SQL injection in Fortinet FortiNDR 7.0 through 7.6.2 allows authenticated attackers to execute unauthorized code or commands via crafted HTTP requests. The vulnerability affects multiple versions across the 7.x branch and has an EPSS exploitation probability indicator (E:P in CVSS), suggesting feasible attack conditions despite moderate CVSS score (5.1). Patch availability and active exploitation status require confirmation from vendor advisory.
An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado parameter through a crafted GET request. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in Intel AI Playground software before version 3.0.0 alpha via an uncontrolled search path element (CWE-427) allows a local low-privileged attacker to execute arbitrary code with elevated privileges. Exploitation requires an authenticated user, active user interaction, high attack complexity, and specific attack conditions (AT:P), making this a constrained but high-impact local privilege escalation. No public exploit code has been identified and CISA SSVC rates current exploitation as none, consistent with the extremely low EPSS score of 0.01% (3rd percentile).
Privilege escalation in Intel Server Firmware Update Utility Software before version 16.0.12 exposes authenticated local users to an uncontrolled search path (DLL/library hijacking) condition within the Ring 3 user-application layer. A low-privileged local attacker who can plant a malicious library or executable in a directory the utility searches at launch can escalate privileges with high impact to confidentiality, integrity, and availability of the affected system. No public exploit is identified at time of analysis, and EPSS sits at the 3rd percentile, consistent with SSVC exploitation status of 'none'.
Privilege escalation in Intel Connectivity Performance Suite software installers before version 50.25.1121.193 allows a local, low-privileged authenticated attacker to gain elevated privileges through an uncontrolled search path (CWE-427) triggered during installer execution in Ring 3 user space. Exploitation is constrained by high attack complexity, a mandatory specific attack configuration (AT:P), and a requirement for active user interaction, making this a targeted rather than opportunistic risk. No active exploitation has been confirmed - EPSS sits at 0.01% (3rd percentile), SSVC lists exploitation as none, and no CISA KEV listing exists.
Privilege escalation in Intel NPU Driver software installers before version 32.0.100.4511 stems from incorrect default permissions applied to Ring 3 (user-space) components during installation, classified under CWE-276. A local authenticated low-privileged user on an affected system can exploit these misconfigured permissions under high-complexity conditions - requiring specific attack prerequisites and active user interaction - to achieve full confidentiality, integrity, and availability compromise of the vulnerable system. No active exploitation is confirmed (not in CISA KEV), EPSS is at the 1st percentile (0.01%), and SSVC designates exploitation status as none, indicating this is a theoretical but not currently weaponized risk.
Missing authorization checks in SAP Strategic Enterprise Management's Scorecard Wizard (Business Server Pages application) allow authenticated users to access restricted information and modify risk evaluation settings without proper authorization. An attacker with valid credentials can view confidential data and alter default configuration values, artificially reducing assessed risk levels to deceive risk assessment processes. No patch availability or active exploitation has been confirmed.
Cross-site request forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform allows unauthenticated attackers to trick authenticated users into sending unintended requests to the web server, resulting in low-impact modifications to application integrity and availability. The vulnerability requires user interaction (clicking a malicious link) and affects all versions of the platform due to insufficient CSRF token validation. No confidentiality impact is present, limiting the attack surface to state-changing operations.
Denial-of-service attacks against Fortinet FortiAnalyzer and FortiManager 6.4 through 7.6.4 allow authenticated attackers to trigger system hangs via specially crafted HTTP requests that exploit a use of potentially dangerous function vulnerability (CWE-676). The crash occurs only when internal lock alignment conditions are met, making exploitation dependent on timing and system state rather than attacker control. CVSS 5.2 reflects medium severity with high attack complexity and low availability impact; active exploitation is not confirmed.
Unauthenticated attackers can delete any classroom record in the HEL Online Classroom WordPress plugin (versions up to 1.0.3) via a REST API endpoint that bypasses all WordPress authentication checks through a permission_callback set to '__return_true', resulting in permanent data loss. The vulnerability affects the plugin's core functionality and requires only network access with no user interaction, though the CVSS score of 5.3 reflects limited confidentiality impact (integrity modification only, no information disclosure).
Remote denial-of-service in Adobe Commerce, exploitable without authentication, stems from a dependency on a vulnerable third-party component (CWE-1395) that can be triggered to crash the application. Affected releases span a wide version range including 2.4.9-beta1 through 2.4.4-p17 and earlier. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.07% places this in the 22nd percentile - reflecting limited observed exploitation interest despite the attack being automatable per the SSVC framework.
