Unauthenticated remote code execution in the Realtyna Organic IDX / WPL Real Estate WordPress plugin (all versions through 5.2.0) lets attackers upload executable PHP files through the plugin's I/O service. The upload function skips file-type validation, and the endpoint is guarded only by static api_key/api_secret defaults that ship identically in every installation via the plugin's SQL migration files, so any attacker who knows these publicly documented credentials can reach it. Rated CVSS 9.8 by Wordfence; no public exploit identified at time of analysis, but the trivially reproducible preconditions make exploitation straightforward.
Unauthenticated file upload validation bypass in the CodeIgniter4 PHP framework (versions prior to 4.7.4) lets a remote attacker upload executable PHP content by exploiting that the is_image and mime_in strict validation rules never enforced a safe client-supplied filename extension. Applications are affected only when they validate uploads solely with is_image or mime_in (without an independent extension check such as ext_in), persist files under the attacker-controlled client filename, and store them in a web-accessible, script-enabled directory. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list; the upstream fix (commit b6e9a4f, released as v4.7.4) adds client-extension consistency checks.
Administrator account takeover in the ShopMonitor.io WordPress plugin before 1.2.0 allows unauthenticated attackers to hijack outgoing emails. The plugin's email-rerouting test mode is gated only by a trusted-source check that can be satisfied with client-supplied request headers, so an attacker can redirect the WordPress administrator password-reset email to an address they control and seize the admin account. Rated CVSS 9.8 with publicly available exploit code; EPSS is low (0.14%, 4th percentile), and it is not listed in CISA KEV - no public exploit identified as actively used at time of analysis, though POC exists.
Server-side request forgery in bank-vaults vault-secrets-webhook (<= 1.22.2) lets a low-privileged tenant with ConfigMap or Secret create/update rights in any watched namespace force the cluster-wide admission webhook to make attacker-controlled outbound HTTP requests and exfiltrate ServiceAccount JWTs. The webhook trusts the vault.security.banzaicloud.io/vault-addr annotation with no scheme validation or host allowlist, then synchronously mints a SA token (via cluster-wide serviceaccounts/token:create) and POSTs it to the attacker's address, which can be replayed against the real Vault. A vendor patch (v1.23.1) exists and the reporter published a working PoC, but there is no public exploit identified in the wild and the flaw is not in CISA KEV.
SQL injection in CodeIgniter4's Query Builder deleteBatch() method (versions 4.3.0 through 4.7.3) allows user-controlled where() condition values to be interpreted as executable SQL because bound values are substituted into the generated DELETE statement while their escape flags are ignored. Only the deleteBatch() batch-delete path is affected; ordinary delete() operations escape their binds correctly. No public exploit was identified at time of analysis, and the flaw is resolved in version 4.7.4.
Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows unauthenticated visitors to permanently inject executable script content into site storage by exploiting a double-encoding sanitization bypass. The flaw arises because the plugin re-decodes HTML entities after sanitization, resurrecting neutralized tags; the live payload is then rendered without escaping on front-end display surfaces and fires in the browser of any authenticated user — including site administrators — who later views the affected page. A publicly available proof-of-concept exists; while no active exploitation is confirmed in CISA KEV, the unauthenticated attack surface and admin-session-hijacking potential make this a meaningful priority for WordPress operators running this plugin.
Arbitrary file read in Thumbor prior to 7.8.0 allows unauthenticated remote attackers to read any file accessible to the thumbor process by supplying percent-encoded path traversal sequences via the watermark or frame filter parameters. The root cause is a decode-after-check flaw in file_loader: the security boundary check runs on the raw encoded path (%2e%2e is treated as a literal directory name and passes the abspath/startswith guard), then unquote() is called afterward, converting %2e%2e into real .. segments that the OS then resolves outside FILE_LOADER_ROOT_PATH. A public proof-of-concept exploit is included in the GitHub Security Advisory (GHSA-cj54-hpcc-gj6h); no active exploitation has been confirmed by CISA KEV at time of analysis.
