Command injection in pgAdmin 4's MASTER_PASSWORD_HOOK feature exposes the pgAdmin service account to arbitrary OS command execution by any authenticated user whose identity originates from an external auth source (OAuth/OIDC, Kerberos, webserver headers). Affected deployments span versions 7.2 through 9.16, but only those with the hook configured to use the `%u` substitution token alongside an external IdP where usernames can be attacker-influenced. No public exploit code or CISA KEV listing exists at time of analysis; however, the commit diff publicly discloses the exact vulnerable code path, significantly lowering the barrier to independent exploit development.
SQL injection in WP Go Maps WordPress plugin (all versions before 10.1.04) allows unauthenticated network attackers to read data from the underlying WordPress database by injecting malicious SQL syntax into an unsanitized plugin parameter. Reported by WPScan, a publicly available proof-of-concept exploit exists for this flaw; however, CISA KEV does not list active exploitation, and EPSS at 0.18% (7th percentile) indicates low observed exploitation probability in the wild. The SSVC framework's 'non-automatable' classification and the CVSS AC:H rating indicate that exploitation requires attacker effort beyond trivial scripting, moderating the real-world urgency despite the unauthenticated attack vector.
Unauthenticated download of exported member and payment PII is possible in the Paid Membership Subscriptions WordPress plugin before 3.0.7 due to export files being written to a predictable, unprotected path within the publicly accessible uploads directory. Any site running an affected version where an administrator has recently triggered an export is at risk of exposing member personally identifiable information and payment records to any network-accessible attacker. A publicly available proof-of-concept exploit exists per WPScan, and while the CVSS base score is low (3.7), the data sensitivity of the exposed artifact elevates real-world impact beyond what the score alone suggests.
Missing authorization on attachment download endpoints in the Support Genix WordPress plugin (before 1.4.48) exposes private support ticket files to unauthenticated network access. Any caller who possesses a stored attachment's filename can retrieve it directly, bypassing ticket ownership and login checks entirely. A publicly available exploit exists per WPScan, though EPSS sits at 0.14% (4th percentile), indicating no widespread opportunistic exploitation at time of analysis; no CISA KEV listing.
Unauthenticated order document enumeration in the FluentCart WordPress plugin (all versions before 1.5.3) exposes customer PII - names, email addresses, and billing and shipping postal addresses - across every order in a store. CWE-639 (IDOR) is the root cause: order documents are keyed on sequential numeric identifiers with no authorization or ownership validation, so any unauthenticated visitor can iterate through all historical orders. A publicly available exploit exists per WPScan; no active exploitation is confirmed in CISA KEV, though the trivial enumeration method and public PoC substantially lower the barrier to mass data harvesting.
Use-after-free in the Zephyr RTOS Bluetooth GATT client stack allows an adjacent Bluetooth peer acting as a GATT server to crash a Zephyr device or potentially redirect its execution by replying to a CCC-write with an ATT Error Response. The defect is a callback-ordering bug in gatt_write_ccc_rsp(): the API-documented termination signal notify(NULL) was emitted before subscribe(), so applications that free or recycle bt_gatt_subscribe_params in their termination handler dereference a dangling function pointer. No public exploit code or CISA KEV entry exists; a vendor patch commit is available but a specific tagged release version has not been confirmed.
Unauthenticated information disclosure in ComfyUI (comfy-org/comfyui) before 0.28.0 lets remote attackers read arbitrary image-decodable files and enumerate the host filesystem via the get_model_preview endpoint, which joins an unrestricted {filename:.*} route capture to the model directory with no containment check (CWE-22). Attackers can use literal ../, percent-encoded %2e%2e%2f, absolute paths, or an unbounded path_index to escape the model folder; disclosure is bounded to files Pillow can decode plus a file-existence/path-enumeration oracle. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.28.0.
Remote unauthenticated denial of service in 389 Directory Server (389-ds-base, shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) allows an attacker to crash the LDAP daemon by sending a crafted replication extended operation. The flaw is a stack buffer overflow in the RUV parsing path that triggers during payload decoding before any authorization check, so no credentials are needed. No public exploit identified at time of analysis; stack protectors constrain the outcome to a server crash rather than code execution.
