Unauthenticated administrator account creation in the POUCO Import Users WordPress plugin (versions through 1.0.0) lets remote attackers register a fully privileged admin user and take over the site. The plugin exposes AJAX actions for account creation/update without capability or nonce checks and blindly trusts an attacker-supplied role value, so any visitor can escalate to administrator. Publicly available exploit code exists (reported by WPScan), though the EPSS score is low (0.15%, 5th percentile) and it is not on the CISA KEV list.
Authentication bypass in the WooCommerce - Social Login plugin for WordPress (all versions up to and including 2.8.7) lets unauthenticated attackers log in as any existing user, including administrators, by forging an Apple id_token containing the victim's email address. The Apple login handler base64-decodes the JWT payload but never verifies the token signature against Apple's public keys nor validates the issuer, audience, or expiry claims, and the nonce needed to trigger the flow is publicly leaked to anonymous visitors. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis.
SQL injection in PyAthena before 3.35.4 lets remote unauthenticated attackers break out of parameterized string literals in DELETE and CTAS (CREATE TABLE ... AS SELECT) statements because DefaultParameterFormatter.format() routes these to the Hive escaper, which backslash-escapes single quotes instead of doubling them. Since Athena/Trino treat backslashes as ordinary characters inside string literals, a single quote in attacker-supplied input terminates the literal early and injects arbitrary SQL, enabling data exfiltration via UNION SELECT, destructive statement execution, and attacker-controlled CTAS output. There is no public exploit identified at time of analysis, but a fixing commit and vendor advisory are public.
Denial of service in Better Auth (npm) before 1.4.2 lets an unauthenticated remote attacker poison the router's base path when baseURL is not explicitly configured. By sending the very first request after server startup with crafted X-Forwarded-Host and X-Forwarded-Proto headers, the attacker forces every subsequent auth route to return 404 for all users until restart. A working reproduction (curl commands) is published in the GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing and no public exploit identified as being used in active attacks.
Cross-tenant information disclosure in the self-hosted task manager Vikunja (0.24.0 through 2.3.0) lets a holder of any project share link read kanban bucket records - bucket titles and the full created_by user object (username, name, id) - belonging to other tenants' project views, because the task-collection endpoint loads the view from the attacker-controlled URL path without re-authorizing it. The same missing pre-authorization check yields a project/view-ID existence oracle (404 vs non-404) usable by link shares and ordinary authenticated users. No public exploit identified at time of analysis; fixed in 2.4.0.