Incorrect authorization on REST API endpoints in the All in One SEO WordPress plugin (before 4.9.9) allows authenticated users with low-level roles such as Contributor to overwrite or reset the site-wide AI integration configuration. The flaw is classified under CWE-863 (Incorrect Authorization), meaning the plugin registers REST API routes without enforcing appropriate role checks before permitting state-modifying operations. A publicly available proof-of-concept exists per WPScan, though no active exploitation has been confirmed by CISA KEV. The practical blast radius is limited to integrity of the plugin's AI settings, with no evidence of confidentiality or availability impact.
File Browser's share API (confirmed vulnerable through v2.63.16) leaks bcrypt password hashes and bypass tokens for password-protected shares via unfiltered JSON serialization of the internal `Link` storage struct. Authenticated users receive these secrets for their own shares on every create or list call, while administrators calling `GET /api/shares` obtain the password hash and bypass token for every user's shares across the entire instance. A working proof-of-concept is publicly available against the v2.63.15 Docker image; the exposed bypass token grants direct, password-free access to any protected share without cracking, while the bcrypt hash enables offline recovery of reused credentials.
Directory traversal in FileThingie v.2.5.7 allows a remote, low-privileged attacker to read arbitrary files outside the application's intended directory boundary via a crafted HTTP request. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-accessible exploitation with high confidentiality impact and no write or availability consequences. No confirmed active exploitation (CISA KEV) is recorded, but a public vulnerability research repository referencing this CVE exists, suggesting proof-of-concept material may be available.
Stack-based buffer overflow in the rpcinfo client utility (part of the rpcbind package) crashes the client process when querying a malicious or compromised rpcbind server using the `-l` flag. Address data returned by the server is copied into a fixed-size stack buffer without bounds validation (CWE-121), enabling a server-side attacker to trigger a denial of service against any administrator or script that runs `rpcinfo -l` against their controlled endpoint. No public exploit identified at time of analysis, and no CISA KEV listing; impact is confined to client-side availability with no confidentiality or integrity exposure.
Out-of-bounds memory corruption in kronosnet's packet reassembly engine (versions ≤ 1.34) enables a remote, unauthenticated network attacker to crash the kronosnet process or cause heap corruption by transmitting malformed fragmented packets carrying invalid sequence numbers. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10, and Red Hat OpenShift Container Platform 4, making this relevant to HA clustering infrastructure that depends on kronosnet for inter-node communication via Corosync or Pacemaker. No public exploit code and no active exploitation have been identified at time of analysis, though the network-accessible, no-privilege-required attack path elevates operational risk for clustered environments despite the AC:H complexity rating.
NULL pointer dereference in NanoMQ 0.24.11 and earlier allows an authenticated REST API user to crash the entire broker process with a single malformed HTTP request. The `properties_parse()` function fails to validate that `user_properties` is a JSON object before iterating its elements, calling `strlen()` on a NULL pointer and causing a fatal segmentation fault. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; a vendor patch is available in version 0.24.14.
Unauthenticated access to FreeScout's email open-tracking endpoint (`GET /thread/read/{conversation_id}/{thread_id}`) allows remote attackers to enumerate valid conversation and thread IDs and manipulate the `opened_at` timestamp on arbitrary threads. All FreeScout deployments prior to version 1.8.219 are affected. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
rsync client versions prior to 3.4.3 crash deterministically when connecting to a malicious sender due to an out-of-bounds array read in recv_files(). Any client performing a standard recursive pull - the default behavior since protocol version 30 - against an attacker-controlled rsync server or URL is exposed without any special victim-side configuration. Impact is strictly denial-of-service (client crash via SIGSEGV); remote code execution has been explicitly ruled out on glibc x86-64 Linux, though non-glibc allocators remain unaudited. No public exploit identified at time of analysis; vendor-released patch is available in version 3.4.3.
NanoMQ's MQTT v5 SUBSCRIBE packet parser fails to enforce the mandatory 1-byte Subscription Options field, enabling remote unauthenticated attackers to submit malformed SUBSCRIBE packets that the broker silently accepts and installs into internal subscription state. Under a precisely crafted packet-length condition, the same defect manifests as a 1-byte heap-buffer-overflow (CWE-125), confirmed by ASAN, which can crash the broker and disrupt all connected MQTT clients. All NanoMQ releases up to and including 0.24.14 are affected; no confirmed active exploitation (KEV) or public exploit code has been identified at time of analysis, though the unauthenticated network attack surface warrants prompt remediation in internet-exposed deployments.