Information disclosure in 389 Directory Server (upstream of Red Hat Directory Server 11-13, shipped across RHEL 6-10) lets an unauthenticated remote attacker inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler evaluates attacker-controlled filters against cn=config using elevated replication-plugin privileges and leaks a boolean match result, attackers can blindly enumerate sensitive configuration metadata such as replication bind DNs and password storage scheme details. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack surface makes it a meaningful reconnaissance primitive.
Path traversal arbitrary file read in ComfyUI (comfy-org) before 0.28.0 lets remote unauthenticated attackers probe arbitrary host filesystem paths and exfiltrate image-format files via the /view endpoint. A crafted POST /prompt workflow using LoadImage or sibling loader nodes joins attacker-controlled annotated filenames to a base directory with no containment check, and LoadImage's VALIDATE_INPUTS method causes the engine to skip input-directory validation. Rated CVSS 7.5 (confidentiality-only); no public exploit identified at time of analysis and it is not on CISA KEV.
Denial of service in gnome-remote-desktop as shipped in Red Hat Enterprise Linux 8, 9, and 10 lets an unauthenticated remote attacker exhaust server resources when the daemon runs in system mode with RDP enabled. Because the incoming connection handler bypasses the connection throttler, an attacker can open large numbers of parallel pre-authentication RDP connections, accumulating accepted sockets and pending routing-token operations until timeout and blocking legitimate RDP logins. There is no public exploit identified at time of analysis, and the flaw is specific to Red Hat's build - it does not affect the upstream project.
Pterodactyl Wings before v1.13.0 crashes when its SFTP handler receives a crafted packet with fewer than 4 bytes in the payload during the SSH connection handshake, triggering a Go runtime index-out-of-bounds panic that kills the Wings daemon. The crash is exploitable by any unauthenticated network attacker who can reach the SFTP port, requiring no credentials because the vulnerable slice operation executes prior to authentication. No public exploit code exists at time of analysis, but the patch diff makes the trigger trivially reproducible: any packet with a short payload in the SSH subsystem channel request is sufficient.
Copier CLI and library versions 9.5.0 through 9.16.0 expose a trust-prefix bypass that permits unsafe template features from untrusted repositories to execute on a victim's system after user interaction. The vulnerability arises because Copier's trusted-repository prefix check evaluates the raw percent-encoded URL string, while the underlying HTTP or Git transport subsequently decodes it - meaning a URL containing encoded dot-dot segments (e.g., %2e%2e) or encoded separators (%2f, %5c) can appear to match a trusted prefix while actually resolving to an entirely different, attacker-controlled repository. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code was identified in the provided data; the issue is patched in v9.17.0.
IPv6 packet forwarding in Zephyr RTOS versions 1.8.0 through 4.4.1 never decremented the hop limit on routed unicast packets, directly violating RFC 8200's mandatory loop-termination mechanism and enabling indefinite packet circulation in routing loops. Both forwarding branches of ipv6_route_packet() in subsys/net/ip - the explicit-route path (net_route_packet()) and the on-link cross-interface path (net_route_packet_if()) - were affected, with neither performing a hop-limit check nor decrement before calling net_send_data(). An on-path attacker who can induce or exploit a transient L3 routing loop converts it into a permanent forwarding storm, exhausting CPU and link bandwidth on the Zephyr forwarder and adjacent segments; no public exploit or active exploitation has been identified, and SSVC rates exploitation as none with a non-automatable attack.
Stored XSS in ElementsKit Elementor Addons (WordPress plugin before 3.10.01) allows administrative users to inject malicious JavaScript into megamenu menu-item settings, which is rendered unsanitized to all page visitors. The most critical exploitation path targets WordPress multisite networks: a subsite Administrator - a role WordPress normally bars from injecting raw HTML via the unfiltered_html capability - can bypass this restriction through the plugin's misconfigured save routine, planting a payload that executes in Super Admin and site visitor sessions. A publicly available proof-of-concept exists per WPScan; EPSS is low (0.16%) but SSVC flags total technical impact due to the Super Admin session takeover potential on multisite deployments.
Remote code execution via stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's Cookie parsing logic affects all firmware versions prior to 2.8.5.1, exploitable by unauthenticated network attackers when the SafeEnhancement feature is enabled. The vulnerability (CWE-121) allows arbitrary code execution on the edge controller, an OT/IIoT device typically deployed in industrial automation environments. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though the industrial attack surface warrants heightened concern due to the operational consequences of device compromise. Notably, the provided CVSS vector (C:H/I:N/A:N) is inconsistent with the described code execution impact - a discrepancy that should be verified with the vendor.
