SQL injection in Crocus version 1.3.44 lets a remote attacker manipulate database queries through the RecordStateMapper.xml mapper and escalate privileges within the application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high impact on confidentiality, integrity and availability. A public write-up/proof-of-concept exists on GitHub, though the flaw is not listed in CISA KEV and EPSS is low (0.19%, 8th percentile), indicating no confirmed active exploitation to date.
Cross-tenant self-service signup bypass in Microsoft Azure API Management (through 2025-10-17) lets remote unauthenticated actors register developer-portal accounts against a tenant where signup was disabled in the UI, by swapping the Host header or tenant identifier to reuse another tenant's still-live registration endpoint. Publicly available proof-of-concept exploit code exists (GHSA-vcwf-73jp-r7mv), but Microsoft evaluated the report and determined the behavior did not cross a security boundary, calling it a configuration/state issue rather than a product vulnerability affecting tenant isolation. No public in-the-wild exploitation has been identified, and the EPSS probability is low (0.18%, 7th percentile).
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can write the shared backing file corrupt process memory or crash consumers of the disjoint-set structure. The dsu_find routine trusts a file-stored parent index that is never bounds-checked against the node count, so the next find or union operation dereferences and path-compresses through an out-of-bounds pointer. No public exploit is identified at time of analysis, and the EPSS score is very low (0.17%), consistent with a niche CPAN module rather than a broadly exploited target.
Remote arbitrary code execution in Bytebot (bytebot-ai self-hosted AI desktop agent, commit 3d37894 dated 2025-09-11) allows attackers to run OS commands by supplying a crafted path to the agent's `computer_write_file` action. The flaw is classed as OS command injection (CWE-78) and carries a CVSS 9.8, but real-world exploitation probability is currently low (EPSS 0.17%, 7th percentile) and it is not on CISA KEV. A public gist referenced by the CVE appears to document the issue and may contain proof-of-concept details, though POC status is not explicitly confirmed in the source data.
Security-mitigation bypass in Mozilla Firefox's DOM: Networking component undermines a built-in protection mechanism (CWE-693), potentially allowing crafted web content to defeat network-layer defenses in versions prior to Firefox 153 and ESR 140.13. The issue was reported and patched by Mozilla with no public exploit identified at time of analysis; EPSS is very low (0.16%, 6th percentile) and it is not listed in CISA KEV. The NVD-assigned CVSS of 9.8 (network, no auth, no user interaction) sits in tension with the sparse 'mitigation bypass' description, which typically describes a defense-defeating enabler rather than direct code execution.
Mitigation bypass in the Mozilla Firefox PDF Viewer component undermines a built-in security control (CWE-693 Protection Mechanism Failure), weakening a defense-in-depth barrier that would otherwise contain malicious PDF content. Mozilla self-reported the issue and shipped fixes in Firefox 153 and Firefox ESR 140.13 via advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and EPSS is very low (0.16%, 6th percentile), so the headline CVSS 9.8 reflects worst-case potential rather than demonstrated mass exploitation.
Same-origin policy bypass in Mozilla Firefox's DOM: Navigation component allows a malicious web page to read or manipulate content belonging to another origin, defeating the browser's core cross-origin isolation boundary. All Firefox users on affected pre-153 releases and unpatched ESR branches are exposed, and while Mozilla's vector maps to CVSS 9.8, EPSS estimates only a 0.16% exploitation probability (6th percentile). There is no public exploit identified at time of analysis and it is not in CISA KEV.
Privilege escalation in Gitea's self-hosted Git service (all versions ≤ 1.26.4) lets an attacker holding a narrowly-scoped Personal Access Token mint a new token with any scope, including full 'all' access, without the account password. The POST /users/{username}/tokens endpoint is guarded by reqBasicOrRevProxyAuth, which is meant to force password auth, but supplying the token as Authorization: Basic base64(<token>:x-oauth-basic) tricks the guard into setting IsBasicAuth=true, and the token-creation handler enforces no scope ceiling. A working proof-of-concept integration test is published in the advisory, though there is no public exploit identified in the wild and EPSS is low (0.16%).