Server-side request forgery bypass in the dssrf npm SSRF-protection library (versions <= 1.0.4) allows internal resource access when Node.js is configured with an external DNS resolver such as 1.1.1.1. The is_url_safe() function relies solely on dns.resolve4 and dns.resolve6 to check whether a hostname resolves to an internal IP; when an external resolver returns NXDOMAIN for 'localhost' (which it cannot authoritatively answer), no addresses are returned and no fallback to dns.lookup occurs, causing the library to incorrectly classify localhost as safe. publicly available exploit code exists, demonstrated via a published proof-of-concept in the GitHub advisory GHSA-5846-7qm3-r52j.
SQL injection in the Kirki WordPress plugin before version 6.0.13 enables unauthenticated remote attackers to read arbitrary data from the underlying WordPress database by injecting malicious SQL through an unsanitized request parameter. The CVSS vector scores this 8.6 with a scope change reflecting potential access to the database tier beyond the web application boundary, with high confidentiality impact but no integrity or availability impact - consistent with a read-only injection primitive. A public proof-of-concept exploit exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates low observed exploitation probability relative to the theoretical severity, and the vulnerability has not been added to the CISA KEV catalog.
Server-side request forgery in Thumbor prior to 7.8.0 allows unauthenticated remote attackers to bypass the ALLOWED_SOURCES hostname allowlist - the service's primary SSRF defense - and cause Thumbor to fetch images from arbitrary hosts, including internal network resources. The bypass exploits Python's regex engine treating unescaped dots as wildcards: an allowlist entry of 's.glbimg.com' silently matches attacker-controlled hostnames like 'sXglbimgYcom'. Because ALLOW_UNSAFE_URL defaults to True and all official documentation examples use plain-string patterns, the preconditions for exploitation match the default deployment profile. No public KEV listing, but a vendor-confirmed proof-of-concept is embedded in GitHub security advisory GHSA-6x26-6r6f-m537.
Server crash in LightFTP 2.3.1 is remotely triggerable by unauthenticated attackers exploiting a TOCTOU race condition in the ABRT cleanup path, enabling denial-of-service without credentials. The flaw arises because WorkerThreadId is re-checked outside the MTLock mutex between worker_thread_cleanup() and pthread_join(), allowing a racing new connection to cause pthread_join() to operate on an invalid thread ID. No active exploitation is confirmed (not in CISA KEV), though a related case study for CVE-2024-11144 - a prior incomplete fix of this same flaw - exists in the zeroscience/tuktam repository.
Two-factor authentication is completely bypassable in the miniOrange 2FA WordPress plugin before version 6.2.6, enabling an attacker who already holds a victim's password to authenticate as that user - including site administrators - by supplying a self-referential OTP value the plugin incorrectly validates against an attacker-controlled parameter rather than the user's stored secret. All WordPress installations running the affected plugin versions are exposed to full account takeover with no prior plugin privileges required. A publicly available proof-of-concept exists per WPScan; however, EPSS probability stands at 0.19% (9th percentile) and SSVC exploitation status is classified as 'none,' indicating no confirmed mass exploitation at time of analysis.
SQL injection in the Product Feed Manager For WooCommerce WordPress plugin (versions prior to 7.6.1) allows authenticated users holding a Contributor role or higher to execute arbitrary SQL statements against the WordPress database by crafting malicious product-feed custom filter rules. High CVSS impact metrics (C:H, I:H) reflect the potential for full database read and write access, including extraction of user credentials, WooCommerce order records, and site configuration data. A publicly available exploit exists per WPScan, though the EPSS score of 0.16% (5th percentile) suggests active mass exploitation has not materialized; the vulnerability is not listed in CISA KEV at time of analysis.