Sandbox path containment bypass in Network-AI's AgentRuntime (npm package `network-ai` by jovancoding) allows any low-privileged agent or user with access to `AgentRuntime.readFile()` or `AgentRuntime.listDir()` to read or enumerate files outside the configured `basePath` sandbox by targeting sibling directories whose names share the sandbox's string prefix. Versions 5.12.1 and earlier are confirmed vulnerable (CPE: cpe:2.3:a:jovancoding:network-ai:*:*:*:*:*:*:*:*, EUVD-2026-46018). A working proof-of-concept is included in the GitHub security advisory GHSA-jvcm-f35g-w78p; no public exploit confirmed in active exploitation and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in HeyForm's unauthenticated file upload endpoint allows remote attackers to execute arbitrary JavaScript in victims' browsers by uploading SVG files containing embedded scripts. The `/api/upload` endpoint accepted SVG uploads without authentication, stored them in the static assets directory, and Express's serve-static served them with `Content-Type: image/svg+xml`, enabling script execution in the HeyForm domain context when a victim views the file URL. No active exploitation is confirmed (not in CISA KEV); vendor-released patch 3.0.0-rc.7 is available.
Stored Cross-Site Scripting in the Spectra Legacy - Gutenberg Blocks plugin for WordPress (all versions through 2.19.28) allows low-privileged authenticated attackers to plant persistent malicious scripts via the image block that execute in any visitor's browser. The vulnerability resides in insufficient sanitization and output escaping within the `uagb/image` block renderer, specifically traced by Wordfence to `class-uagb-image.php` and `block.php`. With Contributor-level access - a role available on virtually any multi-author or membership-enabled WordPress site - an attacker can inject payloads that persist until removed, affecting every subsequent visitor. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated triggering of all configured scheduled jobs in Grav CMS's scheduler-webhook plugin is possible due to a null short-circuit logic flaw in webhook token validation, allowing any network-reachable attacker to execute operator-defined commands under the web server process account via a single POST request. The affected component is the scheduler-webhook plugin for Grav CMS, a PHP flat-file CMS; the CVSS 4.0 vector (AC:H/AT:P) confirms exploitation requires the plugin to be installed with configured jobs and an exposed endpoint - not a default Grav deployment. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Server-side request forgery in HyperDX before 2.31.0 allows authenticated team members to redirect the application server to arbitrary internal network destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint, which performed no URL validation, protocol restriction, or private IP blocklist enforcement. The endpoint further reflected raw error response bodies back to the caller, enabling exfiltration of responses from internal APIs, container services, and cloud provider instance metadata endpoints such as AWS IMDSv1. No public exploit code has been identified and the vulnerability is not in CISA KEV, but the CVSS 4.0 vector assigns High confidentiality impact to subsequent systems (SC:H), reflecting serious internal infrastructure exposure potential for cloud-hosted deployments.
Server-side request forgery in Huginn through 2022.08.18 allows any authenticated user to weaponize the ScenarioImport fetch_url method to issue arbitrary outbound HTTP requests from the server. An attacker with low-privilege access can probe internal network topology, enumerate ports via timing and error signatures, and - critically - reach cloud Instance Metadata Service (IMDS) endpoints such as AWS 169.254.169.254 to harvest IAM credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the upstream fix (PR #3684) and disclosure by VulnCheck confirm the vulnerability.
Windu CMS 4.1 stores user passwords using MD5 and SHA1 with a static salt, providing negligible resistance against offline cracking once password hashes are obtained. An attacker who acquires the credential database - through SQL injection, a backup exposure, or any secondary breach - can recover plaintext passwords rapidly using precomputed rainbow tables or GPU-accelerated cracking tools. No active exploitation has been confirmed (no CISA KEV listing, no public proof-of-concept), though the weakness is structurally severe: static salts eliminate the primary defense against precomputation attacks and MD5/SHA1 are high-throughput algorithms entirely unsuited to password storage.
