Cross-site scripting in nice-select2 before 2.4.1 allows attackers to inject arbitrary scripts via malicious <select> element content that is rendered unsanitized into the DOM. Vulnerable if the application reflects user-controlled data into a <select> element that is transformed by nice-select2. User interaction required; no public exploit or active exploitation known.
Archive of any chat room without authorization in Let's Chat 0.3.0–0.4.8 allows any authenticated user to permanently remove private or password-protected rooms by sending DELETE requests. Room IDs can be enumerated via the rooms listing endpoint, and recovery requires direct database manipulation. A proof-of-concept exploit exists.
Unauthorized data access in the PDFDraft WordPress plugin allows unauthenticated attackers to download stored template PDFs containing customer PII, invoices, orders, and certificates. This is due to a missing capability check in the serveTemplatePdfAjax() function and the REST route registered with `__return_true`, affecting versions up to and including 1.1.0. No public exploit or active exploitation has been identified at the time of analysis, and the CVSS base score of 5.3 reflects the moderate but easily exploitable nature of the issue.
Memory corruption in Xen allows guest VMs with Populated on Demand (PoD) enabled to cause denial of service by attempting to reclaim non-guest memory pages, corrupting hypervisor memory management state. No public exploit identified and SSVC indicates no current exploitation, but the flaw is automatable with partial technical impact.
Missing authorization in the Storegrowth Sales Booster plugin for WordPress ≤2.1.0 allows unauthenticated attackers to modify the BOGO category-message configuration. The vulnerability arises from an AJAX handler that only verifies a nonce value publicly exposed on every frontend page, bypassing capability checks. There is no evidence of active exploitation or publicly available exploit code, and impact is limited to low integrity loss with no confidentiality or availability impact.
Authorization bypass in StoreGrowth for WooCommerce allows unauthenticated attackers to overwrite the spsg_popup_products option with arbitrary data. The plugin fails to properly verify user authorization, relying on a nonce that is publicly exposed to all visitors via wp_localize_script in the BoGo module. Affects all versions up to 2.1.0; no active exploitation or public exploit code identified at time of analysis.
Sensitive information exposure in the WPBot AI ChatBot WordPress plugin in all versions up to 8.5.9 allows unauthenticated attackers to exfiltrate full chat transcripts and associated user personally identifiable information (names, emails, phone numbers) to an attacker-controlled email address via the wpbot_send_email_transcript_free function. No public exploit or active exploitation has been confirmed at the time of analysis, but the vulnerability is easily exploitable due to lack of authentication requirements.
Missing authorization in the WPBot WordPress plugin allows unauthenticated attackers to send arbitrary emails from the site's domain. Versions up to 8.5.9 are vulnerable via the wpcs_send_email() AJAX handler, which lacks nonce verification and capability checks. No active exploitation has been identified, but the flaw can be easily automated for spam or phishing campaigns.
Quick.CMS allows authenticated administrators to read arbitrary files outside the webroot via a path traversal in HTTP URIs. An attacker with admin credentials can craft requests with ../ sequences to access sensitive sibling directories. The vendor assessed exploitation likelihood as very low and will not issue a patch.
Pivotick graph visualization fails to validate URL schemes for node imagePath values, enabling remote attackers to inject malicious URIs that trigger unintended browser requests and limited metadata disclosure when a victim renders crafted graph data. The vulnerability requires victim interaction to load the malicious graph, and no authentication is needed. No public exploit is identified at time of analysis; a vendor patch is available.
Path disclosure in Quick.CMS (<=6.8.0) allows authenticated admins to expose directory structure and absolute file paths via the admin.php p parameter. The vulnerability requires high privileges and the vendor does not consider a fix necessary. No public exploit or active exploitation has been reported.
Processing specially crafted graph data in Pivotick can lead to unreliable visualizations, corrupted cycle detection, and client-side denial-of-service. An attacker can craft node identifiers that collide with Object.prototype properties ('constructor', 'toString', '__proto__'), causing prototype pollution and logic errors. No known active exploitation or public exploit code exists, but the vulnerability is trivially triggered by user interaction.
Reflected cross-site scripting in the WebUI of ELECOM wireless LAN routers and access points allows an attacker on the adjacent network to execute arbitrary scripts in the browser of a logged-in user, potentially leading to session hijacking or unauthorized admin actions. The vulnerability is reachable via crafted links and requires user interaction. No known public exploit code or active exploitation reported.