Privilege escalation to WordPress administrator in Ultimate Member plugin before 2.12.1 permits unauthenticated registrants to self-assign a site-defined role carrying full administrator capabilities, resulting in complete site takeover. The plugin omits administrator-level roles from its registration form role-filter and ships with its post-registration elevation safeguard disabled by default, creating a two-layered failure that exposes affected sites when a custom admin-capable role exists alongside a role-selection field on a live registration form. A publicly available proof-of-concept is confirmed via WPScan; no public exploit identified at time of analysis as actively exploited (not in CISA KEV), and EPSS sits at 0.14%, reflecting the dependency on specific site configuration.
Path traversal file write in the CodeIgniter4 PHP framework prior to 4.7.4 lets remote unauthenticated attackers place uploaded files outside the intended directory whenever an application calls UploadedFile::move() without an explicit second (name) argument. Because the default used the raw client-supplied filename, traversal sequences such as '../../public/shell.php' could drop attacker-controlled content into web-accessible or sensitive locations, potentially enabling code execution on affected sites. No public exploit identified at time of analysis, though the fixing commit ships a regression test that concretely demonstrates the traversal payload.
Remote denial of service in Thumbor's convolution filter (versions <= 7.7.7) allows an attacker to crash the Thumbor worker process with a single crafted HTTP request by passing columns=0 to the filters:convolution() URL parameter. The Python-layer input validation accepts zero via an overly permissive regex (PositiveNumber matches '0'), which propagates to a C extension that performs integer division by zero, triggering SIGFPE and killing the process on x86_64 Linux and macOS Intel. No public exploit identified at time of analysis per KEV, but a fully functional proof-of-concept is documented in the vendor's own GHSA advisory, making exploitation trivially reproducible.
Remote denial of service in Thumbor (pip/thumbor <= 7.7.7) is triggered by passing an unbounded value to the built-in `filters:proportion()` image filter, causing the server to allocate extreme CPU and memory resources during resize operations. The filter executes in the POST_TRANSFORM phase - after request-level MAX_WIDTH/MAX_HEIGHT clamping has already run - making those server-side size guards ineffective as a compensating control. Publicly available exploit code (PoC) exists per the GitHub Security Advisory GHSA-phj3-59pf-cp83; the vulnerability is not currently listed in the CISA KEV catalog.
Denial of service in Thumbor's convolution image filter allows unauthenticated remote attackers to exhaust server processing capacity by submitting a crafted URL. Versions 7.7.7 and earlier contain a regular expression in the convolution filter parser whose subpattern `(A;)*A` causes Python's `re` module to exhibit exponential-time backtracking when the input is malformed (e.g., missing the required trailing column count). A public proof-of-concept is included in the GitHub Security Advisory, and no special configuration is required to trigger the flaw against a default Thumbor deployment. No CISA KEV listing exists at time of analysis, but the trivial exploitation path and public PoC make this a real priority for network-exposed instances.
Remote code execution in REDAXO CMS versions 5.18.2 through 5.21.0 is reachable by authenticated backend users with media upload permissions via a multi-segment filename bypass (e.g., shell.php.any.jpg) that defeats the extension blocklist in rex_mediapool::isAllowedExtension. The flaw is a confirmed regression introduced in PR #6213 (February 2025), which replaced a historically correct str_contains guard with weaker str_ends_with logic, reintroducing a double-extension attack class that the codebase had explicitly defended against since 2018. Exploitation additionally requires the target server to run a multi-extension PHP handler (Apache mod_mime AddHandler or unanchored FilesMatch); no public exploit or CISA KEV listing has been identified at time of analysis, and the vendor-released fix is available in version 5.21.1.
PHP Object Injection in the Kirki WordPress plugin before 6.0.13 enables a two-stage attack where unauthenticated users store malicious serialized PHP objects, which are then deserialized when an administrator reviews the stored data in the WordPress admin panel. With a suitable gadget chain present on the site - from another installed plugin or an outdated WordPress core - this can escalate to full remote code execution on the hosting server. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.22%, 13th percentile) and CISA has not listed this in KEV, suggesting no confirmed widespread in-the-wild exploitation at time of analysis.