Incorrect authorization in Vercel's @ai-sdk/harness-codex package (prior to 1.0.29) allows untrusted code executing inside a Codex CLI sandbox to invoke arbitrary host-exposed tools - including secret lookups, deployment operations, and cloud API calls - without a corresponding model-authorized tool-call event. The relay server validates incoming requests solely by checking whether the requesting process's command line contains the Codex CLI shim path via Linux /proc, a condition any sandbox process can trivially forge by including the shim path in its own argv. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the supply-chain threat vector via malicious npm lifecycle hooks or build scripts is realistic for developer environments processing untrusted repositories.
Sandbox authorization bypass in Vercel's `@ai-sdk/harness-opencode` (all versions prior to 1.0.28) permits untrusted code executing inside the OpenCode sandbox to invoke arbitrary host-exposed tools — including secret lookups, deployment operations, and cloud API calls — without a corresponding model-authorized tool-call event. The flawed process-path fallback reads `/proc/<pid>/cmdline` on Linux to verify the requesting process's command line contains the `host-tool-mcp.mjs` script path, a check that sandboxed attacker-controlled code can satisfy or spoof. No public exploit code has been identified at time of analysis, and the issue is remediated in v1.0.28 by replacing the path check with short-lived one-time authorization tokens bound to bridge-observed model events.
Rsync daemon versions prior to 3.4.3 expose a symlink race condition (TOCTOU) in path-based system calls - specifically chmod() and chown() - that prior security patches overlooked when fixing analogous races in open(). When deployed with 'use chroot = no', an attacker with local filesystem write access to an exported module directory can redirect these calls through a symlink to files outside the module boundary, altering permissions, ownership, or timestamps on otherwise inaccessible files. No public exploit has been identified at time of analysis, and the issue is addressed in rsync 3.4.3.
Reflected XSS in Astro's view transition directive rendering allows arbitrary JavaScript injection when a developer passes attacker-controlled input into transition:persist, transition:scope, or transition:persist-props directives on client-hydrated islands. Affected versions span astro 3.10.0 through 7.0.4 (exclusive), covering roughly four major version lines. A public proof-of-concept is included in the GHSA-7pw4-f3q4-r2p2 advisory; no CISA KEV listing or confirmed in-the-wild exploitation is recorded at time of analysis, and the real-world attack surface is narrowed significantly by the precondition that the application developer must have written code that reflects untrusted request input directly into one of these directives.
Reflected Cross-Site Scripting in Best Practical RT versions 5.0.4-5.0.9 and 6.0.0-6.0.2 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of an authenticated RT user by inducing that user to visit a specially crafted URL. The CVSS vector's Changed scope (S:C) indicates the injected script can impact browser security context beyond the vulnerable RT component itself, including potential session hijacking or in-browser data exfiltration. Vendor-released patches are confirmed in versions 5.0.10 and 6.0.3 (released 2026-05-20); no active exploitation has been identified at time of analysis.
Reflected DOM XSS in dataCycle-CORE versions up to and including 25.07.3 allows unauthenticated remote attackers to inject arbitrary HTML into flash notification toast components via crafted links to public routes such as `/docs`. The frontend toast component renders attacker-supplied content directly via `innerHTML` without sanitization, enabling script execution in the victim's browser across the normal application layout - not limited to isolated or admin-only views. No active exploitation or public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity network vector substantially lowers the bar for opportunistic abuse.
Cross-site scripting in fuint Member Marketing System v1.0 and earlier allows remote unauthenticated attackers to inject malicious JavaScript through the ClientMessageController component, executing within authenticated users' browser sessions when they view the compromised content. The CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-accessible, low-complexity injection requiring no authentication, with scope change indicating browser-context impact beyond the originating request. No public exploit has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stored cross-site scripting in Mettle SendPortal 3.0.1 and earlier enables persistent JavaScript injection through the content parameter of the /templates endpoint, with payloads executing in every browser that subsequently renders the poisoned template. A public proof-of-concept is hosted on GitHub Gist, providing low-effort reproduction for threat actors. Despite CISA SSVC assessing current exploitation as none, the scoped impact (S:C) means a single injected template can cascade across all users who view it, making this a meaningful session-hijacking or credential-harvesting vector for organizations relying on SendPortal for email campaign management.
