Blind SQL injection in Quick.CMS 6.8 is exploitable by a high-privileged administrator through multiple fields in the administration panel, bypassing front-end validation controls and enabling potential database destruction. The vendor has explicitly declined to patch this issue, citing the administration panel's existing broad modification capabilities as context that limits the incremental risk. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.1 reflects the high-privilege prerequisite that significantly constrains real-world impact.
Information disclosure via SQL injection in the WP Photo Album Plus plugin for WordPress allows authenticated administrator-level users to extract sensitive database content. All versions up to 9.2.04.002 are vulnerable due to insufficient escaping and lack of prepared statements on the 'table' parameter. The missing nonce check on the export-table endpoint also enables CSRF exploitation, reducing the practical barrier for data theft.
SQL Injection in WP-Lister Lite for eBay (WordPress plugin, all versions ≤ 3.8.8) allows authenticated attackers holding administrator-level credentials to append arbitrary SQL clauses via the unsanitized 'orderby' parameter, enabling exfiltration of sensitive data from the WordPress database. The flaw spans at least three distinct model/table classes - ProfilesModel.php, StocksLogTable.php, and EbayOrdersModel.php - indicating a systemic lack of input preparation rather than an isolated oversight. No public exploit code or CISA KEV listing has been identified at time of analysis; the high privilege requirement substantially constrains the realistic attacker population.
Full-read Server-Side Request Forgery in WP CTA - Call Now Button, Sticky Button & Call to Action Builder (WordPress plugin, versions through 2.1.2) allows authenticated WordPress administrators to direct the web server to fetch arbitrary internal or external URLs, with the full response content persisted as a WordPress media attachment and thus retrievable by the attacker. The root cause is the import_sidebars() function in inc/import-export.php passing the attacker-controlled sticky_s_media URL from an imported JSON file directly to PHP's file_get_contents(), relying solely on FILTER_VALIDATE_URL validation, which does not block RFC 1918 private address ranges or localhost. No public exploit identified at time of analysis; a patch commit exists in the plugin's WordPress.org SVN repository.
Terminal control sequence injection in diff-so-fancy exposes developers to output manipulation, filename spoofing, terminal screen clearing, and clipboard hijacking when viewing diffs containing attacker-controlled content. The application filters only ANSI SGR sequences while passing OSC, CSI, carriage returns, and other VT100 control characters through unsanitized to the terminal, affecting all versions prior to commit 9c81294. No public exploit is identified at time of analysis, but the low attack complexity (CVSS 4.0 AV:L/AC:L) means the primary barrier is only the requirement for a developer to actively view the malicious diff.
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a valid one-time password, bypassing the second authentication factor. This can lead to unauthorized access to administrator accounts if TOTP is enabled. No public exploit or active exploitation has been identified at time of analysis.
GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
HTTPS agent connection pooling in Node.js fails to distinguish PFX credentials when encoded as an object versus an array, enabling authentication bypass under specific mutual-TLS configurations. Affected are Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. A high-privileged local actor who controls HTTPS agent configuration can induce the runtime to reuse a TLS session authenticated with one PFX credential for a request that should require a different (or no) credential, undermining certificate-based identity verification. No public exploit or CISA KEV listing has been identified at time of analysis.
Authorization bypass in OliveTin's synchronous action execution endpoints exposes full command log output to users holding exec permission but explicitly denied logs access. Versions prior to 3000.17.0 of this Go-based web shell interface are affected; the StartActionAndWait and StartActionByGetAndWait handlers return a complete LogEntry without invoking the isLogEntryAllowed ACL check that governs log visibility elsewhere in the application. No public exploit code exists and no CISA KEV listing is associated with this issue, placing real-world exploitation risk in context with the required authenticated access.
Information disclosure in GitLab Enterprise Edition's AI-assisted code review feature allows authenticated users to access data from projects they are not authorized to view. Affected versions are 19.1.x before 19.1.3 and 19.2.x before 19.2.1. An attacker with any level of authenticated access can craft malicious code content that, when processed by the AI review engine, causes the model to return information from unauthorized projects - a classic prompt injection boundary-crossing attack. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Improper authorization enforcement during token generation in GitLab Enterprise Edition allows an authenticated low-privilege user to bypass administrator-configured tool governance policies. Affected are all GitLab EE installations running 19.1 before 19.1.3 and 19.2 before 19.2.1. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the network-accessible, low-privilege attack vector makes this a realistic insider threat in enterprises relying on GitLab EE's governance controls.
Authenticated authorization bypass in Event Booking Manager for WooCommerce ≤5.3.7 allows contributor-level users to modify site‑wide WooCommerce payment settings - including enabling/disabling payments, altering cart redirects, login requirements, confirmation pages, and ticket statuses - undermining booking integrity and checkout flows. No active exploitation or public exploit is currently reported.
