We are tasked with synthesizing data from multiple sources about CVE-2026-15631 into a comprehensive JSON analysis. The input includes description, patches, CVSS, CWE, EPSS, references, etc. The output must be a JSON object with the specified fields, all as plain text strings, not arrays or objects. We need to follow the precision rules. First, understand the vulnerability: @fastify/http-proxy, a Node.js library, from version 9.4.0 to 11.5.0 inclusive, has a WebSocket path traversal issue. The description says that the WebSocket destination path is resolved via WHATWG URL constructor which collapses dot segments, so a crafted upgrade request with path traversal can escape the rewrite prefix and reach unintended upstream endpoints. This is a variant of CVE-2021-21322, but in a code path not fixed there. Exploitation requires a non-normalizing WebSocket client; browsers and ws package normalize, so raw HTTP clients or downstream proxies that forward request target unchanged make it reachable. Patch: upgrade to 11.6.0. CVSS: 10.0, vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). EPSS: 0.30% (low). No KEV mentioned, so not in KEV. POC availability not explicitly stated, but the description implies the vulnerability exists and exploitation conditions are known; however, no public POC is indicated. The tags: "Path Traversal, Fastify Http Proxy". CPE: cpe:2.3:a:@fastify/http-proxy:@fastify/http-proxy:*:*:*:*:*:*:*:*. EUVD affected versions: "@fastify/http-proxy 9.4.0 <11.6.0". References include a GitHub security advisory (GHSA-7hrw-592w-9wh2) and the OpenJS CNA page. We need to produce each field according to the instructions. product_name: "Fastify HTTP Proxy" (or @fastify/http-proxy? The instructions: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPress', 'Linux Kernel', 'nginx-ui', 'GoAnywhere MFT'. NOT the vulnerability type, NOT the
Proxy prefix-rewrite bypass in @fastify/http-proxy (versions up to and including 11.5.0) lets remote unauthenticated attackers reach upstream endpoints the proxy was configured to hide. Because Fastify's router URL-decodes paths for route matching while the rewrite step performs a literal string replace against the decoded prefix, a request that URL-encodes any character of the configured prefix still matches the route but skips the rewrite, forwarding the raw encoded path to the upstream, which decodes and serves it. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score is 10.0 (scope-changed) and the OpenJS/GHSA advisory characterizes it as an information-disclosure access-control bypass.
Cross-upstream data exposure in the @fastify/reply-from proxy plugin (versions 8.3.1 through 12.6.3) lets remote unauthenticated attackers read and tamper with data belonging to a different backend by exploiting a URL cache-key collision. Because the cache key concatenates destination and source paths with no delimiter, distinct destination/source pairs resolving to different upstreams can collapse to the same key, so a cached URL for one upstream is served for a request routed to another. The flaw is present in the default configuration; there is no public exploit identified at time of analysis and EPSS is low (0.23%, 14th percentile).
Authentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a network-adjacent attacker circumvent the login mechanism and reach the Avi Controller control plane. Reported by VMware/Broadcom, it carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting full unauthenticated compromise of confidentiality, integrity and availability. No public exploit is identified at time of analysis and it is not on the CISA KEV list, but the flaw class (CWE-287) and network-reachable admin plane make it a high-priority patch.
Authentication bypass via capture-replay in Sipeed PicoClaw's LINE Webhook handler permits remote unauthenticated attackers to replay previously captured webhook requests against the ParseRequest function, injecting fraudulent LINE messaging events without possessing the channel secret. All versions through 0.2.9 are affected. A public exploit exists, and the vendor closed the GitHub disclosure as 'not planned,' confirming no official patch will be issued.
Server-side request forgery in Sipeed PicoClaw up to version 0.2.9 allows unauthenticated remote attackers to make the server issue HTTP requests to private or internal network resources by bypassing the application's SSRF guard. The incomplete protection in `pkg/utils/http_guard.go` fails to detect ISATAP IPv6 addresses that encode private IPv4 addresses in their lower 32 bits, enabling bypass via crafted URLs such as `http://[2001:db8::5efe:127.0.0.1]`. A public exploit exists and a patch is available upstream, though no CISA KEV listing is recorded at time of analysis.