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge controllers is possible through a stack-based buffer overflow in the device's log message handling functionality, exploitable by unauthenticated network attackers on versions prior to 2.8.5.1. Reported by the Cyber Security Agency of Singapore (CSA), the vulnerability carries a CWE-121 classification - a well-understood root cause class with a history of weaponizable exploits, particularly in embedded and OT/ICS devices. No public exploit has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), though the network-accessible, unauthenticated nature of the flaw and the industrial deployment context elevate operational risk above what the percentile alone suggests.
Stack-based buffer overflow in Advantech ADAM-3600 EdgeLink's password handling routine enables unauthenticated remote code execution when the SafeEnhancement feature is active. All firmware versions prior to 2.8.5.1 are affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface on an industrial IoT edge device warrants prompt patching given OT environment exposure.
Quadratic ReDoS in NLTK ReviewsCorpusReader allows an unauthenticated attacker to hang any application that processes untrusted reviews corpora, by supplying a single crafted line of approximately 100,000 bracket-less words. All NLTK versions through 3.9.4 are affected; the calls reviews(), features(), and sents() are all vulnerable entry points. Publicly available exploit code (PoC) is included in the advisory; no confirmed active exploitation in CISA KEV at time of analysis.
Path traversal in NLTK's NKJPCorpusReader component (versions ≤ 3.9.4) allows attackers who control the `fileids` argument to read arbitrary files outside the configured corpus root, fully defeating the `nltk.pathsec` sandbox even when `ENFORCE=True` is active. The root cause is that `add_root()` builds file paths via plain string concatenation - not the hardened `FileSystemPathPointer` - and downstream code calls the Python builtin `open()` directly, bypassing the `validate_path()` check that NLTK's own SECURITY.md explicitly promises will block unauthorized access. A detailed public PoC is confirmed against nltk 3.9.4; no active exploitation is listed in CISA KEV at time of analysis.
Path traversal in NLTK's FramenetCorpusReader (versions ≤3.9.4) allows a caller-supplied frame name containing ../ sequences to escape the corpus root and read arbitrary XML files accessible to the process, silently bypassing the nltk.pathsec sandbox even when ENFORCE=True is explicitly enabled. Any web service or pipeline that routes user-controlled input into FramenetCorpusReader.frame() is directly exposed, with full parsed content of frame-shaped XML files returned to the caller and a file-existence oracle for all other XML paths. A working proof-of-concept is publicly available in the GitHub security advisory; the vulnerability is not listed in CISA KEV at time of analysis.
Command injection in Cudy TR1200 (firmware v2.4.15) and TR3000 (firmware v2.4.21) routers via the system.setclock interface enables an authenticated administrator to execute arbitrary OS commands with root privileges. The vulnerability stems from unsanitized input passed directly to a system command, yielding full device compromise - confidentiality, integrity, and availability all rated high. No public exploit or active exploitation (CISA KEV) has been identified; EPSS of 1.21% at the 65th percentile reflects moderate relative risk among disclosed CVEs but low absolute exploitation probability.
Privilege escalation in FeehiCMS v.2.1.1 exploits insufficient session expiration (CWE-613) across the session management module, authentication logic, and logout handler, allowing a network-based attacker to reuse captured session tokens even after legitimate user logout to gain elevated access. The CVSS 3.1 score of 7.4 (High) reflects high confidentiality and integrity impact under high attack complexity, with no authentication required on the attacker's side. A public proof-of-concept write-up exists on GitHub; however, EPSS sits at 0.20% (10th percentile) and no CISA KEV listing exists, suggesting limited observed exploitation despite available exploit documentation.
Authenticated command execution affects several Hikvision wireless access points (DS-3WAP521-SI, DS-3WAP522-SI, DS-3WAP621E-SI, DS-3WAP622E-SI, DS-3WAP623E-SI, DS-3WAP622G-SI), where insufficient input validation lets an attacker holding valid device credentials send crafted packets carrying malicious commands to achieve arbitrary command execution on the device. The CVSS 3.1 vector (7.2, AV:N/AC:L/PR:H/UI:N) indicates a network-reachable but high-privilege (authenticated) attack with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the vendor has published a security advisory.