Cross-origin information disclosure in Mozilla Firefox arises from a site isolation weakness in the Graphics: WebRender rendering component, where origin boundaries are not correctly enforced during GPU-accelerated compositing. An attacker-controlled web page loaded by a victim could leak data belonging to a different origin, undermining the same-origin protections that site isolation is meant to guarantee. Mozilla fixed the issue in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Memory corruption in the Graphics component of Mozilla Firefox stems from incorrect boundary conditions (a buffer overflow) that can be triggered when the browser processes maliciously crafted graphics content, potentially leading to arbitrary code execution in the content process. It affects Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13, and is fixed across those releases per Mozilla advisories MFSA2026-68/69/70. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.15%, 5th percentile) despite the vendor-supplied CVSS of 9.8.
Sandbox escape via use-after-free in Mozilla Firefox's Disability Access (accessibility) APIs allows an attacker who has compromised the content process to break out of the browser sandbox and gain code execution at the host privilege level. It affects Firefox before 153 and the ESR 115.x and 140.x branches, was reported and patched by Mozilla, and carries no public exploit at time of analysis. EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV, indicating no observed exploitation.
Memory corruption in Mozilla Firefox's JavaScript engine JIT compiler allows attackers to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious web page. The flaw stems from a JIT miscompilation (type confusion, CWE-843) affecting Firefox before 153, ESR before 115.38, and ESR before 140.13, and carries CVSS 9.8. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Memory corruption in Mozilla Firefox's DOM Bindings (WebIDL) layer allows a remote attacker who serves malicious web content to trigger a use-after-free (CWE-416) via an invalid/dangling pointer, potentially leading to arbitrary code execution or information disclosure in the content process. All Firefox and Firefox ESR builds prior to the fixed releases are affected. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%, 5th percentile) suggests exploitation is not yet observed in the wild, though Mozilla rates the memory-safety impact as high.
Sandbox escape in Mozilla Firefox stems from a use-after-free in the Disability Access (accessibility) APIs, letting an attacker who already controls a sandboxed content process break out of the browser sandbox and compromise the host. It affects Firefox before 153 and the ESR 115.x and 140.x branches, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed widespread exploitation.
Sandbox escape in Mozilla Firefox stems from a use-after-free (CWE-416) in the DOM: Navigation component, letting web-reachable content corrupt memory and cross the content-process sandbox boundary. Affected builds are Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13; Mozilla self-reported the issue and shipped fixes across all three branches (MFSA-2026-68/69/70). There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed weaponization yet despite the 9.8 CVSS rating.
Memory corruption in the cubeb audio/video library used by Mozilla Firefox arises from incorrect boundary conditions (CWE-119), and Mozilla fixed it in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13 (advisories MFSA2026-68/69/70). The input CVSS rates it 9.8 (network, no privileges, no user interaction), implying an unauthenticated remote attacker could corrupt memory in the browser and potentially achieve code execution, though as a media-processing flaw real exploitation almost certainly requires a victim to render attacker-controlled audio/video content. There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), and it is not in CISA KEV.
Information disclosure in Mozilla Firefox and Firefox ESR stems from a site isolation flaw in the Networking component, letting a malicious web page bypass cross-origin process/security boundaries and access data belonging to other sites. The issue was reported by Mozilla and fixed in Firefox 153 and Firefox ESR 140.13; no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.15% (5th percentile).
Cross-origin information disclosure in Mozilla Firefox and Firefox ESR stems from a site isolation weakness in the Networking: HTTP component (CWE-346, origin validation error), letting a malicious web page bypass origin boundaries to read data belonging to another site. It affects Firefox before version 153 and Firefox ESR before 140.13 and is addressed in Mozilla advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed weaponization despite the vendor's 9.8 CVSS rating.
Memory corruption in Mozilla Firefox's JavaScript WebAssembly engine, stemming from an integer overflow (CWE-190), can be triggered by attacker-controlled web content and was patched in Firefox 153 and Firefox ESR 140.13. Reported by Mozilla and tracked as EUVD-2026-46202/MFSA2026-68 & MFSA2026-70, the flaw carries a 9.8 CVSS rating implying potential remote code execution, though no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.15% (5th percentile).
Memory corruption in Mozilla Firefox's WebAssembly (JavaScript) engine allows remote attackers to trigger a buffer overflow through incorrect boundary condition handling, potentially leading to arbitrary code execution in the browser content process. The flaw carries a critical CVSS 9.8 and affects Firefox prior to version 153 and Firefox ESR prior to 140.13; it is fixed in those releases per Mozilla advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%) suggests exploitation in the wild has not yet been observed.