Reflected Cross-Site Scripting in RT (Request Tracker) 6.0.0 through 6.0.2 allows an unauthenticated network attacker to execute arbitrary JavaScript in an authenticated user's browser session by inducing that user to visit a crafted URL. The CVSS:3.1 scope-change flag (S:C) confirms the payload crosses from the RT application context into the victim's browser, enabling session token theft or unauthorized RT actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor-released fix is RT 6.0.3, published 2026-05-20.
Reflected cross-site scripting in a WSO2 product allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing an unsanitized parameter. When a victim user clicks the attacker-controlled link, the injected script executes in the victim's browser under the application's origin, enabling UI manipulation, phishing redirects, and extraction of non-cookie browser data. Session hijacking impact is partially mitigated because session cookies are protected by the httpOnly flag, though other sensitive browser-accessible data remains at risk. No public exploit or KEV listing has been identified at time of analysis.
Open redirect in Hikashop, the Joomla e-commerce extension, affects all versions from 1.0.0 through 6.5.1 and allows remote unauthenticated attackers to craft legitimate-looking store URLs that silently forward victims to arbitrary external destinations. Exploitation requires victim interaction (a clicked link), making this a phishing and credential-harvesting enabler rather than a direct infrastructure threat. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at just 0.13% (3rd percentile), consistent with SSVC's classification of exploitation status as none.
Path traversal in Network-AI's EnvironmentManager.restore() allows a local authenticated caller to copy arbitrary directories from outside the designated backups directory into any environment data directory. All versions prior to 5.12.2 (confirmed in 5.12.1) are affected, as the backupId parameter is concatenated with path.join() without containment checks, and the restore path is reachable by default through the bundled CLI. A working proof-of-concept is publicly documented in the GHSA advisory; no CISA KEV listing was identified at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescriptionorderreport.php` endpoint to database manipulation via the unsanitized `delid` parameter, exploitable by remote authenticated attackers. A publicly available proof-of-concept (GitHub ltranquility/submit_vuln issue #10) confirms exploitability; the CVSS 4.0 E:P metric corroborates this. No CISA KEV listing exists, and real-world impact is bounded by the low-privilege authentication prerequisite and the niche deployment footprint of this educational PHP codebase.
Cookie injection in Adminer before 5.4.3 allows network-accessible, unauthenticated attackers to manipulate Set-Cookie path attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header, enabling downgrade of SameSite protection and subsequent cross-origin authenticated requests against victim sessions. Exploitation is gated on a misconfigured reverse proxy that forwards attacker-controlled header values and requires passive user interaction (UI:P per CVSS 4.0), making this a realistic but non-trivial attack path. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis; vendor-released patch is available as version 5.4.3.
Denial of service in SurrealDB's embedded JavaScript scripting engine allows any query-executing user - including unauthenticated guests when guest access is enabled alongside scripting - to immediately crash the server process by passing an oversized string to the QuickJS-NG v0.8 runtime for compilation, triggering a null pointer dereference. The crash requires a manual operator restart with no graceful shutdown, and cannot be leveraged for code execution or data compromise. The attack is constrained to instances where the non-default `--allow-scripting` capability is active; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Buffer underflow in HDF5 library versions through 1.14.6 corrupts memory when H5Iget_name is called with a size parameter of zero on a group identifier, writing a null terminator before the intended buffer boundary and potentially crashing the host application. Applications that ingest attacker-supplied HDF5 files and expose user-controlled size values to H5Iget_name face availability disruption and, under specific heap layouts, possible disclosure of adjacent memory contents. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 5.9 reflects the high attack complexity and required active user interaction that meaningfully constrain real-world exploitation.
Out-of-bounds read in HDF5 (all versions prior to 2.0.0) is triggered when parsing a maliciously crafted file whose array datatype metadata violates the internal invariant that element_size × nelem must equal the stored full datatype size. When a victim opens such a file, the HDF5 parser reads beyond its intended buffer boundary, causing application crash or potential memory disclosure. No active exploitation is confirmed in CISA KEV, but SSVC intelligence confirms a POC exists, and the vendor has released a patch in version 2.0.0.