Incorrect authorization in zevorn rt-claw up to version 0.2.0 allows remote unauthenticated attackers to bypass access controls in the Swarm RPC Receiver component, enabling unauthorized read, write, and availability impact against affected deployments. The flaw resides specifically in the handle_rpc_request function within claw/services/swarm/swarm.c, where authorization logic fails to correctly validate the calling actor. A publicly available proof-of-concept exploit exists, the project has not responded to responsible disclosure, and no patch has been released, leaving all installations on or below v0.2.0 without a vendor-provided fix.
Server-side request forgery in zevorn rt-claw up to version 0.2.0 allows remote unauthenticated attackers to forge arbitrary HTTP requests via the `receiver_thread` function within the swarm service's `http_request` component (`claw/services/swarm/swarm.c`). The CVSS 4.0 vector confirms fully remote, unauthenticated, low-complexity exploitation with no user interaction required. A public proof-of-concept exists via GitHub issue #140, and the vendor had not responded to the coordinated disclosure at the time of reporting - no patch is available.
Server-side request forgery in zevorn rt-claw up to version 0.2.0 allows unauthenticated remote attackers to manipulate the url argument passed to the claw_net_get and claw_net_post functions in claw/tools/tool_net.c, causing the server to initiate arbitrary outbound HTTP requests. This can be leveraged to probe internal network resources, bypass perimeter controls, or interact with backend services not otherwise exposed. No public exploit identified at time of analysis beyond publicly available exploit code, and the vendor has not responded to the coordinated disclosure made via GitHub issue #139.
Server-side request forgery in rt-claw up to 0.2.0 allows unauthenticated remote attackers to manipulate the `url` argument in the `claw_net_get` and `claw_net_post` HTTP request functions, coercing the server into issuing arbitrary outbound requests to internal or external resources. A proof-of-concept exploit has been publicly disclosed via GitHub issue #134. No vendor patch exists - the project maintainer was notified through responsible disclosure but has not responded, leaving deployments with no official fix path.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /edit_rooma.php endpoint to remote unauthenticated database manipulation via the unsanitized ID parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions. A public exploit exists on GitHub, and publicly available exploit code exists - though this has not yet been confirmed in CISA KEV as actively mass-exploited.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/edit_room1.php` endpoint to remote unauthenticated database manipulation via the unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special preconditions - any network-reachable instance is vulnerable. A public proof-of-concept exploit is available on GitHub, materially lowering the barrier to attack; however, no CISA KEV listing has been identified at time of analysis.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authenticated OWNER or EDITOR user embed malicious SurrealQL inside unescaped table or field names that executes when a higher-privileged operator re-imports the CLI-exported backup, yielding root-level takeover of the instance. Reported by VulnCheck and discovered during a cure53 audit, it also enables a universal second-order injection against co-tenanted applications that let end users define custom tables or fields, even when query parameters are otherwise sanitized. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor and cure53 both rate the impact Critical (CVSS 4.0 base 9.4).
Session hijacking and keystroke injection in the urwid Python library's web display backend (urwid/display/web.py) let attackers take over active web terminal sessions and reach OS-level code execution with the session owner's privileges. The urwid_id session token is generated with Python's non-cryptographic Mersenne Twister PRNG, so a remote attacker who observes roughly 334 session IDs (e.g. via the X-Urwid-ID response header) can reconstruct PRNG state and predict every past and future token, while any local user can read the same token from world-listable FIFO filenames in /tmp. No public exploit has been identified at time of analysis; the issue was reported by VulnCheck and carries a 9.2 (CVSS 4.0) severity.
Directory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated network users bypass file path validation to reach files outside intended directories. Rated CVSS 8.8, the flaw is exploitable remotely by any authenticated user (PR:L) and the vendor scores full high confidentiality, integrity, and availability impact, implying potential arbitrary file read and/or write on the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in VMware Avi Load Balancer exposes organizations running versions from 22.1.1 through 32.1.1 to arbitrary code injection by low-privileged authenticated users with network access. The flaw is classified as CWE-94 code injection, meaning attacker-supplied input reaches an execution context without adequate sanitization. Broadcom has released patches across all affected branches; no public exploit code has been identified at time of analysis, and the EPSS score of 0.68% (48th percentile) reflects modest current exploitation probability despite the high CVSS 8.8 rating.