Memory-safety corruption in Mozilla Firefox stems from a JIT miscompilation in the JavaScript engine's WebAssembly component, fixed in Firefox 153 and Firefox ESR 140.13. An attacker who lures a victim to a malicious page can supply crafted WebAssembly that the Just-In-Time compiler translates incorrectly, corrupting engine state to disclose memory or achieve code execution in the content process. There is no public exploit identified at time of analysis and the EPSS score is very low (0.15%, 5th percentile), so no active exploitation is indicated despite the 9.8 rating.
Protection-mechanism bypass in Mozilla Firefox's DOM Service Workers component allows remote web content to circumvent a browser security mitigation, weakening defenses that normally contain untrusted script. The flaw affects Firefox versions prior to 153 and was reported and patched by Mozilla (MFSA2026-68). No public exploit has been identified at time of analysis, and EPSS estimates exploitation probability at only 0.15% (5th percentile), indicating no observed weaponization despite the high nominal CVSS score.
Memory-safety defects in Mozilla Firefox 152 and the Firefox ESR 115.37 and 140.12 release trains can corrupt process memory, and Mozilla states some showed evidence of memory corruption that could be leveraged to run arbitrary code. The flaws were resolved in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile), consistent with a batch of internally-found bugs rather than an actively exploited zero-day.
Access-control mitigation bypass in the DOM Service Workers component of Mozilla Firefox before version 153 allows remote content to circumvent a browser security mitigation, undermining protections intended to isolate web origins. Mozilla self-reported the flaw (MFSA2026-68/71) and shipped a fix in Firefox 153; there is no public exploit identified at time of analysis and EPSS is low (0.14%, 4th percentile). The NVD-assigned CVSS of 9.8 (full CIA impact, no user interaction) is notably higher than typical for a browser mitigation bypass, which warrants scrutiny.
Memory-safety compromise in Mozilla's NSS (Network Security Services) cryptographic library allows remote attackers to trigger an integer overflow that leads to out-of-bounds memory access, remediated in Firefox 153 (advisory MFSA2026-68). The flaw stems from incorrect boundary conditions during size calculations in NSS Libraries code, and because NSS handles TLS/certificate and cryptographic parsing, malicious network-supplied data can reach the vulnerable path without user authentication. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile), indicating no observed weaponization despite the critical CVSS score.
Sandbox escape in Mozilla Firefox's DOM: Networking component allows a remote attacker to break out of the content-process security boundary, fixed in Firefox 153. Rated CVSS 9.8, it maps to CWE-693 (Protection Mechanism Failure) and is tagged as an information-disclosure issue by Mozilla, meaning a compromised or malicious web page could bypass the browser's isolation to reach host resources. No public exploit identified at time of analysis, and the EPSS score is low (0.14%, 4th percentile), indicating no observed exploitation activity yet.
Memory-corrupting type confusion in Firefox's JavaScript JIT engine allows a remote attacker to serve a malicious web page that triggers a JIT miscompilation, corrupting memory to disclose sensitive data or achieve code execution in the content process; Mozilla fixed it in Firefox 153. No public exploit is identified at time of analysis, and the EPSS score is low (0.13%, 3rd percentile), indicating no observed weaponization yet despite the critical 9.8 CVSS rating.
Memory corruption via integer overflow in Mozilla Firefox's ImageLib graphics component allows remote attackers to potentially achieve code execution by serving a maliciously crafted image, with the flaw resolved in Firefox 153. The CVSS 9.8 rating reflects unauthenticated network reach with high impact to confidentiality, integrity, and availability, though no public exploit has been identified and the EPSS probability of 0.13% (3rd percentile) indicates no observed exploitation activity to date. It is not listed in CISA KEV and there is no public exploit identified at time of analysis.
SQL injection in Turkhotspot 5651 Loglama versions 5.1.2 through 5.1.2 (fixed in 5.1.3) allows remote attackers to inject arbitrary SQL commands, per TR-CERT advisory TR-26-0584. The product is a Turkish Law 5651 network-access logging/hotspot compliance appliance, and successful exploitation exposes the backing database that stores legally mandated user-activity logs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated account takeover in the Easy Form Builder by WhiteStudio WordPress plugin (versions up to and including 4.0.11) lets remote attackers reset any user's password - including administrators - and gain full site control. The plugin's password recovery flow reuses a publicly scrapeable session identifier ('sid') as the reset token and exposes an unauthenticated nonce-refresh endpoint that hands valid REST nonces to any visitor, collapsing the entire reset gate. Rated CVSS 9.8; no public exploit has been identified at time of analysis, but the attack path is fully described and trivial to reconstruct.