Unauthenticated access to the ApprovalInbox HTTP server in Network-AI 5.0.0-5.12.1 allows any party that can reach the inbox port to enumerate pending agent approvals and approve or deny them without operator consent, completely defeating the human-in-the-loop Approval Gate designed to gate high-risk operations such as shell commands and file writes. Exploitation via CSRF is possible against the default 127.0.0.1 binding because the server unconditionally sets Access-Control-Allow-Origin: * on all routes, including state-changing POST endpoints, enabling any website the operator visits to silently submit approval requests through their browser. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available as of v5.12.2.
Hidden field injection in HeyForm's form submission API allows anonymous submitters to bypass server-side schema validation and store arbitrary key/value pairs - including XSS payloads and forged authorization metadata - directly into submission records. All HeyForm deployments prior to version 3.0.0-rc.9 are affected. The injected data is subsequently forwarded verbatim to every registered webhook integration, enabling downstream system poisoning and stored XSS against any admin interface that renders submission data. SSVC rates this as automatable with a POC exploit available; no KEV listing at time of analysis.
Arbitrary host file disclosure in BuildKit's WCOW (Windows Container on Windows) worker mode allows an untrusted build author to read any file reachable by the BuildKit daemon process. By placing NTFS directory junctions inside the cache mount root - a technique the `source=` selector fails to detect on Windows - a malicious Dockerfile can redirect cache access to traverse outside the container's expected filesystem boundary. This affects any multi-tenant or shared CI/CD environment running a WCOW-configured BuildKit daemon where untrusted users can submit builds; no active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Incorrect error-path logic in the Linux kernel's i2c-i801 SMBus driver allows a local, low-privileged user to trigger a hardware state machine corruption leading to a system-wide hung task panic. When i801_check_pre() returns -EBUSY because the BIOS/ACPI firmware legitimately holds the SMBus controller, the driver unconditionally writes to SMBHSTSTS hardware registers without owning the controller, destroying the firmware's in-progress transaction and permanently corrupting the SMBus state machine. This produces an infinite 'SMBus is busy' error log flood, causes a console livelock that starves processes competing for mmap_lock, and ultimately triggers the hung task watchdog. No public exploit is identified at time of analysis; EPSS is 0.17% (6th percentile) and the vulnerability is not in CISA KEV.
NULL pointer dereference in the Linux kernel XFS log recovery path allows a local attacker to crash the kernel by mounting a crafted XFS filesystem image. The flaw exists in xlog_recover_reorder_trans() at fs/xfs/xfs_log_recover.c:1836, where a committed log transaction containing zero regions leaves ri_buf NULL, causing a fatal dereference when ITEM_TYPE() is called during recovery. EPSS is 0.16% (5th percentile) and no active exploitation has been observed; the vulnerability was discovered through an AI-assisted code audit, not in-the-wild activity.
NULL pointer dereference in the Linux kernel's DualPI2 traffic scheduler crashes the kernel when GSO segmentation accounting mismatches occur under a QFQ parent queueing discipline. Systems running Linux kernels prior to 6.18.39, 7.1.4, or 7.2-rc1 with DualPI2 configured as a child of QFQ are vulnerable to a local denial-of-service via kernel panic. No public exploit code exists and EPSS is 0.15% (5th percentile), reflecting the niche configuration required; however, the availability impact is total (kernel crash) when conditions are met.
Kernel panic via NULL dereference in the Linux kernel BPF subsystem affects systems compiled with CONFIG_BPF_LSM=y where the BPF LSM is not activated at boot. A locally authenticated user with low privileges can create a BPF_MAP_TYPE_INODE_STORAGE map under this misconfigured state, causing bpf_inode() to alias the struct rcu_head.func callback pointer; when map cleanup nulls this aliased pointer, rcu_do_batch() subsequently attempts an instruction fetch at address 0x0, triggering an immediate kernel panic and complete system denial of service. No public exploit is identified at time of analysis; EPSS sits at 0.14% (4th percentile), consistent with the narrow triggering conditions required.
NULL pointer dereference in the Linux kernel's team network driver (net/team/team_core.c) allows a local attacker with CAP_NET_ADMIN to crash the kernel by racing a mode change against concurrent packet transmission. The vulnerability arises because __team_change_mode() wipes team->ops via memset() before reinstalling safe dummy handlers, creating a window where team_xmit() running under RCU on a parallel CPU can invoke a NULL function pointer. No public exploit code exists and the issue is not listed in CISA KEV, but the availability impact is total (kernel panic), and the fix is present in upstream stable commits.
