Stored XSS in the Store Locator WordPress plugin before 1.6.9 allows high-privileged users (administrators) to inject persistent malicious scripts via unsanitized store logo metadata, which executes when the admin page is rendered in another user's browser. The vulnerability is especially significant in WordPress multisite networks because it bypasses the `unfiltered_html` capability restriction - a control specifically intended to prevent administrators from injecting raw HTML and scripts. A public POC is documented by WPScan; no active exploitation is confirmed (absent from CISA KEV), and EPSS of 0.03% indicates low current exploitation probability.
Path traversal in the Store Locator WordPress plugin before version 1.6.9 enables authenticated administrators to read arbitrary PHP files from the server filesystem, including wp-config.php, which contains database credentials and WordPress secret keys. The vulnerability stems from an unvalidated parameter passed directly into a file path, allowing traversal sequences to escape the intended directory. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.04% (12th percentile) and no KEV listing exists, indicating low observed exploitation activity despite the public PoC.
SQL injection in CodeAstro Student Attendance Management System 1.0 enables authenticated administrators to manipulate the `admissionNumber` parameter in `/attendance-php/Admin/createStudents.php`, allowing arbitrary SQL commands to be passed to the underlying database. Exploitation is constrained to actors who already hold high-privilege admin credentials (PR:H per the CVSS 4.0 vector), but impact spans database confidentiality, integrity, and availability. A public proof-of-concept exploit is available on GitHub; the vulnerability is not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.
Host filesystem integrity violations in runc are triggered when the container runtime processes a malicious OCI image where /dev is configured as a symbolic link rather than a directory. An attacker who can deliver such a crafted image - via a public registry, a supply-chain-compromised base image, or a shared CI/CD pipeline - can cause runc to follow the symlink during container device-node initialization, resulting in limited, unintended write operations on the host filesystem outside the container boundary. The vendor-credited reporter (Aleksa Sarai, a known runc maintainer) describes the impact as 'limited host filesystem integrity violations,' falling short of a full container escape. No public exploit has been identified at time of analysis.
Cross-site scripting in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via the unsanitized `action` parameter in `/index.php`. Publicly available exploit code exists (CVSS 4.0 E:P), and the attack requires no authentication, only that a victim interact with a crafted URL or request. No vendor-released patch has been identified at time of analysis.