Security filter bypass in fast-uri (before versions 4.1.2, 3.1.5, and 2.4.4) enables unauthenticated remote attackers to circumvent host-based access controls - including SSRF filters, allowlists, and redirect validators - by submitting URLs that use backslash-based authority introducers. The parser inconsistency between fast-uri and Node.js's native WHATWG URL handler causes the same crafted URL to resolve to different hosts in each parser, allowing attackers to steer downstream requests to unintended destinations. No public exploit is identified at time of analysis and this CVE does not appear in CISA KEV, though the CVSS 7.5 High rating with AV:N/AC:L/PR:N/UI:N reflects straightforward remote exploitability wherever the vulnerable application pattern exists.
GiveWP WordPress plugin before 4.16.3 exposes sensitive donor privacy data through an unauthenticated REST API endpoint that returns recurring-donation records without access controls. Any unauthenticated remote party can enumerate donor names and subscription details for donors who explicitly chose to give anonymously, directly violating donor privacy expectations. A publicly available exploit exists per WPScan reporting, though EPSS sits at the 5th percentile, suggesting limited opportunistic exploitation at time of analysis. No active exploitation is confirmed via CISA KEV.
Sensitive information disclosure in the Demi WordPress plugin before 0.0.7 lets unauthenticated attackers retrieve full-site backup archives that the plugin writes to a publicly reachable path under a predictable filename with no access control. Because these archives contain the complete site database - including WordPress user password hashes - an attacker can crack or replay credentials to escalate toward administrative takeover. A public exploit exists (WPScan) and a fixed release (0.0.7) is available; EPSS was not supplied but the CVSS is 7.5 (High) and it is not on CISA KEV.
Unauthenticated information disclosure in the Geeky Bot WordPress plugin (all versions before 1.2.8) permits any remote, unauthenticated user to retrieve chat-history session metadata - including WordPress usernames, user IDs, and timestamps - by invoking an unprotected AJAX endpoint. Reported by WPScan with a publicly available proof-of-concept, this flaw provides attackers with a ready-made user enumeration primitive against any publicly reachable WordPress site running the affected plugin. CISA KEV listing is absent and EPSS sits at 0.14% (4th percentile), indicating limited current mass-exploitation, but the POC lowers the barrier for targeted attacks significantly.
Unauthenticated file upload and arbitrary ticket attachment in JS Help Desk WordPress plugin (all versions before 3.1.4) stems from a complete absence of authorization, nonce validation, and ownership checks on the plugin's front-end request dispatcher. Any unauthenticated remote attacker can upload files - constrained to the plugin's inert allowed extensions - and attach those files to any user's support ticket without possessing an account. A publicly available proof-of-concept exists per WPScan reporting; however, EPSS remains very low (0.14%, 4th percentile) and the vulnerability is not listed in CISA KEV, indicating limited observed exploitation despite POC availability.
Payment verification bypass in the FlxWoo WordPress plugin before 3.1.1 allows unauthenticated attackers to complete WooCommerce orders without paying, because the plugin marks orders as paid without confirming the checkout session was actually settled with the payment processor. Publicly available exploit code exists, and a vendor patch is released; no active exploitation is confirmed in CISA KEV. The flaw enables fraudulent free acquisition of goods or services from any store running the plugin.
Prototype pollution in @phun-ky/defaults-deep prior to version 2.0.5 allows remote unauthenticated attackers to write arbitrary properties to Object.prototype by supplying crafted objects containing keys such as __proto__, constructor, or prototype to the defaultsDeep() function. The root cause is that the library performed recursive object merging without filtering these special property names, enabling full process-wide prototype chain manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack class is well-understood and exploitation is straightforward wherever untrusted input reaches the affected function.