XML entity expansion (CWE-776) in the DHCP XML handling component of HPE Aruba AOS Instant 8.x.x.x enables an unauthenticated remote attacker to cause denial-of-service via excessive resource consumption on affected Access Points. Exploitation requires both high attack complexity and user interaction (CVSS AV:N/AC:H/PR:N/UI:R), restricting the realistic attack surface to scenarios where a connected wireless client triggers the vulnerable DHCP parsing path. No active exploitation has been identified - EPSS stands at 0.07% (21st percentile), SSVC confirms exploitation status of none, and the vulnerability is absent from CISA KEV.
Unauthenticated attackers can modify critical payment gateway settings in the iPOSpays Gateways WC WordPress plugin through an exposed REST API endpoint lacking authorization checks, enabling them to overwrite live API keys, secret keys, and payment tokens. Affected versions up to 1.3.7 permit unrestricted access to the /wp-json/ipospays/v1/save_settings endpoint due to a permission_callback set to '__return_true' with no nonce verification, allowing complete compromise of payment processing credentials without authentication. This is a high-integrity attack vector against e-commerce sites using the plugin.
Slek Gateway for WooCommerce plugin version 1.0 exposes merchant API credentials (slek_key and slek_secret) to unauthenticated attackers through client-side HTML forms and plaintext GET parameters. An attacker who places an order on an affected WooCommerce store can extract the merchant's secret credentials by inspecting the HTML source or using browser developer tools on the order-pay page before JavaScript auto-submission occurs, compromising the merchant's Slek payment processing account.
mem0 1.0.0 server accepts unauthenticated POST requests to the /memories endpoint, allowing remote attackers to inject arbitrary memory records without identity verification or authorization checks. This authentication bypass enables data pollution and unauthorized modification of the memory database with spoofed entries. EPSS exploitation probability is low (0.05th percentile), and no active exploitation has been confirmed, but the vulnerability is automatable and affects default configurations.
External control of file name or path (CWE-73) in Microsoft Office Word enables network-based information disclosure when a victim opens a specially crafted document, affecting Word 2016, Office 2019, LTSC 2021/2024, and Microsoft 365 Apps for Enterprise. An unauthenticated remote attacker can exploit this to coerce Word into resolving an attacker-controlled file path - likely a UNC path - causing an outbound network request that leaks sensitive data such as NTLM credentials. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.05% at the 14th percentile indicates negligible real-world exploitation activity at time of analysis.
Insecure Direct Object Reference (IDOR) in GoJobs, a REST API job board platform by karnop, exposes job records to unauthenticated network attackers who enumerate object identifiers on the job retrieval endpoint. The endpoint performs no authentication or authorization checks, meaning any external user can retrieve arbitrary job postings by iterating numeric or sequential IDs. A proof-of-concept exists per SSVC intelligence and exploitation is rated automatable, though EPSS probability remains very low (0.05%, 14th percentile) and no active exploitation has been confirmed in CISA KEV.
Unauthenticated remote attackers can trigger a denial-of-service condition against Asset CleanUp: Page Speed Booster (WordPress plugin) versions up to 1.4.0.3 by exploiting missing authorization controls that incorrectly configure access restrictions. The vulnerability allows attackers to perform actions intended for authenticated administrators without proper authentication, resulting in availability impact through the ability to modify or disable asset optimization features.
Broken access control in Flowsint prior to 1.2.3 allows any authenticated user to read sketch logs belonging to arbitrary other users, constituting horizontal privilege escalation. The SSVC framework confirms a proof-of-concept exists and exploitation is automatable, though EPSS at 0.04% (12th percentile) reflects the niche deployment footprint of this OSINT tool. No active exploitation has been confirmed by CISA KEV; the risk is primarily insider threat or multi-tenant abuse where users share a single Flowsint instance.
linux-entra-sso, Siemens' Chrome browser extension for Microsoft Entra ID SSO on Linux, leaks the Entra ID Primary Refresh Token (PRT) cookie to attacker-controlled hosts due to missing URL origin validation in its Chrome adapter. Versions prior to 1.8.1 are affected; the Chrome adapter's declarativeNetRequest rule uses an unanchored urlFilter that performs substring matching, causing the PRT injection to fire on any request URL containing 'https://login.microsoftonline.com/' anywhere in the path - not just requests actually destined for Microsoft's login endpoint. A proof-of-concept exists per SSVC data, though exploitation is not confirmed in CISA KEV and EPSS is very low (0.03%), reflecting the niche product footprint and required user interaction.