The Survey Form Block WordPress plugin up to and including version 1.0.1 lacks a capability check in its get_all_data() AJAX function, enabling authenticated users with minimal Subscriber roles to export entire survey submission datasets and column metadata without authorization. This data exposure vulnerability (CVSS 4.3) is patched by the vendor but has not been observed in active exploitation or public exploits.
Authentication bypass on the Autel MaxiCharger AC Elite Home EV charger allows physically present attackers to access device functionality without credentials via the exposed USB interface. The CWE-306 flaw represents a complete absence of authentication on the USB attack surface, not a weak implementation - any USB-connected party is immediately granted access. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; real-world risk is bounded by the physical access prerequisite inherent to the AV:P vector.
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requiring legitimate assessment completion. An attacker with a valid student account can retrieve answers and compromise exam integrity.
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM commit endpoint without viewing material. Affects version 5.3.2, compromising training and compliance records. No public exploit or active exploitation identified at time of analysis.
Cross-Site Request Forgery in the Facturación Electrónica Costa Rica WordPress plugin (all versions through 2.0.2) allows unauthenticated attackers to overwrite critical plugin configuration - including API tokens, Hacienda environment mode, and invoice emission flags - by tricking a logged-in site administrator into clicking a malicious link. The flaw stems from missing nonce validation in the admin configuration handler exposed via fvcr_admin_page_html, confirmed by Wordfence with direct source references to admin/configuration.php and functions.php. No public exploit or active exploitation has been identified at time of analysis, though the financial-system integration amplifies the business impact of a successful attack.
Cross-site request forgery in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.8 enables remote attackers to execute unauthorized actions on behalf of authenticated users without their consent. The vulnerability exploits the server's implicit trust in session cookies, allowing a malicious third-party site to trigger state-changing requests against the Liberty instance. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch.
HTTP request smuggling exposure in Node.js 26.x arises because the HTTP server failed to reject incoming requests that exceed the configured maximum header count, creating an inconsistent parsing boundary exploitable by adversaries. Rated Low severity (CVSS 3.7) by the Node.js security team and fixed in v26.5.1 released 2026-07-29, the flaw is classified under CWE-444 and is most dangerous in reverse-proxy deployments where header-count enforcement differs between the frontend proxy and the Node.js backend. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny service to any user by knowing their email address. The vulnerability, assigned a low CVSS score of 3.7, does not compromise data but can disrupt user sessions. No active exploitation or public proof-of-concept has been reported at the time of analysis.
Information disclosure in Koollab LMS 5.3.2 allows unauthenticated remote attackers to access sensitive user data (name, internal identifier, scores, lesson status, position, and cached state) via the SCORM API due to improper access controls. No exploit code or active exploitation is known, and the base CVSS score of 3.7 reflects low impact.
The Node.js permission model fails to validate the final resolved output path when generating diagnostic reports via process.report, allowing a local low-privileged attacker to write report files to filesystem locations outside the paths explicitly permitted by the --allow-fs-write flag. Affected are Node.js 26.x through 26.5.0, 24.x through 24.18.0, and 22.x through 22.23.1 (confirmed via EUVD-2026-51369). No public exploit code exists and no active exploitation has been confirmed; the fix is available in Node.js 26.5.1 released 2026-07-29.
Information disclosure in Koollab LMS allows authenticated users to access other users' course completion data without authorization. The vulnerability
Out-of-bounds read in Zephyr RTOS 4.2.0 through 4.4.0 allows a high-privileged local shell user to disclose device memory contents or crash the system via the coredump print shell command. The 16-bit tgt_code field from a stored coredump header is used as an unbounded index into a static 7-element string pointer array in print_coredump_hdr(), enabling reads up to ~64K entries past the array boundary that are then dereferenced and printed as a C string. No public exploit has been identified and no CISA KEV listing exists; the CVSS 3.0 base score accurately reflects that exploitation is constrained by local high-privilege access and deliberate coredump storage manipulation.
File upload restriction bypass in Ko
JWT malleability in joserfc versions 1.7.1 and prior allows a low-privileged user holding a valid token to craft alternate byte-distinct representations by exploiting the library's acceptance of non-conforming trailing Base64 padding (==), which violates the JOSE specification. Applications using deny-list-based token revocation or anti-replay protection are at risk of bypass, since a padding-modified token hashes to a different value that will not match the stored revoked-token record. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released fix is joserfc 1.7.2.
Incorrect SUID/SGID bit preservation in fuse-overlayfs before version 1.17 allows a low-privileged process inside a rootless container to leave an upper-layer file with mode 4777 (setuid plus world-writable) by triggering a copy-up via open(O_TRUNC) or truncate. The vulnerability is confined to local container contexts and carries a CVSS 4.0 score of 2.0, reflecting narrow exploitation conditions and limited integrity-only impact. No active exploitation (KEV) or public exploit code has been identified at time of analysis.