Remote code execution in the ElementsKit Elementor Addons WordPress plugin before 3.10.01 allows an authenticated administrator to inject arbitrary PHP code into server-side execution by crafting a malicious custom widget definition. The plugin writes this definition verbatim into a generated PHP file and subsequently executes it without sanitization. The critical escalation scenario occurs on WordPress multisite networks, where a subsite Administrator - ordinarily barred from file or code editing - can exploit this flaw to achieve host-level code execution, bypassing the privilege boundaries the network enforces. A publicly available exploit exists; no confirmed active exploitation (CISA KEV) at time of analysis.
Null byte injection in the free5GC Authentication Server Function (AUSF) v4.2.1 and earlier allows unauthenticated remote attackers to crash Go's URL parser and force HTTP 500 responses on the authentication endpoint, denying authentication service to all legitimate 5G subscribers sharing that AUSF instance. A publicly available Python PoC is included in the vendor's own security advisory, and fuzzing demonstrated a 4.1% trigger rate across nearly 100,000 requests - confirming reliable, scalable exploitation against the default deployment with no special configuration required. No public exploit or CISA KEV listing is confirmed at time of analysis, but the trivially automatable nature of the attack makes it a material risk for 5G core operators.
User enumeration and profile disclosure in WPGraphQL 2.x through 2.14.1 completely undermines the plugin's own anti-enumeration design via a deprecated GraphQL field that was never removed. An unauthenticated attacker can invoke the `sendPasswordResetEmail` mutation and include the deprecated `user` sub-field: a null response indicates the email or username does not exist, while a populated User object confirms existence and additionally leaks databaseId, full name, slug, bio, and profile URI for author-class users. A detailed proof-of-concept GraphQL mutation is published in advisory GHSA-jhh7-832h-f8hv, and no rate limiting exists at the WPGraphQL layer. No active exploitation has been confirmed by CISA KEV, though the barrier to exploitation is trivially low.
Stored XSS in the Lightbox with PhotoSwipe WordPress plugin before 5.9.0 allows author-level users (lacking unfiltered_html) to inject arbitrary JavaScript into image lightbox captions via an unsanitized link data attribute. The payload executes in the browser of any visitor or administrator who opens the affected lightbox, enabling session hijacking or privilege escalation against site administrators. A publicly available exploit documents the technique; no active exploitation is confirmed via CISA KEV, though the author-level entry bar is low on sites with multiple contributors.
SQL injection in the Check & Log Email WordPress plugin (all versions before 2.0.15) allows authenticated WordPress administrators to execute arbitrary SQL queries against the underlying database via unsanitized parameters. With PR:H per the CVSS vector, exploitation is constrained to admin-level accounts, making the primary threat a rogue insider or a follow-on attack after admin credential compromise. A public proof-of-concept is available through WPScan; however, EPSS at 0.16% (6th percentile) and absence from CISA KEV indicate no confirmed widespread exploitation campaign at time of analysis.
Server-Side Request Forgery in xxl-job v3.4.0's job trigger endpoint enables authenticated low-privilege users to weaponize the admin server as a proxy to scan and probe internal network resources. The CVSS vector (PR:L, C:H) confirms that any credentialed xxl-job-admin user can exfiltrate data from internal services reachable by the server, including cloud metadata endpoints and private APIs. A public proof-of-concept exploit exists on GitHub; however, EPSS at 0.16% (6th percentile) indicates minimal observed exploitation activity, and no CISA KEV listing has been issued.
User email enumeration in the JS Help Desk WordPress plugin (versions before 3.1.4) allows any Contributor-level site user to harvest the email addresses of all registered WordPress users. Two design flaws compound: the plugin unconditionally grants a support-agent capability to the built-in Contributor role at activation time, and the user-listing handler omits any capability check entirely, making the Contributor elevation the effective attack precondition. A public proof-of-concept is documented by WPScan; however, EPSS places exploitation probability at 0.14% (4th percentile), indicating no public exploit is currently being run at scale. No CISA KEV listing is present.