Stored Cross-Site Scripting in the Shortcodify WordPress plugin up to version 1.4.3 enables authenticated contributors to inject arbitrary JavaScript via the 'name' shortcode attribute. No known active exploitation or public POC exists at time of analysis, but the low privilege requirement and typical impact of stored XSS make this a moderate priority for sites using the plugin.
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requests. Affected firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 store passwords supplied during resource dump operations in the BMC audit log, where they are accessible to users with administrative privileges. No active exploitation or public exploits have been identified.
Arbitrary file read in the SpeedyCache plugin for WordPress allows authenticated administrators to read sensitive files like wp-config.php by exploiting a path traversal vulnerability in CSS URL validation. The flaw affects all versions up to 1.3.8 and requires Administrator-level access; no public exploit or active exploitation has been reported at this time.
Information disclosure in IBM Sterling B2B Integrator and File Gateway 6.2.x allows authenticated privileged users to read sensitive data from application log files. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in the SMS Alert WordPress plugin allows authenticated administrators to extract sensitive database information. Affected versions up to and including 3.9.7 are vulnerable via the 'id' parameter. No active exploitation or public exploit has been reported as of this analysis.
Time-based SQL injection in the SMS Alert plugin for WordPress allows authenticated administrators to extract sensitive database information. Affected are all versions up to 3.9.7. No public exploit or active exploitation has been identified at this time.
Authenticated SQL injection in ShopLentor for WooCommerce allows administrator-level attackers to extract sensitive data via the 'orderby' parameter. All versions up to and including 3.4.5 are affected. No public exploit or active exploitation is currently known.
Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive database contents via the coupon_code parameter. The vulnerability requires high privileges but low attack complexity, and no public exploitation or exploit code is currently known.
Stored cross-site scripting in IBM Sterling B2B Integrator and File Gateway allows privileged users to inject arbitrary JavaScript into the Web UI, altering intended functionality and potentially leading to credential disclosure within trusted sessions. No public exploit identified at time of analysis.
Physical access to IBM PowerVM Hypervisor firmware with Transparent Memory Encryption (TME) enabled can allow an attacker to decrypt protected memory contents due to insufficient entropy. This information disclosure vulnerability affects firmware versions FW1110.00–FW1110.20 and FW1060.00–FW1060.71, potentially exposing sensitive data stored in memory. No public exploit code or active exploitation evidence is available at the time of analysis.
Authenticated SQL injection via stored settings in SMS Alert for WooCommerce 3.9.7 and earlier allows administrator-level attackers to extract database contents through a second-order attack. Malicious payloads inserted into the `checkout_payment_plans` and `order_status` plugin settings are saved by `update_option()` and later executed when a WP-Cron event triggers the vulnerable `sendSms()` function. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Authorization bypass in Advanced Form Integration plugin for WordPress up to 2.6.0 allows authenticated attackers with subscriber-level access to overwrite MailUp OAuth tokens. The missing authorization check on admin_init enables token hijacking, letting attackers redirect form-submission data to a controlled MailUp account or break the integration. Exploitation requires only a subscriber account and visiting any wp-admin page, making it a low‑complexity attack with moderate impact on data integrity.
Information disclosure in ShopLentor WordPress plugin versions ≤3.4.5 allows authenticated attackers with contributor-level access to read arbitrary wp_options rows whose values are stored as arrays-of-arrays containing 'title' keys, leading to cross-plugin data leakage of internal plugin news feeds, WooCommerce block pattern transients, and third-party configuration records. The vulnerability exists due to missing authorization checks on the user-controlled 'optionSection' parameter in the plugin’s API, and no public exploit or active exploitation has been reported.
Information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway 6.2.x allows authenticated remote attackers to view sensitive data embedded in source code comments of a mailbox component. Affected versions include 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation has been reported.
Information disclosure in the dashboard component of IBM Sterling B2B Integrator and File Gateway 6.2.x allows low‑privileged authenticated users to view sensitive details embedded in source code comments. No active exploitation or public proof‑of‑concept code is known at this time; the advisory carries a CVSS base score of 4.3 and is categorized as low severity.