Remote code execution in VMware Avi Load Balancer exposes the Avi Control Plane to arbitrary code execution by any low-privileged, network-connected user, stemming from a code injection flaw (CWE-94) in the controller. Multiple major version branches from 22.1.1 through 32.1.1 are confirmed affected, with vendor-released patches available across all branches. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.8 rating and full high-impact triad (C:H/I:H/A:H) make this a high-priority patch target for any deployment where the control plane is network-reachable.
Privilege escalation in VMware Avi Load Balancer exposes authenticated, network-accessible users to remote code execution across a wide version range spanning 22.1.x through 32.1.x. The CVSS 8.8 rating reflects low-complexity, low-privilege network exploitation yielding full confidentiality, integrity, and availability impact on affected systems. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.39% (31st percentile) confirms limited active exploitation pressure at time of analysis.
Authentication bypass in FalkorDB QueryWeaver lets unauthenticated attackers hijack any existing account by submitting a signup request containing the victim's email address, whereupon the server issues a valid session token bound to the victim's identity. No credentials, prior access, or user interaction are required, making this a pre-auth account takeover. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available.
Stack-based buffer overflow in Shibby Tomato 1.28 router firmware lets an authenticated attacker corrupt memory through the Scheduler Name Handler (function sub_42537C) by supplying an overlong scheduler-name argument, enabling likely remote code execution on the device. The affected build is a niche, community-maintained MIPS router firmware distribution that has been retired and superseded by FreshTomato. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the VulDB-assigned CVSS 4.0 score is 8.7.
Stack-based buffer overflow in Shibby Tomato router firmware (version 1.28, RT-N5x MIPSR2 Build 124) lets an authenticated remote attacker corrupt the stack through the sub_40BB50 function that renders /proc/webmon_recent_domains, potentially achieving arbitrary code execution on the MIPS-based router. The flaw is remotely reachable and, per the CVSS 4.0 vector, requires low privileges (PR:L) but no user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no KEV listing; this Tomato fork has been superseded by FreshTomato, so no upstream patch is expected.
Denial of service and heap corruption in OpenPLC_v3 lets an authenticated web-interface user overflow the 100-byte MB_device.dev_name buffer via an oversized device_name field on the /modbus endpoint. Because getData() in modbus_master.cpp copies delimiter-bounded characters with no bounds check, a ~200-byte value writes 100 bytes past the allocation, overwriting adjacent Modbus config fields (protocol, dev_address, ip_port) and crashing the PLC control loop. No public exploit identified at time of analysis, though VulnCheck published a detailed technical advisory; the affected repository is archived and no vendor-released patch was identified.
Out-of-bounds write in Shibby Tomato 1.28 (RT-N5x MIPSR2 Build 124) router firmware lets an authenticated attacker corrupt memory in the setup_conntrack routine of /sbin/rc by manipulating the ct_tcp_timeout argument. The flaw (CWE-787) is reachable over the network and carries a CVSS 4.0 base of 8.7, but no public exploit is identified at time of analysis and it is not on CISA KEV. The affected project is end-of-life and superseded by FreshTomato, so no upstream fix is expected.
Arbitrary Python code execution in scikit-hep uproot (uproot5) arises because the library dynamically generates and compiles reader classes from a ROOT file's TStreamerInfo records, interpolating file-controlled streamer metadata (such as streamer element names) into generated Python source without repr()/!r safe quoting. A crafted ROOT file can inject expression-breaking content that is evaluated in the process opening the file, giving code execution to whoever processes attacker-supplied ROOT data. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authorization bypass in VMware Avi Load Balancer (branches 22.1.x, 30.x, 31.x, and 32.1.1) allows a network-based actor holding low-privilege credentials to reach a limited subset of the Avi Control Plane without proper authorization. Rated CVSS 8.3 by VMware/Broadcom with CWE-863 (Incorrect Authorization), the flaw exposes control-plane functionality that should be gated behind higher authorization. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical rather than observed.