Remote unauthenticated access to an undocumented HTTP endpoint in ANDRITZ HIPASE-250 (formerly 250 SCALA) allows attackers to silently modify the system's audit logging level and destination without credentials. Rooted in CWE-306 (Missing Authentication for Critical Function), this flaw is particularly dangerous in industrial control system contexts where log integrity underpins incident detection and forensic capability - suppressing logs is a classic defense-evasion precursor enabling follow-on attacks to go unrecorded. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, but the trivial attack complexity (AV:N/AC:L/PR:N/UI:N) means any attacker with network reachability can exploit this without tooling.
Session hijacking in Coturn TURN/STUN server prior to 4.15.0 allows an authenticated attacker who obtains a victim's MOBILITY-TICKET to seize the victim's TURN allocation, intercepting and injecting relayed traffic while exhausting the victim's quota. The flaw resides in the --mobility (MICE, RFC 8016) session-resume code path in handle_turn_refresh: the server locates the victim allocation via an attacker-controlled mobile ID and then validates the REFRESH against the attacker's own credentials rather than the allocation owner's, because the hmackey_set flag set during the attacker's own prior authentication is never cleared for long-term-credential sessions and silently suppresses the credential-copy step. No public exploit code or CISA KEV listing is identified at time of analysis; CVSS AC:H and PR:L reflect that exploitation requires both a legitimate authenticated session and possession of the victim's MOBILITY-TICKET.
Default-credential unauthorized access affects the Advantech ECU-1251D industrial communication gateway, which ships with a root SSH account protected by no password and is documented as such in the device manual. An attacker on the same network segment can log in as root over SSH without any credential, and because configuration provides no prompt or guidance to change these defaults, exploitable devices are likely to persist in the field. No public exploit identified at time of analysis, but the vulnerability requires no exploitation skill - knowledge of the documented default is sufficient.
Credential exfiltration in AWS Strands Agents Tools before 0.8.2 exposes HTTP_REQUEST_TOKEN_CONFIG bearer tokens to attacker-controlled proxy infrastructure by exploiting the LLM's ability to set proxy parameters within the http_request tool's input schema. The root cause (CWE-863: Incorrect Authorization) is that proxy configuration was included as an LLM-controllable field, enabling prompt injection attacks to redirect credentialed HTTP requests through adversary infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; however, any deployment combining token-authenticated HTTP requests with externally influenced agent inputs is at material risk.
Authentication bypass in pgAdmin 4 SERVER mode exposes multiple routes to unauthenticated network access due to missing @pga_login_required decorators, a defect class previously identified in CVE-2026-12046 but incompletely remediated. Unauthenticated remote clients can enumerate table constraint metadata, delete table constraints (a state-mutating operation), read all CLI-settable preference values, and force-close active debugger or schema-diff sessions belonging to other authenticated users. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms no authentication or special conditions are required in SERVER mode deployments; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in multiple PHP Jabbers commercial PHP scripts allows a network-based attacker to trigger unauthorized administrative actions - including creating new admin accounts - by tricking an authenticated administrator into visiting a malicious page. The root cause is the complete absence of CSRF tokens and missing SameSite cookie attributes in state-changing requests, meaning the browser silently attaches session cookies to forged cross-origin requests. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, successful exploitation grants persistent backdoor access via rogue admin accounts.
Denial of service in the Advantech ECU-1251D industrial communication gateway allows a network-adjacent, high-privilege attacker to send a crafted DNP3 signal to the device's Digital Output address, forcing the DNP3Daemon into an indefinite restart loop and severing SCADA TelWin operator connectivity until a manual restart is performed. The device remains partially reachable via its web panel during the loop, which may create a false impression of operational continuity while SCADA control is lost. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the disclosure source is Singapore's Cyber Security Agency (CSA).
Stored or reflected cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated attacker to inject script-related HTML tags into web pages that are subsequently rendered in other users' browsers. The attack requires passive user interaction from a victim and yields low-confidentiality impact, consistent with session token or cookie theft scoped to the vulnerable application. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS 4.0 score of 4.8 reflects the constrained, privilege-gated nature of the vulnerability.
