Cross-site scripting in itsourcecode Courier Management System 1.0 allows remote, unauthenticated attackers to inject arbitrary client-side scripts via the `page` parameter of /index.php, requiring only that a victim user follow a crafted link. A publicly available proof-of-concept exploit exists, lowering the bar for abuse. No patch has been identified at time of analysis; no CISA KEV listing, but the public PoC and low attack complexity make this actionable for defenders protecting user sessions.
Code injection in zevorn rt-claw up to version 0.2.0 allows remote attackers to execute arbitrary code via the Telegram-to-AI Tool Execution Flow. The vulnerable function `tool_run_script_execute` in `claw/services/tools/script.c` fails to sanitize attacker-controlled input before passing it to script execution logic. A public proof-of-concept exploit has been released via GitHub issue #138, and the vendor has not yet responded to disclosure - no patch is available at time of analysis.
Path traversal in Croogo CMS up to version 4.0.7 allows remote authenticated attackers to escape the intended file management directory by supplying crafted path sequences to the Admin File Manager's FileManager::isEditable function in FileManager/src/Utility/FileManager.php. A public proof-of-concept exploit exists and has been disclosed via a researcher advisory, while the Croogo project has not responded to the responsible disclosure report and no patch has been released. The vulnerability carries a medium base score but the combination of a public PoC, unresponsive vendor, and no remediation path meaningfully elevates practical risk for any internet-exposed Croogo instance.
Cross-site scripting in code-projects Online Examination System 1.0 allows remote attackers to inject arbitrary JavaScript by manipulating the eid, n, or t parameters in the /account.php?q=quiz endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms unauthenticated remote exploitation requiring only passive victim interaction, consistent with a reflected XSS delivery via crafted link. A proof-of-concept exploit is publicly available on GitHub; this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation has been identified at time of analysis.
Out-of-bounds write in davenardella snap7 up to version 1.4.3 allows network-authenticated attackers to corrupt memory by supplying a crafted PDULength value during S7 protocol negotiation. The vulnerable function TSnap7Peer::NegotiatePDULength in src/core/s7_peer.cpp fails to enforce bounds on the PDULength argument, enabling writes beyond the allocated buffer boundary. A public proof-of-concept exploit is available on GitHub (issue #17), and the CVSS 4.0 E:P modifier confirms this - elevating practical risk above the medium base score, particularly in OT/ICS deployments where snap7 is commonly used to interface with Siemens S7 PLCs.
Authorization bypass in guohongze adminset 0.61 and earlier allows authenticated remote attackers to access or manipulate deployment resources belonging to other projects by substituting arbitrary project_id values in requests to the Delivery Deployment Endpoint (delivery/deli.py). This CWE-639 flaw - Authorization Bypass Through User-Controlled Key - is a classic IDOR pattern where the application accepts user-supplied object identifiers without verifying ownership. A public proof-of-concept exploit is available via GitHub issue #161, and the vendor has not responded to the responsible disclosure; no patch exists at time of analysis.
Authorization bypass in geex-arts django-jet up to version 1.0.8 allows remote low-privilege authenticated users to circumvent object-level access controls in the Dashboard Module's jet/dashboard/views.py via user-controlled key manipulation (CWE-639). An attacker with a valid Django session can substitute controlled identifiers in dashboard requests to access or modify resources belonging to other users beyond their intended authorization scope. A public proof-of-concept is available via GitHub issue #528, and no patch has been released - the project maintainer has not responded to the disclosure, leaving all users on affected versions permanently exposed.
Server-side request forgery in CordysCRM (1Panel-dev) up to version 1.4.1 allows authenticated remote attackers to coerce the application server into issuing outbound HTTP requests to arbitrary destinations by manipulating the `appSecret` parameter in the Third Party Edit Endpoint's `getSqlBotSrc` function. This can expose internal network services, cloud instance metadata endpoints, and other non-public resources to an attacker with only a low-privileged account. A public exploit has been disclosed (GitHub issue #2688), meaning exploitation requires minimal technical skill beyond valid credentials.
Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to manipulate the mkAddress parameter in the Third Party Endpoint's SSO token service, causing the application server to issue unauthorized HTTP requests to attacker-controlled destinations. The affected component is TokenService.java within the CRM's SSO integration layer, meaning exploitation could expose internal network topology or interact with internal services unreachable from the public internet. A public proof-of-concept exploit exists; the project vendor closed the issue report without acknowledging it as a valid security vulnerability, leaving no official remediation path confirmed.