Local privilege escalation in VMware (Broadcom) Avi Load Balancer allows a user who already has local access to the appliance to elevate to root and run arbitrary code. It affects the 22.1.x, 30.x, 31.x and 32.1.x release lines, is CVSS 7.8, and was reported by the vendor. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash the per-connection server child with a single malformed packet. The flaw stems from an unsigned integer underflow and a size_t-to-int truncation that fools the allocator into returning a ~512-byte block while the caller believes it received ~4 GB, causing an attacker-controlled heap overflow past a 544-byte allocation. Publicly available exploit code exists (a VulnCheck proof of concept) demonstrating reliable DoS; heap metadata corruption and consequences beyond DoS are theorized but not demonstrated, and there is no public exploit identified for code execution.
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with OWNER or EDITOR rights define a custom function containing nested FOR loops that bypasses per-loop iteration limits and consumes all server CPU, ignoring configured query timeouts. The multiplicative iteration count (e.g. several nested loops of 1,000,000 each) monopolizes the process until it is manually killed, blocking all other queries and new connections. Discovered during a cure53 audit; no public exploit identified at time of analysis and it is not on CISA KEV, though the technique is trivially reproducible from the advisory.
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted query whose result contains a null byte to the /sql HTTP endpoint. The null byte triggers an uncaught exception during JSON serialization of the query response in the net module, terminating the process and any application that depends on it. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the reported CVSS 4.0 base score is 7.1 (availability-only impact).
Denial of service in SurrealDB before 2.2.2 lets an authenticated user crash the database by calling the string::replace function with a regex pattern that produces an unbounded output string, exhausting server memory. The flaw spans the 2.0.x, 2.1.x, and 2.2.x release lines and was discovered during a cure53 security audit; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is availability-only with no confidentiality or integrity loss, rated CVSS 4.0 7.1 High.
Internal file disclosure in Stoat for Android allows any process capable of local intent dispatch to exfiltrate the app's internal storage - including the local message database and cached authentication tokens - through an unvalidated URI passed to the exported ShareTargetActivity. The attacker triggers a single, deceptive share interaction in which the victim selects a destination channel while the Stoat composer conceals the true nature of the attachment, showing only 'attachment' with no filename. No public exploit code has been identified and this CVE is not listed in CISA KEV; the upstream fix is confirmed via commit 50d5f5143940809ebb5a61e5f507c956c33aa970, though a specific patched release version is not independently confirmed.
Server-side request forgery in Sipeed PicoClaw through version 0.2.9 allows low-privileged remote attackers to cause the server to issue outbound HTTP requests to the RFC 2544 benchmark address range (198.18.0.0/15), which was omitted from the private/restricted IP blocklist in the `isPrivateOrRestrictedIP` function. The CVSS 4.0 score of 2.1 reflects the narrow impact scope and authentication requirement (PR:L). A publicly available proof-of-concept exists via GitHub issue #3077, and an upstream patch has been committed but no tagged release version has been independently confirmed as shipping the fix.
Missing authorization in PicoClaw's Feishu group message handler allows authenticated remote attackers to perform unauthorized actions by sending crafted group messages through the `handleMessageReceive` function in `pkg/channels/feishu/feishu_64.go`. All versions up to and including 0.2.9 are affected. A publicly available proof-of-concept exploit exists via GitHub issue #3082, but the issue was closed automatically due to inactivity - indicating no vendor-supplied fix has been released. No public exploit identified at time of analysis as actively exploited in the wild.
Incorrect authorization in Sipeed PicoClaw's WeCom Group Message Handler allows authenticated remote attackers to bypass access controls and perform unauthorized actions on affected deployments running version 0.2.9 and earlier. The flaw resides in the dispatchIncoming function within pkg/channels/wecom/wecom.go, where incoming group messages are processed without properly verifying the caller's authorization level. A publicly available proof-of-concept exploit exists, though no CISA KEV listing indicates exploitation remains opportunistic rather than widespread at time of analysis.