Stored cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) enables a high-privileged authenticated attacker to inject persistent malicious scripts into the application that execute in victims' browsers when they view the affected content. The CVSS 4.0 vector (PR:H/UI:P) confirms exploitation requires an administrative-level account for payload injection and passive user interaction from a second victim. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unrestricted file upload in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated user to upload files of dangerous types, enabling potential stored cross-site scripting or server-side file execution. The CVSS 4.0 vector (PR:H/UI:P) indicates exploitation requires an authenticated administrator or similarly privileged account plus passive victim interaction, substantially constraining real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext storage of sensitive information in Johnson Controls XAAP Application on Android (versions before 1.53) exposes sensitive data to retrieval by attackers who already have access to a jailbroken or otherwise compromised device. The flaw stems from insufficient data-at-rest protection (CWE-312), meaning credentials, tokens, or configuration data are stored without encryption in the app's local storage. No public exploit code exists and this vulnerability is not listed in CISA KEV; real-world risk is constrained by the requirement for prior device compromise.
Unbounded memory consumption in Google mcp-toolbox versions through 1.4.0 allows unauthenticated remote attackers to crash the service via a single oversized HTTP request. The /mcp endpoint's toolInvokeHandler uses Go's io.ReadAll without any body-size guard - no http.MaxBytesReader, no Content-Length pre-check - so a sufficiently large POST body linearly exhausts host RAM until the OS OOM killer terminates the process. No active exploitation is confirmed (CVSS 4.0 E:U), but the attack requires no authentication and trivial complexity, making any internet-exposed deployment an easy target for denial of service.
Keycloak's OIDC token introspection endpoint incorrectly discloses the full set of JWT claims to confidential clients inspecting tokens that were not issued for them. Any confidential client configured to receive signed JWT introspection responses can submit a foreign token, receive an 'inactive' status confirmation, and simultaneously receive the complete signed JWT payload containing sensitive user attributes and claims - effectively bypassing the audience isolation that OIDC introspection is designed to enforce. No active exploitation has been confirmed (not listed in CISA KEV), and no public proof-of-concept code has been identified at time of analysis, but the low attack complexity and network accessibility via a standard API endpoint make this a meaningful confidentiality risk in multi-tenant or multi-client Keycloak deployments.
Incorrect authorization in Keycloak's group policy evaluation allows a low-privileged authenticated user to bypass group membership checks and gain unauthorized access to administrative functions or protected resources. The root cause is a string prefix comparison used to verify child-group membership under an 'extend to child groups' policy: a user in a group whose name shares a leading prefix with a privileged group (e.g., '/admins-external' matching a policy scoped to '/admins') is incorrectly treated as a legitimate child-group member. The CVSS vector (PR:L, I:H) confirms this is an authenticated integrity-bypass with high impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
IP spoofing via X-Forwarded-For header manipulation in Ghost CLI before 1.30.1 enables unauthenticated remote attackers to defeat rate-limiting controls on self-hosted Ghost instances. The vulnerability arises when Nginx is configured with the $proxy_add_x_forwarded_for directive, which appends attacker-supplied IP values to the header chain, causing Ghost's rate-limiter to treat each crafted request as originating from a distinct, unseen IP address. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the low attack complexity makes this straightforward to abuse once a vulnerable instance is identified.
Stored cross-site scripting in AWS Ops Wheel's participant URL handling allows an authenticated user to inject persistent malicious JavaScript via a crafted participant_url containing a dangerous URI scheme (e.g., javascript:). When a higher-privileged user - most critically an administrator - views the affected participant entry, the payload executes in their browser, enabling session token theft and full administrative takeover of the deployed instance. No public exploit or active exploitation has been identified at time of analysis; remediation requires redeployment from the latest source incorporating PR #168.
Reflected cross-site scripting in the FS Inc S3150-8T2F Switch web management interface allows remote unauthenticated attackers to execute arbitrary JavaScript in an authenticated administrator's browser by tricking them into clicking a crafted URL targeting the /logo.asp endpoint. The vulnerability carries a CVSS 6.1 score with changed scope, enabling session hijacking, credential theft, or unauthorized device reconfiguration through the victim's browser session. No public exploit code has been confirmed and EPSS sits at 0.14% (4th percentile), indicating negligible observed exploitation probability at time of analysis.