protobufjs versions 7.5.5 and earlier, and 8.0.0-8.0.1 accept overlong UTF-8 byte sequences in the minimal UTF-8 decoder used by non-Node and fallback decoding paths, allowing attackers to bypass byte-level filtering and decode strings containing characters that were not present in the raw protobuf binary input. This integrity issue affects applications that rely on pre-decoding byte validation before using protobuf strings in security-sensitive contexts. Patch versions 7.5.6 and 8.0.2 are available; Node.js Buffer-backed paths are not directly affected.
WPMU DEV Hustle plugin versions through 7.8.10.1 allow unauthenticated remote attackers to modify sensitive data via missing authorization controls on access-restricted functionality. The vulnerability exploits incorrectly configured access control security levels, enabling attackers to bypass authentication mechanisms without user interaction. No public exploit code or active exploitation has been confirmed at the time of analysis.
WP EasyPay plugin through version 4.3.0 exposes sensitive information in sent data, allowing unauthenticated remote attackers to retrieve embedded data without user interaction. The vulnerability stems from improper handling of sensitive data during transmission, classified as an information disclosure issue with a CVSS score of 5.3 (network-accessible, low complexity). No active exploitation has been confirmed in CISA KEV at the time of analysis.
Unauthenticated attackers can cancel arbitrary bookings in the Smart Appointment & Booking WordPress plugin versions up to 1.0.8 due to a logic flaw in nonce validation that uses AND instead of OR, combined with a missing capability check in the saab_cancel_booking() function. By supplying any value for the security parameter and a predictable booking ID, attackers can modify or delete booking records without authentication or user interaction.
Information disclosure vulnerability in Firefox's JavaScript Engine allows remote unauthenticated attackers to leak sensitive memory contents over the network without user interaction. The vulnerability affects Firefox versions prior to 150.0.3 and has a low EPSS score (0.02%) despite the network-based attack vector, suggesting limited real-world exploitation pressure despite the modest CVSS score of 5.3.
OX Dovecot Pro allows authenticated users to upload malicious Sieve scripts via ManageSieve protocol or local access that bypass configured CPU time limits by up to 130 times, enabling denial of service through server performance degradation. The vulnerability requires low-privilege authenticated access and medium attack complexity, affecting availability without compromising confidentiality or integrity. No public exploit code has been identified at the time of analysis.
Denial of service in protobufjs allows remote attackers to crash runtime code generation by providing crafted protobuf schemas or JSON descriptors containing unescaped control characters in field names. When affected message types perform encode, decode, verify, or conversion operations, the generated JavaScript code fails to compile, rendering those types unusable. This affects applications that load untrusted schemas; those using only application-defined schemas are not impacted. No code execution is known to occur.
Prototype injection in protobufjs generated message constructors allows attackers controlling plain objects passed to message constructors to modify the prototype chain of individual message instances via an enumerable `__proto__` property. Affects protobufjs versions 7.5.5 and earlier, and 8.0.0-8.0.1. This is a per-instance prototype pollution issue (not global) with impact dependent on downstream application behavior such as inherited property reliance or `instanceof` checks. No active exploitation confirmed; no public exploit identified at time of analysis.
Stored cross-site scripting in Flowsint, an open-source OSINT graph exploration tool, allows an authenticated remote attacker to inject arbitrary HTML into map node labels that executes in the browser of any user who selects that node marker in the map tab. Affected versions are all releases prior to 1.2.3, which delivers the official fix. Publicly available exploit code exists per SSVC data, though EPSS sits at just 0.16% (37th percentile), consistent with the tool's niche deployment footprint and the non-automatable nature of the attack.
Stored SSRF in mosparo's automatic rule package source URL feature allows a project editor to plant an attacker-controlled URL that the mosparo server subsequently fetches without restricting private or loopback destinations. Any authenticated project member with the editor role can exploit this to probe internal HTTP services behind the mosparo host, effectively turning the application into a network reconnaissance oracle. A publicly available proof-of-concept exists per SSVC data; however, the vulnerability is not listed in CISA KEV and carries a very low EPSS of 0.03%, suggesting no observed widespread exploitation at time of analysis.