Server-side request forgery in zhayujie CowAgent up to version 2.1.1 allows low-privileged authenticated users to direct the server to issue arbitrary HTTP requests by supplying a crafted URL to the WebFetch.execute function, enabling internal network reconnaissance and cloud metadata credential theft. The WebFetch tool lacked any IP-range validation, leaving loopback, RFC1918, link-local, and cloud metadata endpoints (e.g., 169.254.169.254) fully reachable from the server. A public proof-of-concept exists (GitHub issue #2889); the CVSS 4.0 threat metric E:P confirms exploit code availability, though no CISA KEV listing indicates confirmed widespread active exploitation.
Server-side request forgery in GoClaw through 3.15.0-beta.32 allows authenticated remote attackers to bypass the SSRF blocklist in the web_fetch component by targeting IP addresses in the RFC 2544 benchmarking range (198.18.0.0/15) and the reserved-for-future-use range (240.0.0.0/4), which the `isPrivateIP` function in `internal/tools/web_shared.go` failed to block. A publicly available proof-of-concept exploit exists (GitHub issue #1218, corroborated by E:P in the CVSS 4.0 vector), though no CISA KEV entry confirms active widespread exploitation. The bypass is constrained by a PR:L requirement and by the rarity of infrastructure that routes these non-standard ranges to reachable internal services.
Authentication bypass by spoofing in AstrBot up to version 4.25.5 allows low-privileged remote attackers to impersonate other users by manipulating the Username argument in the OpenAPI chat_send endpoint. Affected is the function OpenApiRoute.chat_send in astrbot/dashboard/routes/open_api.py, exposing confidentiality, integrity, and availability at a limited level. A public proof-of-concept exploit exists on GitHub; the vendor did not respond to responsible disclosure, and no patch has been released.
Incorrect authorization in GoClaw's WebSocket Approval Endpoint allows low-privileged remote attackers to bypass access controls in the RequestApproval function, potentially approving privileged operations without proper authorization. All versions up to and including 3.13.2 of nextlevelbuilder/goclaw are affected. A public exploit has been disclosed via GitHub, though no CISA KEV listing confirms active exploitation at this time.
Name resolution bypass in GoClaw's exec approval subsystem allows remote low-privileged attackers to circumvent the binary execution allowlist. Affecting all versions up to and including 3.13.3-beta.3, the flaw resides in the matchesAllowlist and extractBin functions within internal/tools/exec_approval.go, where crafted input causes the allowlist check to resolve a name or reference incorrectly, permitting unauthorized binary execution. A publicly disclosed proof-of-concept exploit exists (GitHub issue #1213); no CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis.
Authorization bypass in AstrBot's dashboard API allows any authenticated low-privileged user to enumerate and read chat sessions belonging to other users by manipulating the Username parameter in the session-listing endpoint, affecting all versions up to and including 4.25.5. The vulnerable function `OpenApiRoute.get_chat_sessions` in `astrbot/dashboard/routes/open_api.py` fails to verify that the requesting user is authorized to access the target Username's session data (CWE-639 IDOR). A public proof-of-concept exploit exists on GitHub; no public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), though the low attack complexity and published POC materially lower the exploitation barrier.
Missing authorization on the Invoke Endpoint in nextlevelbuilder GoClaw up to version 3.13.2 allows low-privileged remote attackers to invoke tool functionality without proper permission checks. The flaw resides in the `ToolsInvokeHandler.ServeHTTP` function within `internal/http/tools_invoke.go`, where authorization is absent rather than bypassed cryptographically. A public proof-of-concept exploit is available via GitHub, lowering the bar for exploitation; however, this CVE is not currently listed in the CISA KEV catalog, so confirmed active exploitation has not been established at time of analysis.
