious defense-in-depth concern because it grants total confidentiality, integrity, and availability impact once a foothold exists, but it is not remotely reachable and requires prior local access.
Authenticated code execution on Nomad client hosts is possible in HashiCorp Nomad and Nomad Enterprise 1.10.0 through versions prior to 2.0.1 via a path traversal flaw in the dynamic host volume feature. A submitter with volume-creation privileges can escape the intended volume directory and write to or execute code in arbitrary locations on the client node's filesystem, gaining code execution outside the intended sandbox. This flaw is not in CISA KEV and has no public exploit identified at time of analysis; EPSS probability is low at 0.03%.
Local privilege escalation in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where an untrusted pointer dereference (CWE-822) lets an already-authenticated local attacker execute code with SYSTEM-level privileges. Microsoft has released a patch, and no public exploit is identified at time of analysis; EPSS exploitation probability is very low (0.03%) and the flaw is not on CISA KEV. Despite the 'Information Disclosure' tag applied in vendor metadata, the CVSS vector and description describe a privilege-elevation primitive with total confidentiality, integrity, and availability impact on the affected host.
Remote code execution in Fortinet FortiOS 7.2.0-7.2.11, 7.4.0-7.4.8, and 7.6.0-7.6.3 enables authenticated attackers to execute arbitrary code via malformed network packets. The out-of-bounds write vulnerability (CWE-787) affects FortiOS firewall appliances and requires only low-privilege credentials to exploit over the network. Fortinet published advisory FG-IR-26-123 confirming the vulnerability. No CISA KEV listing or public exploit code identified at time of analysis, though the straightforward network attack vector (AV:N/AC:L) suggests moderate weaponization potential once details emerge.
Local privilege escalation in the Win32K GRFX (graphics) subsystem of Microsoft Windows allows an authenticated, low-privileged user to execute arbitrary code in the kernel context via a heap-based buffer overflow. All currently supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) are affected. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.02%), but the total technical impact and low exploitation barrier make it a meaningful patch-priority for endpoint hardening.
Memory corruption in Mozilla Firefox versions prior to 150.0.3 stems from a JIT (Just-In-Time) compiler miscompilation in the JavaScript engine, allowing remote attackers to trigger high-impact compromise of confidentiality, integrity, and availability when a user visits a malicious web page. The flaw carries a CVSS score of 8.8 and requires user interaction (loading attacker-controlled JavaScript), but no authentication. There is no public exploit identified at time of analysis, though a GitHub repository referenced from NVD suggests early proof-of-concept research, and EPSS scores the exploitation probability at only 0.02% despite the high CVSS severity.
Cross-site request forgery in ChurchCRM's UserEditor.php (versions prior to 7.3.2) lets an unauthenticated attacker forge account-management requests that execute with an authenticated administrator's session. Because the endpoint processes user creation and permission changes from $_POST parameters with no CSRF token, a victim admin who visits a malicious page can be tricked into silently promoting a low-privilege user to administrator or minting a new admin backdoor account. Publicly available exploit code exists (SSVC: poc) but the flaw is not in CISA KEV, and EPSS is very low (0.02%, 4th percentile), indicating no evidence of widespread exploitation.