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to bypass access controls via manipulation of the ExecTool.Execute function in credentialed_exec.go. The CVSS 4.0 vector confirms network-accessible exploitation requiring only low-privilege credentials, with limited but confirmed confidentiality, integrity, and availability impact on the vulnerable system. A publicly available proof-of-concept exploit exists (tracked in GitHub issue #1215), though the overall CVSS 4.0 base score of 2.1 reflects constrained real-world impact.
Cross-site request forgery in the OAuth Handler component of geex-arts django-jet (versions up to 1.0.8) allows remote attackers to perform unauthorized actions on behalf of authenticated users. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms this is remotely exploitable with no privileges but requires a victim to interact with an attacker-controlled resource. A publicly available proof-of-concept exists (GitHub issue #528), and the vendor has not responded to the coordinated disclosure, meaning no patch is available at time of analysis.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the `course` parameter of `/forCYS.php`, executing malicious code in the browser of any user who views the manipulated output. A public proof-of-concept exploit is available on GitHub (referenced via VulDB entry 380019), raising the practical risk above theoretical for any exposed instance. No active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 (Medium) reflects the authenticated and user-interaction requirements that limit widespread opportunistic abuse.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `course` argument in `/CYS.php`, which executes in the context of a victim user's browser upon interaction. A publicly available exploit exists, disclosed via a GitHub issue, confirming the vulnerability is reproducible. No active exploitation has been confirmed by CISA KEV, but the low attack complexity and available proof-of-concept increase opportunistic risk.
Stored cross-site scripting in Pluck CMS 4.7.21 and earlier allows an authenticated administrator to inject persistent malicious scripts via the Info argument of the Albums module, which subsequently execute in the browsers of users who view the affected content. The flaw originates from misuse of htmlspecialchars_decode in albums.admin.php, which reverses HTML entity encoding on attacker-controlled input rather than sanitizing it, allowing script payloads to survive into rendered HTML. A public proof-of-concept exploit exists on GitHub and no vendor patch has been released; the maintainer has not responded to the disclosure.
Race condition in awesto django-shop's Purchase Stock Handler allows a remotely authenticated attacker with low privileges to manipulate inventory data by triggering concurrent purchase requests. Affected versions span all releases up to and including 1.2.4. A publicly available proof-of-concept exists in the project's GitHub issue tracker, and the vendor has not responded to responsible disclosure - no patch has been released. EPSS data is absent, but the CVSS 4.0 score of 2.3 reflects the high attack complexity and limited impact scope.
Race condition in Allegro Ralph's hostname allocation handler allows adjacent, low-privileged attackers to corrupt hostname assignment logic, producing duplicate or incorrect hostname entries. The flaw resides in the AssetLastHostname.increment_hostname function within src/ralph/assets/models/assets.py, where concurrent manipulation of the counter argument creates a time-of-check/time-of-use window. The project maintainers were notified via an issue report but have not yet responded, leaving no available patch; a proof-of-concept exploit has been publicly disclosed on GitHub. No public exploit identified at time of analysis beyond the PoC, and KEV status is not confirmed.
IP allowlist bypass in Sipeed PicoClaw's First Run Setup middleware allows remote unauthenticated attackers to circumvent CIDR-based access controls by injecting a spoofed trusted IP address into the `X-Forwarded-For` header, exploiting the pre-patch logic that blindly trusted the leftmost header value without validating intermediate proxies. All versions through 0.2.9 are affected via the `web/backend/middleware/access_control.go` component. A public proof-of-concept is confirmed (CVSS 4.0 E:P), though high attack complexity and the narrow setup-phase window substantially limit real-world impact; no active exploitation has been confirmed in CISA KEV.
Race condition in django-tastypie's throttle module (versions up to 0.15.1) allows authenticated remote users to bypass API rate limiting controls by exploiting a time-of-check to time-of-use (TOCTOU) window in the CacheThrottle and CacheDBThrottle classes. The CVSS 4.0 score of 2.3 with high attack complexity (AC:H) and low-privilege requirement (PR:L) reflects the limited real-world risk; impacts are constrained to minor information disclosure and throttle bypass without subsequent-system effects. No public exploit has been identified and the project maintainers have not yet responded to the disclosure.
Improper exception handling in devpush's storage reset worker exposes a limited integrity-impact flaw for adjacent network attackers with low-privilege access. The `reset_storage` function in `app/workers/tasks/storage.py` fails to correctly check or handle exceptional conditions (CWE-703), meaning that under specific error scenarios, the storage reset process may enter an inconsistent or exploitable state. With a CVSS 4.0 score of 2.1, no public exploit code identified, and no active exploitation confirmed, this represents a low-priority finding that nonetheless warrants a vendor patch given the unresponsive upstream maintainer.