Privilege escalation and cross-product compromise in Oracle Application Object Library (the core AOL/FND framework of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read and modify all AOL-accessible data and, because of a scope change, significantly impact other Oracle EBS products beyond AOL itself. Rated CVSS 3.1 9.6 (Critical) with confidentiality and integrity impact but no availability effect, it is remotely exploitable over HTTPS with low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege/authorization bypass in Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, authenticated network attacker read and modify all portal-accessible data over HTTP. The scope-changing flaw (CVSS 3.1 base 9.6) can significantly impact additional products beyond the portal itself and is tagged as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV; disclosed via the Oracle Critical Patch Update of July 2026.
Privilege-escalating data compromise in Oracle SOA Suite (Oracle Fusion Middleware) lets a low-privileged, remote attacker with HTTP access abuse the Integration Business Insight component to read, create, modify, or delete all data accessible to SOA Suite. Rated CVSS 3.1 9.6 (Critical) with a scope change that can significantly impact other products beyond SOA Suite itself. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication bypass; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass and data compromise in Oracle Coherence (Oracle Fusion Middleware Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 allows a low-privileged, network-adjacent attacker to read, create, delete or modify all Coherence-accessible data over HTTP. Because the flaw carries a scope change, successful exploitation can significantly impact additional products beyond Coherence itself, yielding a CVSS 3.1 score of 9.6. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch item.
Cross-context web attack against Oracle Banking Trade Finance Process Management (OBTFPM) 14.6.0 through 14.8.0 lets an unauthenticated network attacker who lures an authenticated user into interacting with crafted content act in the victim's session, reading, creating, deleting or modifying all OBTFPM-accessible data and causing a partial denial of service. Oracle rates it CVSS 3.1 9.6 with a scope change (S:C), meaning impact can spill into other connected products beyond OBTFPM itself. No public exploit is identified at time of analysis and it is not in CISA KEV; the Critical rating is driven by the scope change plus full confidentiality/integrity impact rather than by observed exploitation.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, and modify all HRMS-accessible data over HTTP. The scope-change (S:C) rating means a successful attack can pivot beyond HRMS to significantly impact other Oracle EBS products, yielding a CVSS 3.1 base score of 9.6. No public exploit identified at time of analysis; the fix is delivered in Oracle's July 2026 Critical Patch Update.
Unrestricted file upload in D-Link DNS-320 firmware 1.0.2 allows remote unauthenticated attackers to upload arbitrary files - including executable PHP webshells - via the `/web/function/save_ajax.php` endpoint by manipulating the handler argument. This effectively enables persistent remote code execution on an end-of-life NAS device for which no vendor patch is expected. A public proof-of-concept exploit has been disclosed, lowering the skill barrier for exploitation; however, no CISA KEV listing was identified at time of analysis.
Sandbox escape in Google Chrome for Android prior to 150.0.7871.182 stems from a use-after-free in the GPU component, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Chromium rates the severity High; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. As a second-stage primitive it is typically chained with a separate renderer bug to achieve full device compromise on Android.
Authorization bypass in Gitea before 1.27.0 lets a public-only Personal Access Token read internal content owned by Limited-visibility users and organizations, exceeding the reach the scope is meant to grant. The Repository and Package scope categories only test repo.IsPrivate / Owner.Visibility.IsPrivate(), which return false for VisibleTypeLimited, so an authenticated attacker with a public-only PAT can fetch READMEs, repo content, packages from all 24 registries, and even perform full git-upload-pack clones of instance-internal projects. A vendor-verified end-to-end Docker PoC exists (publicly available exploit code exists); it is not in CISA KEV and EPSS is low at 0.17% (6th percentile). This is the residual gap left after CVE-2026-25714 / PR #37118 fixed the sibling User/Org/ActivityPub cases.
