Unauthorized file disclosure in Let's Chat 0.3.0 through 0.4.8 allows authenticated attackers to download file attachments from any room, including private and password-protected rooms, by exploiting missing room membership checks in the file retrieval endpoint. Attackers can enumerate likely MongoDB ObjectIds to recover files uploaded by other users, effectively bypassing all room-level access restrictions. No public exploit identified at time of analysis, but the issue is trivially exploitable due to the absence of proper authorization checks.
HTTP response splitting in Rouille 0.4.0 to 3.6.2 allows remote attackers to inject arbitrary response headers. By embedding carriage return or line feed bytes into percent-decoded query parameters or Cookie header values, attackers can perform cache poisoning, session fixation, and override security policies like CSP or CORS. No active exploitation is confirmed, but proof-of-concept code may exist.
Authentication bypass in Cosmos Server 0.22.18 allows unauthenticated attackers to leak Constellation device metadata via the public-devices endpoint. The handler accepts any non-empty Authorization header but does not validate the bearer token, exposing device names, IPs, and role flags. Publicly available exploit code exists, but no active exploitation is reported; the vulnerability is patched in version 0.22.19.
Cross-site scripting in nice-select2 before 2.4.1 allows attackers to inject arbitrary scripts via malicious <select> element content that is rendered unsanitized into the DOM. Vulnerable if the application reflects user-controlled data into a <select> element that is transformed by nice-select2. User interaction required; no public exploit or active exploitation known.
Archive of any chat room without authorization in Let's Chat 0.3.0–0.4.8 allows any authenticated user to permanently remove private or password-protected rooms by sending DELETE requests. Room IDs can be enumerated via the rooms listing endpoint, and recovery requires direct database manipulation. A proof-of-concept exploit exists.
Unauthorized data access in the PDFDraft WordPress plugin allows unauthenticated attackers to download stored template PDFs containing customer PII, invoices, orders, and certificates. This is due to a missing capability check in the serveTemplatePdfAjax() function and the REST route registered with `__return_true`, affecting versions up to and including 1.1.0. No public exploit or active exploitation has been identified at the time of analysis, and the CVSS base score of 5.3 reflects the moderate but easily exploitable nature of the issue.
Memory corruption in Xen allows guest VMs with Populated on Demand (PoD) enabled to cause denial of service by attempting to reclaim non-guest memory pages, corrupting hypervisor memory management state. No public exploit identified and SSVC indicates no current exploitation, but the flaw is automatable with partial technical impact.
Missing authorization in the Storegrowth Sales Booster plugin for WordPress ≤2.1.0 allows unauthenticated attackers to modify the BOGO category-message configuration. The vulnerability arises from an AJAX handler that only verifies a nonce value publicly exposed on every frontend page, bypassing capability checks. There is no evidence of active exploitation or publicly available exploit code, and impact is limited to low integrity loss with no confidentiality or availability impact.
Authorization bypass in StoreGrowth for WooCommerce allows unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary data. The plugin fails to properly verify user authorization, relying on a nonce that is publicly exposed to all visitors via wp_localize_script in the BoGo module. Affects all versions up to 2.1.0; no active exploitation or public exploit code identified at time of analysis.
Sensitive information exposure in the WPBot AI ChatBot WordPress plugin in all versions up to 8.5.9 allows unauthenticated attackers to exfiltrate full chat transcripts and associated user personally identifiable information (names, emails, phone numbers) to an attacker-controlled email address via the wpbot_send_email_transcript_free function. No public exploit or active exploitation has been confirmed at the time of analysis, but the vulnerability is easily exploitable due to lack of authentication requirements.
Missing authorization in the WPBot WordPress plugin allows unauthenticated attackers to send arbitrary emails from the site's domain. Versions up to 8.5.9 are vulnerable via the wpcs_send_email() AJAX handler, which lacks nonce verification and capability checks. No active exploitation has been identified, but the flaw can be easily automated for spam or phishing campaigns.
Quick.CMS allows authenticated administrators to read arbitrary files outside the webroot via a path traversal in HTTP URIs. An attacker with admin credentials can craft requests with ../ sequences to access sensitive sibling directories. The vendor assessed exploitation likelihood as very low and will not issue a patch.
Pivotick graph visualization fails to validate URL schemes for node imagePath values, enabling remote attackers to inject malicious URIs that trigger unintended browser requests and limited metadata disclosure when a victim renders crafted graph data. The vulnerability requires victim interaction to load the malicious graph, and no authentication is needed. No public exploit is identified at time of analysis; a vendor patch is available.
Path disclosure in Quick.CMS (<=6.8.0) allows authenticated admins to expose directory structure and absolute file paths via the admin.php p parameter. The vulnerability requires high privileges and the vendor does not consider a fix necessary. No public exploit or active exploitation has been reported.
Processing specially crafted graph data in Pivotick can lead to unreliable visualizations, corrupted cycle detection, and client-side denial-of-service. An attacker can craft node identifiers that collide with Object.prototype properties ('constructor', 'toString', '__proto__'), causing prototype pollution and logic errors. No known active exploitation or public exploit code exists, but the vulnerability is trivially triggered by user interaction.