Sensitive OS file disclosure in the HPE Aruba Networking AOS-10 Gateway web management interface allows authenticated remote administrators to read arbitrary files on the underlying operating system. Affected version ranges span AOS 10.4.0.0-10.4.1.10, 10.7.0.0-10.7.2.2, and 10.8.0.0. No public exploit code exists and EPSS sits at 0.03% (11th percentile), with SSVC confirming no observed exploitation - risk is primarily from compromised admin credentials or insider threats rather than opportunistic attack.
Stored Cross-Site Scripting (XSS) in WP SEO Structured Data Schema plugin for WordPress versions up to 2.8.1 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via the `_kcseo_ative_tab` parameter, which executes in the browsers of users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's metadata handling. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote code execution in GWD Connect WordPress plugin versions up to 2.9 allows attackers to execute arbitrary PHP code on unregistered installations via the update_agent action in standalone agent endpoints (gwd-backup.php and gwd-logs.php) when the API key is not configured. The vulnerability exploits a missing authorization check that occurs only when the authentication key has not been set up, affecting default installations. No public exploit code or active exploitation has been confirmed at this time.
Stored Cross-Site Scripting in Adobe Commerce 2.4.x allows a high-privileged attacker to inject persistent JavaScript payloads into vulnerable form fields, which execute in the browser of any user who subsequently views the affected page. The scope change (S:C) means injected scripts run in the victim's browser security context, enabling session hijacking or unauthorized action execution against lower-privileged users. No public exploit code has been identified and EPSS at 0.06% (20th percentile) with SSVC exploitation status of 'none' confirm no current active exploitation.
Open redirect in Horilla HR and CRM version 1.5.0 enables authenticated attackers to weaponize trusted application notification links into phishing redirects targeting other users. Four notification endpoint handlers (mark_all_as_read, mark_as_read, mark_as_unread, delete) in notifications/views.py pass the unvalidated next GET parameter directly to Django's redirect() without checking the destination host, allowing external URL injection. SSVC confirms a proof-of-concept exists; exploitation is not automatable and the vulnerability is not listed in CISA KEV, placing real-world risk firmly in the social-engineering category rather than direct system compromise.
Stored Cross-Site Scripting in Adobe Commerce allows a high-privileged attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser upon visiting the affected page. All active release trains from 2.4.4 through 2.4.8 are affected, along with the 2.4.9-beta1 pre-release. No public exploit identified at time of analysis; an EPSS score of 0.02% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity, keeping real-world urgency low despite the stored nature of the flaw.
Intel QAT (Quick Assist Technology) software drivers for Windows before version 1.13 contain an unchecked return value flaw in Ring 3 user-space application code, enabling a local authenticated attacker to cause a denial of service. The vulnerability carries a CVSS 4.0 score of 4.8 with strictly local access and low-privilege requirements, limiting blast radius to availability of the affected system only. No public exploit code exists and CISA has not listed this in KEV; EPSS at the 3rd percentile and SSVC exploitation status of 'none' confirm this is currently theoretical rather than actively targeted.
Reflected cross-site scripting (XSS) in SAP NetWeaver Application Server ABAP (Business Server Pages) allows unauthenticated attackers to inject malicious scripts via unprotected URL parameters. Successful exploitation requires victim interaction (clicking a crafted link) and affects confidentiality and integrity of application data. No public exploit code or active exploitation reported at time of analysis.
Sandbox path bypass in consul-template before 0.42.0 allows local authenticated users to read files outside the intended sandbox via symlink attack in the file template helper. The vulnerability requires local access and elevated privileges but grants high confidentiality impact. Vendor-released patch available in version 0.42.0.
SAPUI5 Search UI allows unauthenticated attackers to manipulate URL parameters to inject malicious content, potentially deceiving users into accessing attacker-controlled pages. The vulnerability requires user interaction (clicking a crafted link) and has low confidentiality impact with no effect on integrity or availability. No active exploitation has been confirmed at the time of this analysis.
Stored cross-site scripting in efw4.X's previewServlet allows authenticated low-privilege users to cause arbitrary JavaScript execution in victims' browsers by uploading .html, .htm, or .svg files that are served without sanitization or protective security headers. All efw4.X versions prior to 4.08.010 are affected; the framework serves these files with text/html or image/svg+xml MIME types derived from extension alone, giving browsers a green light to parse and execute embedded scripts within the application's origin. No active exploitation confirmed in CISA KEV, but SSVC data confirms a POC exists; EPSS at 0.03% (8th percentile) reflects low opportunistic exploitation probability consistent with the authentication and user-interaction requirements.