An out-of-bounds read and write in ANGLE within Google Chrome on Android allows a remote attacker to potentially escape the browser sandbox via a crafted HTML page. The flaw is patched in Chrome 150.0.7871.182. No public exploit or active exploitation has been reported; EPSS estimates a low 0.16% probability of exploitation.
Unrestricted file upload in D-Link DNS-320 1.0.2 exposes the device to remote exploitation through the `/mydlink/multi_uploadify.php` PHP endpoint, where the `Filedata[]` parameter accepts arbitrary file types without validation. Remote unauthenticated attackers can upload malicious files - including PHP webshells - to the device filesystem, potentially achieving code execution on the NAS. A public proof-of-concept exploit is available per VulDB reporting, which elevates the urgency for owners of internet-facing DNS-320 units to act despite the absence of a CISA KEV listing.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the /photo_center/php/uploadify.php endpoint to unauthenticated remote attackers who can manipulate the 'Malicious Handler' argument to upload arbitrary files to the device. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of flaw that on PHP-backed NAS web interfaces frequently enables follow-on code execution by uploading a web shell. A public proof-of-concept exploit is available, elevating the realistic risk beyond what the moderate CVSS 4.0 base score of 6.9 alone would suggest, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the unsanitized ID parameter in /edit_subjecta.php. The flaw (CWE-89) enables both data extraction and potential data modification against the timetabling database. A public proof-of-concept exploit is available on GitHub, and no special configuration is required beyond the application being network-accessible.
Authenticated remote code execution in Tenable Security Center allows an attacker to inject shell metacharacters through asset filter parameters on the Analysis REST endpoint, breaking out of command argument handling to run arbitrary commands as a low-privileged OS user. The CVSS 4.0 base score of 9.4 reflects high confidentiality, integrity, and availability impact plus a scope change to subsequent systems, though exploitation requires low-level authenticated access (PR:L). There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unrestricted file upload in D-Link DNS-320 firmware version 1.0.2 allows unauthenticated remote attackers to upload arbitrary files - including PHP web shells - via the `Filedata[]` parameter of the jQuery Uploadify handler at `/web/jquery/uploader/multi_uploadify.php`. Because the endpoint performs no file-type validation and the underlying server executes PHP, a successful upload can yield full operating system command execution on the device. Publicly available exploit code exists (E:P confirmed in CVSS 4.0 threat component), substantially lowering the barrier to exploitation; KEV status has not been confirmed at time of analysis.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes unauthenticated remote attackers to arbitrary PHP file upload via the `/web/jquery/uploader/uploadify.php` endpoint, likely enabling remote code execution on the embedded Linux system. A public proof-of-concept exploit has been released, significantly lowering the skill barrier for exploitation. No vendor patch has been identified, and the device is a legacy product that may be end-of-life, leaving affected deployments without a vendor-supported remediation path.
Remote unauthenticated compromise of Oracle PeopleSoft Enterprise FIN Expenses 9.2 (Expenses component) allows attackers with only HTTP network access to read, create, delete or modify all Expenses-accessible data and to cause a partial denial of service. Rated CVSS 3.1 9.4 and flagged by Oracle as easily exploitable, meaning no authentication or user interaction is required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Unauthenticated remote compromise of Oracle Agile Engineering Data Management 6.2.1 (Install component) lets attackers with only HTTP network access modify or destroy critical PLM data, read a subset of accessible data, and trigger a complete denial of service. Oracle rates it CVSS 9.4 and describes it as easily exploitable, but it is not in CISA KEV and no public exploit has been identified. The combination of no authentication requirement with high integrity and availability impact makes it a serious exposure for any network-reachable deployment.
SQL injection in the ticketing REST API of Tenable Security Center (versions before 6.8.0) allows an authenticated non-admin user to read sensitive information from the underlying appliance database. Because any low-privileged authenticated account can trigger it over the network, the flaw effectively collapses the product's internal privilege boundaries and exposes vulnerability, asset, and configuration data held by the appliance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor (Tenable) has released a fixed version.
Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across multiple lesson AJAX handlers, allowing any subscriber-level authenticated user to read and overwrite other users' lesson notes and fraudulently mark course content as completed on their behalf. The vulnerability affects all Academy LMS installations running an unpatched version and is worsened by a publicly available exploit published via WPScan, though no active exploitation has been confirmed through CISA KEV. In environments where course completion carries compliance, certification, or audit significance, the integrity impact exceeds what the Medium CVSS score alone conveys.