Reflected cross-site scripting in the WebUI of ELECOM wireless LAN routers and access points allows an attacker on the adjacent network to execute arbitrary scripts in the browser of a logged-in user, potentially leading to session hijacking or unauthorized admin actions. The vulnerability is reachable via crafted links and requires user interaction. No known public exploit code or active exploitation reported.
Stored Cross-Site Scripting in the Shortcodify WordPress plugin up to version 1.4.3 enables authenticated contributors to inject arbitrary JavaScript via the 'name' shortcode attribute. No known active exploitation or public POC exists at time of analysis, but the low privilege requirement and typical impact of stored XSS make this a moderate priority for sites using the plugin.
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requests. Affected firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 store passwords supplied during resource dump operations in the BMC audit log, where they are accessible to users with administrative privileges. No active exploitation or public exploits have been identified.
Arbitrary file read in the SpeedyCache plugin for WordPress allows authenticated administrators to read sensitive files like wp-config.php by exploiting a path traversal vulnerability in CSS URL validation. The flaw affects all versions up to 1.3.8 and requires Administrator-level access; no public exploit or active exploitation has been reported at this time.
Information disclosure in IBM Sterling B2B Integrator and File Gateway 6.2.x allows authenticated privileged users to read sensitive data from application log files. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in the SMS Alert WordPress plugin allows authenticated administrators to extract sensitive database information. Affected versions up to and including 3.9.7 are vulnerable via the 'id' parameter. No active exploitation or public exploit has been reported as of this analysis.
Time-based SQL injection in the SMS Alert plugin for WordPress allows authenticated administrators to extract sensitive database information. Affected are all versions up to 3.9.7. No public exploit or active exploitation has been identified at this time.
Authenticated SQL injection in ShopLentor for WooCommerce allows administrator-level attackers to extract sensitive data via the 'orderby' parameter. All versions up to and including 3.4.5 are affected. No public exploit or active exploitation is currently known.
Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive database contents via the coupon_code parameter. The vulnerability requires high privileges but low attack complexity, and no public exploitation or exploit code is currently known.
Stored cross-site scripting in IBM Sterling B2B Integrator and File Gateway allows privileged users to inject arbitrary JavaScript into the Web UI, altering intended functionality and potentially leading to credential disclosure within trusted sessions. No public exploit identified at time of analysis.
Physical access to IBM PowerVM Hypervisor firmware with Transparent Memory Encryption (TME) enabled can allow an attacker to decrypt protected memory contents due to insufficient entropy. This information disclosure vulnerability affects firmware versions FW1110.00–FW1110.20 and FW1060.00–FW1060.71, potentially exposing sensitive data stored in memory. No public exploit code or active exploitation evidence is available at the time of analysis.
Authenticated SQL injection via stored settings in SMS Alert for WooCommerce 3.9.7 and earlier allows administrator-level attackers to extract database contents through a second-order attack. Malicious payloads inserted into the `checkout_payment_plans` and `order_status` plugin settings are saved by `update_option()` and later executed when a WP-Cron event triggers the vulnerable `sendSms()` function. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Authorization bypass in Advanced Form Integration plugin for WordPress up to 2.6.0 allows authenticated attackers with subscriber-level access to overwrite MailUp OAuth tokens. The missing authorization check on admin_init enables token hijacking, letting attackers redirect form-submission data to a controlled MailUp account or break the integration. Exploitation requires only a subscriber account and visiting any wp-admin page, making it a low‑complexity attack with moderate impact on data integrity.
Information disclosure in ShopLentor WordPress plugin versions ≤3.4.5 allows authenticated attackers with contributor-level access to read arbitrary wp_options rows whose values are stored as arrays-of-arrays containing 'title' keys, leading to cross-plugin data leakage of internal plugin news feeds, WooCommerce block pattern transients, and third-party configuration records. The vulnerability exists due to missing authorization checks on the user-controlled 'optionSection' parameter in the plugin’s API, and no public exploit or active exploitation has been reported.
Information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway 6.2.x allows authenticated remote attackers to view sensitive data embedded in source code comments of a mailbox component. Affected versions include 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation has been reported.
Information disclosure in the dashboard component of IBM Sterling B2B Integrator and File Gateway 6.2.x allows low‑privileged authenticated users to view sensitive details embedded in source code comments. No active exploitation or public proof‑of‑concept code is known at this time; the advisory carries a CVSS base score of 4.3 and is categorized as low severity.
Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table. Exploitation requires tricking a site administrator into clicking a link, and while no active exploitation has been reported by CISA KEV, the flaw is confirmed with a fix committed to the plugin repository.
Information disclosure in SAP NetWeaver AS for ABAP and ABAP Platform allows a privileged user who activates diagnostic tracing to leak session identifiers into trace output. An attacker with access to the trace data can obtain those identifiers and impersonate legitimate users during their validity period. No public exploit or active exploitation has been reported.
Server-Side Request Forgery (SSRF) in the Media Cleaner WordPress plugin through version 7.0.3 allows authenticated administrators to make arbitrary web requests from the server, potentially probing internal services. The flaw stems from insufficient hostname validation in the get_urls_from_html() function, enabling bypass via substring matching. No active exploitation or public proof-of-concept is identified, and the high privilege requirement limits the attack surface.