JS Help Desk WordPress plugin before 3.1.4 exposes all support ticket content to any authenticated WordPress user due to missing authorization and ownership checks in its search handler. Any account at Subscriber level or above can enumerate and read the subject and full message body of every other user's support ticket by interacting with the plugin's nonce-gated AJAX endpoint, bypassing the intended per-user data isolation. A publicly available proof-of-concept exploit exists per WPScan; EPSS is low at 0.14% (4th percentile), suggesting opportunistic rather than widespread automated exploitation, but the low authentication bar makes this a meaningful data exposure risk on multi-user WordPress sites.
Unauthenticated mailing list subscription abuse in the Mailgun for WordPress plugin before 2.2.1 allows any remote attacker to enroll arbitrary email addresses into the site owner's Mailgun mailing lists by exploiting an unprotected AJAX endpoint. The plugin's stored API credentials are silently invoked on the attacker's behalf, effectively weaponizing the site owner's Mailgun account against third-party email addresses. A public exploit is available via WPScan, though the EPSS score of 0.14% (4th percentile) and absence from CISA KEV indicate limited observed exploitation to date.
Insecure Direct Object Reference (IDOR) in JS Help Desk WordPress plugin before 3.1.5 exposes support ticket data to any low-privileged authenticated user who supplies an arbitrary ticket ID. The plugin performs no ownership check when loading ticket contents, meaning a registered user can enumerate ticket IDs and read PII, message bodies, and reporter identity belonging to other users. A publicly available proof-of-concept exists per WPScan; no confirmed active exploitation (CISA KEV) has been identified, and EPSS remains very low at 0.13%.
Arbitrary local file read in gemini-bridge (versions 1.0.0-1.3.0) exposes any file accessible to the server process - SSH keys, cloud credentials, `.env` files, source code - through the `consult_gemini_with_files` tool when operating in inline mode. Compounding the local disclosure, file contents are simultaneously exfiltrated to Google's infrastructure via the Gemini CLI round-trip, extending blast radius beyond the local host. No public exploit identified at time of analysis, but the CVSS vector (AV:L/AC:L/PR:N/UI:N) indicates trivially low exploitation complexity, and the GHSA advisory explicitly calls out prompt-injection as a realistic delivery vector for AI agent pipelines. Vendor-released patch available in version 1.3.1.
Hard-coded credential exposure in Andritz HIPASE-250 (formerly 250 SCALA) engineering workstations lets an adjacent-network attacker log in over VNC using a fixed x11vnc password baked into the provisioning script. Because every workstation provisioned with that script shares the identical credential, one leaked or reverse-engineered password unlocks remote graphical control of all affected units across a site. Rated CVSS 8.1; no public exploit identified at time of analysis and not listed in CISA KEV.
Stored XSS in the NewStatPress WordPress plugin (all versions before 1.4.5) allows unauthenticated remote attackers to inject persistent malicious scripts by supplying crafted HTTP request data that the plugin logs without sanitization and later renders in its statistics widgets. Any authenticated user - including administrators - who views the affected widget triggers the stored payload in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. A public exploit exists via WPScan, though EPSS at 0.17% (7th percentile) indicates exploitation has not yet become widespread.
Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject persistent malicious scripts into photo comments by exploiting a decode-after-sanitize flaw in the plugin's comment pipeline. The sanitization sequence in `wppa-functions.php` applies `wp_kses` then `wp_strip_all_tags()` on write, but neither function decodes HTML entities before inspecting markup - a double-encoded payload such as `&lt;script&gt;` passes both filters as harmless text, is stored one entity-decode level down, and renders as executable HTML when a victim's browser processes the page. A public proof-of-concept is available via WPScan; however, the vulnerability is not in CISA KEV and EPSS sits at 0.15% (5th percentile), indicating no observed mass exploitation at time of analysis.
Reflected cross-site scripting in the Ultimate Addons for WPBakery Page Builder WordPress plugin (all versions before 3.21.5) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL processed by the plugin's shared link-rendering function, uavc_link_init(). A publicly available proof-of-concept exploit was reported by WPScan, though EPSS places exploitation probability at just 0.15% (5th percentile), suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing was identified at the time of analysis.
