Incorrect authorization on REST API endpoints in the All in One SEO WordPress plugin (before 4.9.9) allows authenticated users with low-level roles such as Contributor to overwrite or reset the site-wide AI integration configuration. The flaw is classified under CWE-863 (Incorrect Authorization), meaning the plugin registers REST API routes without enforcing appropriate role checks before permitting state-modifying operations. A publicly available proof-of-concept exists per WPScan, though no active exploitation has been confirmed by CISA KEV. The practical blast radius is limited to integrity of the plugin's AI settings, with no evidence of confidentiality or availability impact.
File Browser's share API (confirmed vulnerable through v2.63.16) leaks bcrypt password hashes and bypass tokens for password-protected shares via unfiltered JSON serialization of the internal `Link` storage struct. Authenticated users receive these secrets for their own shares on every create or list call, while administrators calling `GET /api/shares` obtain the password hash and bypass token for every user's shares across the entire instance. A working proof-of-concept is publicly available against the v2.63.15 Docker image; the exposed bypass token grants direct, password-free access to any protected share without cracking, while the bcrypt hash enables offline recovery of reused credentials.
Reflected XSS in Astro's view transition directive rendering allows arbitrary JavaScript injection when a developer passes attacker-controlled input into transition:persist, transition:scope, or transition:persist-props directives on client-hydrated islands. Affected versions span astro 3.10.0 through 7.0.4 (exclusive), covering roughly four major version lines. A public proof-of-concept is included in the GHSA-7pw4-f3q4-r2p2 advisory; no CISA KEV listing or confirmed in-the-wild exploitation is recorded at time of analysis, and the real-world attack surface is narrowed significantly by the precondition that the application developer must have written code that reflects untrusted request input directly into one of these directives.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/prescriptionorderreport.php` endpoint to database manipulation via the unsanitized `delid` parameter, exploitable by remote authenticated attackers. A publicly available proof-of-concept (GitHub ltranquility/submit_vuln issue #10) confirms exploitability; the CVSS 4.0 E:P metric corroborates this. No CISA KEV listing exists, and real-world impact is bounded by the low-privilege authentication prerequisite and the niche deployment footprint of this educational PHP codebase.
HAProxy Community Edition 3.2.x and 3.3.x contains a varint mishandling defect that allows remote network clients to trigger an infinite loop or process crash, resulting in denial of service. The flaw affects Community Edition 3.2.x before 3.2.12 and 3.3.x before 3.3.3, and is explicitly confirmed to also affect HAProxy Enterprise and ALOHA commercial distributions. No public exploit has been identified and CISA has not listed this in KEV; however, HAProxy's role as a critical network gateway in many enterprise environments elevates the operational impact of even a Low-severity availability disruption.
NULL pointer dereference in NanoMQ 0.24.11 and earlier allows a malicious MQTT broker to remotely crash any connecting NanoMQ MQTTv5 client - including bridge mode - with a single 35-byte crafted packet, triggering SIGSEGV and denial of service. The bug in mqtt_codec.c:1863 arises when a CONNECT packet carries will properties (will_prop != NULL) but no connect-level properties (prop == NULL); the code erroneously dereferences prop->next, reading from virtual address 0x38 (NULL plus struct field offset). No CISA KEV listing or public exploit is confirmed at time of analysis, but the minimal 35-byte trigger and auto-reconnect behavior in bridge mode can convert a single crash into a persistent DoS loop.
Open redirect in the @astrojs/node standalone server's static file handler allows remote attackers to redirect authenticated or unauthenticated users to arbitrary external hosts via crafted slash-backslash paths. Versions 8.1.0 through 11.0.1 of the npm package fail to normalize backslash characters before the internal-path prefix check in `isInternalPath()`, causing the 301 `Location` header to echo back paths like `/\attacker.com/page` which browsers resolve as `//attacker.com/page` per the WHATWG URL specification. No public exploit is identified at time of analysis; exploitation is gated by a non-default configuration option and requires social engineering to deliver a crafted link to a victim.