Path traversal vulnerability in Lhaz and Lhaz+ archive extraction allows local users to write files to unintended directories when the automatic folder creation feature is enabled and a crafted archive is extracted. The vulnerability requires user interaction (extracting a malicious archive) and affects only the integrity of file placement, not confidentiality or availability. CVSS score is 3.3 (low); no public exploit code or active exploitation has been identified.
Windows Filtering Platform (WFP) on affected Windows 10, Windows 11, and Windows Server releases exposes an improper access control flaw (CWE-284) that enables a locally authenticated, low-privileged attacker to bypass a host-based security feature. The bypass is limited to confidentiality and integrity impacts (no availability), scoped to the vulnerable system, and requires no user interaction once local execution is established. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS at 0.04% (11th percentile) and SSVC exploitation status of 'none' corroborate the low probability of near-term opportunistic weaponization.
Spoofing via improper access control in Microsoft 365 Copilot for Android (versions prior to 16.0.19822.20190) enables a locally authenticated attacker with low privileges to manipulate identity or content presentation within the application. The CVSS vector (AV:L/PR:L) confirms exploitation requires prior local access and an authenticated foothold on the device - this is not a remote or unauthenticated threat. No public exploit code exists and no active exploitation has been identified; EPSS sits at 0.04% (11th percentile) and CISA SSVC rates it non-automatable with only partial technical impact.
Stored cross-site scripting (XSS) in the Continually WordPress plugin versions up to 4.3.1 allows authenticated administrators to inject arbitrary web scripts into admin settings that execute whenever users access affected pages. The vulnerability requires high-privilege administrator access and is limited to multisite WordPress installations or sites with unfiltered_html disabled, resulting in low CVSS impact (4.4) despite network accessibility. No public exploit code or active exploitation has been identified at this time.
Stored Cross-Site Scripting in FastBots plugin for WordPress up to version 1.0.12 allows authenticated administrators to inject arbitrary JavaScript into admin settings that executes when any user accesses affected pages. The vulnerability requires high-privilege administrator access and affects only multi-site WordPress installations or single-site installations with the unfiltered_html capability disabled. No public exploit code or active exploitation has been identified at time of analysis.
Heap out-of-bounds null write in NanaZip's UFS/UFS2 filesystem image parser (versions 5.0.1252.0 through 6.0.1698.0) enables a limited heap corruption primitive when a user opens a crafted disk image. The attacker controls the byte offset of the single null-byte write within a ~254-byte window past the heap allocation boundary, yielding partial integrity and availability impact with no confidentiality exposure. No public exploit has been confirmed at time of analysis, EPSS places exploitation probability at the 2nd percentile, and the vulnerability is not listed in CISA KEV.
Stack-based out-of-bounds read in NanaZip's ZealFS v1 filesystem image parser affects versions 5.0.1252.0 through before 6.0.1698.0, allowing an attacker who tricks a user into opening a crafted archive to leak stack memory and potentially crash the application. The root cause is an attacker-controlled BitmapSize header field that drives an unbounded loop reading past the end of a stack-allocated ZEALFS_V1_HEADER structure, yielding limited confidentiality and availability impact. No active exploitation has been confirmed - EPSS is 0.01% (2nd percentile), SSVC rates exploitation as none, and no KEV listing or public exploit code exists at time of analysis.
Zyxel WRE6505 v2 firmware stores sensitive configuration data in an insecure manner, allowing local administrators to download and decrypt backup configuration files, leading to disclosure of confidential credentials and network settings. The vulnerability affects firmware version V1.00(ABDV.3)C0 and requires local access with administrative privileges. No public exploit code or active exploitation has been identified; however, the product is no longer supported by Zyxel, limiting patch availability.
Ivanti Secure Access Client before version 22.8R6 allows local authenticated users to read or modify sensitive log data through write access to a shared memory section due to incorrect permission assignments on a critical resource. With a CVSS score of 4.4 and a local attack vector requiring authentication, this vulnerability poses a moderate risk to users whose systems are accessed by multiple authenticated accounts. No active exploitation has been publicly confirmed, but the simplicity of the attack (local, low complexity) makes this a practical concern for multi-user systems.