Full device takeover in Rich Source DMS+ (Non-Mobile) is possible because the product ships with a hard-coded API key that is identical across all deployments. Unauthenticated remote attackers who obtain or extract this fixed key can authenticate to the management interface and seize control of every installed DMS+ device, with maximal confidentiality, integrity, and availability impact (CVSS 4.0 base 10.0). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Command injection in the system.upgrade_check interface of multiple Cudy router models (TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, WR6500) lets remote attackers run arbitrary commands as root via crafted input. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, and CISA SSVC marks the flaw as automatable with total technical impact. There is no public exploit identified at time of analysis, and the EPSS score is a moderate 1.21% (65th percentile).
Command injection in Cudy's OpenWRT-based router firmware allows remote attackers to execute arbitrary commands as root through the system.setclock interface, affecting multiple TR- and WR-series models (TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, WR6500 v2.3.15). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network-based exploitation with total system compromise, and CISA's SSVC framework rates it Automatable with Total technical impact. No public exploit is identified at time of analysis and it is not in CISA KEV; EPSS is modest at 1.21% (65th percentile).
Root-level command injection in Cudy TR- and WR-series routers lets attackers run arbitrary OS commands through the ipsec_conn interface, which fails to sanitize user-supplied input before passing it to a shell context. Affected models span TR1200 (v2.4.15), TR3000 (v2.4.21), WR300 (v2.4.25), WR1200 (v2.4.23), WR1300 (v2.4.22), WR1500 (v2.3.10), WR3000 (v2.4.19), WR3600 (v2.3.16), and WR6500 (v2.3.15). No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is modest at 1.21% (65th percentile), so this is a high-severity design flaw without evidence of widespread exploitation yet.
Sensitive-credential disclosure leading to full node compromise in Pterodactyl Wings before v1.12.3 lets a low-privileged, authenticated panel user (a server owner or a subuser holding startup.update) smuggle a {{config.*}} placeholder through a user-editable egg variable, causing Wings to resolve it against its entire daemon configuration and write secrets - including the node daemon token, token_id, and Docker registry credentials - into a file the user can read via the file manager or SFTP. Because the daemon token is both the Panel⇆Wings API bearer and the HMAC signing key for every JWT the node issues, an attacker can then forge tokens and act against every server on the node. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS is 9.9 and the affected templating pattern is common across stock and community eggs.
Remote code execution is claimed in Hugo Leisink's Hiawatha web server version 12.1 and earlier, reachable by an unauthenticated attacker sending a single crafted HTTP request (CVSS 9.8, CWE-94). Notably, the primary referenced research (fenrisk.com/hiawatha-http-smuggling) and the cited RFCs on chunked/message parsing indicate the underlying defect is HTTP request smuggling rather than classic code injection, so the RCE framing should be treated cautiously. Publicly available exploit code exists (SSVC 'poc'); this is not listed in CISA KEV, and EPSS is low at 0.36% (29th percentile).
Remote code execution in Logsign SIEM (all versions before 6.4.108) allows unauthenticated network attackers to inject and execute arbitrary code, as tracked under CVE-2026-17561 (CWE-94, Code Injection). Reported through Turkey's national CERT (USOM), the flaw carries a critical CVSS 9.8 with a fully remote, no-privilege, no-interaction vector, meaning a single crafted request can compromise the appliance. No public exploit code has been identified at time of analysis and it is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch.
Stack-based buffer overflow in the Tenda W6-S wireless router (firmware 1.0.0.4(510)) lets remote attackers corrupt stack memory by sending oversized 'GO' and 'index' parameters to the /goform/wifiSSIDset endpoint, where the formwrlSSIDset handler copies them into a fixed 64-byte buffer via unbounded sprintf. Successful exploitation can crash the device or achieve arbitrary code execution with full impact to confidentiality, integrity, and availability. Publicly available exploit code exists in the form of a detailed technical write-up, though there is no public exploit identified as weaponized and no confirmed active exploitation.