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.2 allows remote low-privilege authenticated attackers to bypass binary execution controls by manipulating the isSafeBin function in internal/tools/exec_approval.go. The authorization logic flaw permits approval of binaries that should be restricted, with potential for unauthorized code execution within the tool's operational context - particularly impactful in pipeline or build automation deployments. A publicly available proof-of-concept exists (CVSS 4.0 E:P); the vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes authenticated users' ability to manipulate backend database queries via the `delid` parameter in `/prescriptionrecord.php`. Any instance accessible over the network is at risk of unauthorized data extraction or record manipulation - a significant concern given the sensitive patient and prescription data typically stored in such systems. Public exploit code is available on GitHub, and no vendor-released patch has been identified at time of analysis; exploitation is not confirmed in CISA KEV but the low attack complexity and public POC reduce the barrier to abuse.
Cross-site request forgery in Sipeed PicoClaw through version 0.2.9 allows a remote attacker to forge the initial admin password setup request against an uninitialized instance. The vulnerable handler at `/api/auth/setup` in `web/backend/api/auth.go` accepted POST requests without validating `Origin`, `Referer`, or `Sec-Fetch-Site` headers, enabling a malicious webpage to silently register attacker-controlled credentials on a victim's locally-running PicoClaw instance. A publicly disclosed exploit exists (GitHub issue #3072); no active exploitation is confirmed in CISA KEV.
Memory exhaustion in SurrealDB's scripting subsystem allows authenticated users to bypass the server's recursion depth limit by chaining native function calls with embedded JavaScript that issues new queries, triggering infinite recursion and depleting server memory. Affected versions span all SurrealDB releases before 2.0.5, 2.1.0-2.1.4, and 2.2.0-2.2.1, but only when the scripting capability is explicitly enabled via a non-default flag. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, any authenticated user on an exposed instance can reliably cause a denial of service.
Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `day` parameter of `/forexam.php`, which executes in a victim user's browser upon viewing the affected page. A public exploit proof-of-concept is available on GitHub, lowering the bar for exploitation. No patch has been identified at time of analysis; no public exploit identified at time of analysis in terms of KEV listing, though exploit code exists publicly.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows authenticated remote attackers to inject arbitrary JavaScript into the browsers of other users by manipulating the `sy` parameter in `/schoolyr.php`. The vulnerability is a stored or reflected XSS (CWE-79) in a PHP-based academic scheduling application. A publicly available exploit exists on GitHub, though no active exploitation has been confirmed by CISA KEV, and the low CVSS 4.0 score of 2.0 reflects the limited real-world impact constrained by authentication requirements and required user interaction.
Incomplete shell command blacklist validation in SafestClaw up to version 4.2.4 allows a local low-privilege attacker to bypass the ShellAction._validate_command restriction in the Built-in Web Interface, potentially executing unintended shell commands. A proof-of-concept has been publicly disclosed via GitHub issue #59, though the project maintainer actively disputes that the disclosed exploit demonstrates any concrete user-facing threat, noting the AI-generated POC fails to show actual harm and that the open-source codebase allows operators to customize or remove the allow list. No public exploit has been confirmed in CISA KEV, and the CVSS 4.0 base score of 1.9 reflects the minimal assessed real-world impact.
Incorrect authorization in GoClaw's execution approval module (versions up to 3.13.2) allows a high-privileged attacker on an adjacent network to bypass the binary execution allowlist enforced by the extractBin, RequestApproval, and matchesAllowlist functions. Despite the Authentication Bypass tag, exploitation is constrained to adjacent-network, high-privilege contexts per the CVSS 4.0 vector, limiting opportunistic abuse. A public proof-of-concept is available via the project's GitHub issue tracker, making exploitation accessible to any attacker who already meets the privilege and network prerequisites.
Inclusion of functionality from an untrusted control sphere (CWE-829) in Sipeed PicoClaw through version 0.2.9 allows a local low-privileged attacker to manipulate the NewContextBuilder function in pkg/agent/context.go, causing the application to load or execute functionality outside its intended control boundary. The impact is limited - partial confidentiality, integrity, and availability effects - but a publicly available proof-of-concept exploit exists. Critically, the vendor closed the disclosure issue on GitHub as 'not planned,' meaning no official patch will be released, leaving users without a vendor-supported remediation path.