Authorization bypass in Google mcp-toolbox's bigquery-execute-sql tool (versions 0.16.1-1.4.0) allows authenticated low-privileged users to exfiltrate DDL schemas from explicitly restricted datasets and query federated external data via EXTERNAL_QUERY connections. The fail-open logic flaw stems from the tool treating an empty tableIDSet returned by the BigQuery dry-run API - which occurs for INFORMATION_SCHEMA and EXTERNAL_QUERY constructs - as a signal to skip allowedDatasets enforcement entirely. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the bypass mechanism is straightforward for any authenticated toolbox user.
HTTP request smuggling in cPanel and WP Squared (by WebPros) enables leakage of credentials from other users sharing the same hosting infrastructure. The CVSS 4.0 vector confirms network-reachable exploitation with no authentication required but with passive user interaction and attack-specific prerequisites; critically, the subsequent-system impact is rated High for both confidentiality and integrity (SC:H/SI:H), indicating that successful exploitation crosses trust boundaries to affect other users or backend components beyond the attacker's own session. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the scope-change impact makes it a meaningful risk in shared hosting environments where cPanel serves multiple tenants.
Memory exhaustion via unbounded configuration file parsing in Pterodactyl Wings prior to v1.13.0 allows a low-privileged game server tenant to crash the Wings daemon. The parsers for JSON, YAML, XML, INI, and text configuration files in parser.go perform no size validation, enabling a malicious or oversized config file to buffer unlimited data into the Wings process heap and trigger an OOM kill. No public exploit is identified at time of analysis, and the vendor-released patch is available in v1.13.0.
Redirect URI policy bypass in Keycloak's secure-client-uris executor enables interception of OAuth authorization codes over unencrypted HTTP connections. The flaw exists because the executor performs only a prefix-string comparison on the redirect URI rather than properly parsing and validating the host component, allowing a specially crafted domain name to satisfy the HTTPS enforcement check while pointing to an attacker-controlled HTTP endpoint. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and related Red Hat middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Token revocation bypass in Keycloak's TokenManager component allows sessions and user data access to persist after administrative invalidation. The flaw (CWE-862: Missing Authorization) causes client-level 'not-before' revocation policies to be silently skipped when a realm-level revocation policy with an older, non-zero timestamp is already in place - causing the revocation to produce no effect. Authenticated token holders (PR:L) can continue refreshing sessions and querying user information APIs despite explicit administrative revocation. No public exploit identified at time of analysis; KEV status is not confirmed.
Unauthenticated campaign content tampering in the MailerPress - Newsletter, Email Marketing & AI Automation WordPress plugin (versions ≤ 1.5.0) allows any remote actor to overwrite active email campaign HTML by invoking the revision-restore REST endpoint without credentials. The campaign revision-restore route (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>) was registered in the WordPress REST API without a permissionCallback, bypassing the authorization layer entirely. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, though the attack is trivially executable against any reachable WordPress instance running the affected plugin.
Insecure Direct Object Reference in Fluent Forms for WordPress (versions up to and including 6.2.8) exposes other users' payment receipt data to unauthenticated remote attackers via a brute-forceable 'transaction' parameter. Because the transaction hash is constructed from observable or guessable inputs - submission ID, form ID, and creation timestamp - the effective brute-force space is bounded to approximately 900 candidates per second per (submission, form) pair, making unauthenticated enumeration of victim receipts containing name, email, billing address, order items, payment method, and payment status practically feasible. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, a patch is available in version 6.2.9.
Stored cross-site scripting in Roskus Prospero Flow CRM before v5.5.3 allows authenticated users holding the 'create lead' or 'update lead' permission to inject persistent JavaScript payloads via the lead name field. The application renders lead names through Blade's unescaped output directive and embeds them unsanitized inside a JavaScript string literal in an onclick attribute, providing two distinct injection sinks. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized contact data modification in MailerPress (WordPress plugin, versions up to and including 1.5.0) is achievable by any unauthenticated remote attacker via a missing capability check on the REST API endpoint `mailerpress/v1/contact`. The root cause (CWE-862) means WordPress's permission framework is entirely bypassed for this endpoint, exposing the contact database to arbitrary writes without credentials. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and zero authentication requirement make this trivially exploitable by automated scanners.