Unauthenticated cross-site request forgery in the WPLP Cookie Consent WordPress plugin up to version 4.3.7 allows attackers to permanently delete or forcibly resolve arbitrary GDPR data request records stored in the wpl_data_req table. Exploitation requires tricking a site administrator into clicking a link, and while no active exploitation has been reported by CISA KEV, the flaw is confirmed with a fix committed to the plugin repository.
Information disclosure in SAP NetWeaver AS for ABAP and ABAP Platform allows a privileged user who activates diagnostic tracing to leak session identifiers into trace output. An attacker with access to the trace data can obtain those identifiers and impersonate legitimate users during their validity period. No public exploit or active exploitation has been reported.
Server-Side Request Forgery (SSRF) in the Media Cleaner WordPress plugin through version 7.0.3 allows authenticated administrators to make arbitrary web requests from the server, potentially probing internal services. The flaw stems from insufficient hostname validation in the get_urls_from_html() function, enabling bypass via substring matching. No active exploitation or public proof-of-concept is identified, and the high privilege requirement limits the attack surface.
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to be leaked to cross-origin redirect targets when fetching remote schemas. Affects versions prior to 0.63.0. A public proof-of-concept exploit exists, but no active exploitation has been reported and the CVSS score is low (3.7).
Rate-limiting bypass vulnerability in an unspecified screen-sharing application allows an attacker with local network access to brute-force the screen-sharing code, potentially displaying harmful content on the target screen. The vulnerability has a CVSS score of 3.3 (Low) with a local attack vector, though the description suggests network-adjacent access. No evidence of active exploitation or public exploit code identified at the time of analysis.
Information disclosure in gst-plugins-good's FLAC header parser within Matroska/WebM containers allows a local attacker to leak 4 bytes of heap memory by tricking a user into opening a malicious media file. The flaw has a low CVSS score (3
Authenticated users of pretix can abuse the 'quick setup' view shown right after an event is created to alter configuration on events they do not have permission to manage - creating products and quotas, setting bank-transfer configuration, or linking a Stripe account. Exploitation requires a valid logged-in account (CVSS PR:L) and a well-timed, race-condition-style request (AT:P) to hit the configuration actions before the per-event permission check applies, which substantially limits reliability; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) confines impact to integrity of event configuration with no confidentiality or availability loss. All signals - a 2.3 CVSS 4.0 base score, EPSS of 0.21% (11th percentile), SSVC 'Exploitation: none / Automatable: no / Technical Impact: partial', and the absence of KEV listing or public exploit code - converge on low real-world priority, and no public exploit has been identified at time of analysis. Fixed versions are available from the vendor.
Remote information disclosure in nextlevelbuilder GoClaw up to version 3.13.2 allows authenticated low-privilege attackers to extract sensitive data from internal tool execution. The vulnerability is in the ExecTool.Execute function of the jq handler, and publicly available exploit code exists. Users are urged to patch via PR #1230 or upgrade to a fixed version when released.
Quadratic time complexity in CPython's xml.etree.ElementTree.findall(), iterfind(), and find() methods allows denial of service when processing XML documents with many same-tag siblings and XPath index predicates. Affected versions are CPython before 3.15.0. No active exploitation or public exploit identified at time of analysis.
Use-after-free in the sqlite3 Ruby gem (published as both sqlite3-ruby and sqlite3) versions 2.1.0 through 2.9.4 lets an aggregate function be invoked through a still-open prepared statement after its Database object has been explicitly closed, producing an invalid memory read and a segmentation fault that crashes the Ruby process. Exploitation requires an in-process API-misuse pattern in the host application itself - local, high-complexity, low-privileged per the assessed CVSS:3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) - with no remote or network vector and no attacker-supplied input. No public exploit identified at time of analysis (EPSS 0.11%, CISA SSVC exploitation: none, Automatable: no); the maintainers classify it as Low severity, describing a reliably reproducible crash after garbage collection rather than a proven denial-of-service or code-execution primitive.
A use-after-free vulnerability in the sqlite3-ruby gem allows an attacker to crash the Ruby process by defining a custom SQLite function with the same name but a different number of arguments or text encoding, leading to an invalid memory read and segmentation fault. The issue affects versions prior to 2.9.5 and was assessed as low severity by the maintainers due to the specific code pattern required for exploitation.