Symlink traversal in Network-AI's EnvironmentManager.backup() allows a local attacker with write access to an environment data directory to exfiltrate arbitrary files from outside the environment root into readable backup artifacts. All Network-AI versions prior to 5.12.2 (npm package jovancoding/network-ai) are affected, confirmed in v5.12.1 per GHSA-6x2m-p4xp-wg22. A proof-of-concept is publicly available in the GHSA advisory; no active exploitation (CISA KEV) has been identified at time of analysis.
Stored XSS in Best Practical RT (versions 5.0.0-5.0.9 and 6.0.0-6.0.2) allows any authenticated user with file upload permissions to embed malicious JavaScript in an uploaded file that executes in the browser session of any RT user who later views or downloads that content. The root cause is RT serving uploaded files inline rather than forcing browser download via Content-Disposition: attachment, enabling browsers to render and execute embedded scripts. Vendor-released patches 5.0.10 and 6.0.3 are available (released 2026-05-20); no public exploit identified at time of analysis.
Arbitrary file write in Apache MINA SSHD's sshd-git component enables any SSH-authenticated user to write files to arbitrary server filesystem paths via the JGit git archive --output argument. Servers are only affected when explicitly configured with GitPgmCommandFactory; the vulnerability does not exist in default MINA SSHD deployments. No public exploit code or CISA KEV listing exists at time of analysis; vendor-confirmed fixes are available in versions 2.19.0 and 3.0.0-M5.
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone configurations - linking or unlinking banners and campaigns to zones - by tricking an authenticated administrator into loading a crafted page or request. The zone-include.php script accepts both GET and POST requests for these state-changing operations without verifying any CSRF token, meaning the browser's ambient session credentials are sufficient to authorize the action. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Stored Cross-Site Scripting in Best Practical RT versions 6.0.0 through 6.0.2 allows an authenticated attacker with write access to inject persistent JavaScript payloads into ticket or configuration data, which then executes in the browsers of other RT users who view the affected pages. The CVSS scope change (S:C) reflects cross-user browser context impact - injected scripts operate in the victim's session, enabling session hijacking or unauthorized actions. No public exploit is identified at time of analysis; vendor-released patch is confirmed in RT 6.0.3, published 2026-05-20.
Stored cross-site scripting in Bifra Engineering Consulting Ltd. Q-smart NexT Poll (all versions before 1.8.7) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into poll content that executes in the browsers of any user who subsequently views the affected page. The scope change (S:C in CVSS) indicates impact extends beyond the submitting user to other authenticated or unauthenticated viewers, enabling session hijacking, credential theft, or unauthorized actions performed in the victim's browser context. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Two-factor authentication bypass in Webmin prior to version 2.640 allows a network attacker holding valid username and password credentials to gain full administrative access by sending requests via the HTTP Basic authentication code path, which skips TOTP enforcement entirely. All Unix-like systems running Webmin with 2FA enabled on any account are affected, making this particularly dangerous in environments where 2FA was deployed as the primary compensating control against credential exposure. No active exploitation has been confirmed via CISA KEV, and no public exploit code was identified in the provided data at time of analysis.
Unrestricted file upload in Windu CMS version 4.1 enables authenticated low-privilege attackers to upload arbitrary PHP files and achieve remote code execution on the host server. The application performs no validation of uploaded file types, allowing a webshell to be placed and subsequently invoked via HTTP. No public exploit code has been identified at the time of analysis, and no KEV listing exists, but the attack path is trivial once credentials are obtained.
Username enumeration via authentication timing side-channel in FileBrowser Quantum's `/api/auth/login` endpoint allows unauthenticated remote attackers to distinguish valid from invalid usernames by measuring response latency. Valid usernames trigger a bcrypt password hash comparison (~40-50 ms), while non-existent usernames return almost immediately (~1-4 ms), creating a statistically exploitable timing differential. A working proof-of-concept Python script was published in the GHSA advisory; the CVE is not in CISA KEV, so active exploitation is not confirmed at time of analysis.