Tool source code disclosure in Open WebUI (≤ 0.10.2) allows any authenticated non-admin user who holds a read grant on a shared workspace tool to retrieve the full Python source of that tool via three unguarded API endpoints. The root cause is a Pydantic response-model inheritance defect where the `ToolUserResponse` subclass re-admitted the `content` field that the parent `ToolResponse` schema deliberately excluded, combined with a separate query-level defect in the list path. Because tool source commonly embeds hard-coded API keys, credentials, and internal service URLs, the practical confidentiality loss frequently exceeds the code itself; a detailed proof-of-concept is published in the GitHub security advisory, and the vendor-confirmed fix is available in 0.11.0 with no active exploitation (CISA KEV) recorded at time of analysis.
Unrestricted file upload in the Chat Widget WordPress plugin before 1.8.2 allows any network-reachable user to submit arbitrary files to the plugin's public response endpoint, bypassing all validation of type, extension, content, and size. Uploaded files are stored in the WordPress uploads directory under bare UUIDs - stripping the original extension - which explicitly prevents code execution or stored XSS despite the CWE-434 classification. Real-world impact is bounded to disk exhaustion and abuse of the hosting environment to serve attacker-controlled static content, conditional on the channel's response storage or mail-forwarding feature being configured. No public exploit identified via CISA KEV; however, a proof-of-concept is publicly available per WPScan, and EPSS at 0.16% (6th percentile) signals minimal observed exploitation activity.
Unauthenticated consent-record forgery and privacy-queue flooding affect GDPR Framework By Data443 WordPress plugin versions prior to 2.4.0. The plugin fails to verify the identity of the data subject or check authorization when recording cookie-consent choices and processing privacy requests, allowing any unauthenticated remote attacker to submit fraudulent GDPR consent records on behalf of arbitrary email addresses and to inject unlimited entries into the site's privacy-request queue. A publicly available proof-of-concept exists per WPScan; the vulnerability is not listed in the CISA KEV catalog, and EPSS sits at 0.15% (4th percentile), indicating low observed exploitation at time of analysis.
Remote unauthenticated command injection in the H3C Magic BE18000 series and related H3C routers (NX400, Magic NX30 Pro, R3010, NX15, R1510, and NE36 Pro) allows attackers to run arbitrary OS commands as root through the /api/esps request handler. Multiple object interfaces (esps.dhcpd.vlan, esps.filter.url, esps.apcm.version, esps.swcm.version, esps.system.ntp) pass attacker-controlled parameters into shell expressions evaluated by eval without sanitization, yielding full device takeover. SSVC classifies exploitation as proof-of-concept with total technical impact and automatable exploitation, and publicly available exploit code exists per the referenced Notion write-up.
Server-side request forgery in Odysseus before commit 87babb5 allows admin-authenticated attackers to weaponize the embedding endpoint configuration API to probe internal network resources, including cloud instance metadata services at 169.254.169.254, RFC 1918 hosts, and other server-reachable targets. The vulnerability arises because the embedding endpoint accepted arbitrary URLs without validating scheme, host, IP range, or DNS rebinding protections, enabling partial response exfiltration from cloud credential endpoints and internal APIs. A publicly available exploit and blog post exist; the vulnerability is not currently listed in CISA KEV, but the high subsequent-system confidentiality impact (SC:H in the provided CVSS 4.0 vector) reflects real risk of cloud credential theft from metadata services.
Remote unauthenticated code execution in Veeam ONE (CPE cpe:2.3:a:veeam:one) allows attackers to run arbitrary code on the agent host over the network with no credentials or user interaction. The flaw is a CWE-94 code injection carrying a maximal CVSS 4.0 base score of 10.0, reflecting full compromise of both the vulnerable and downstream systems. Reported via HackerOne with a Veeam KB advisory published; no public exploit has been identified at time of analysis.
Broken object-level authorization in the REST API Log WordPress plugin (all versions before 1.7.1) permits unauthenticated attackers who hold any valid log-download token - regardless of which entry it was issued for - to retrieve arbitrary log entries from any other user, exposing stored credentials, authentication tokens, and private REST API payloads. The root cause is twofold: tokens are not cryptographically bound to specific log entry IDs, and the plugin performs no WordPress capability check on the requester. A public exploit PoC is referenced via WPScan, though EPSS at 0.18% and SSVC exploitation status of 'none' indicate no confirmed widespread abuse at time of analysis.
Remote code execution and denial of service in OpenSIPS SIP server (versions 4.0.0 and prior) arises from a stack buffer overflow in the sip_to_json() function, where an attacker-controlled SIP header name longer than 255 bytes is memcpy'd into a fixed 255-byte stack buffer. Because both the length and content of the overwrite are attacker-controlled, a single unauthenticated UDP packet to SIP port 5060 can crash the process or, on builds lacking stack protections, hijack the saved return address for RCE. No public exploit identified at time of analysis; the issue was not fixed at publication, making this an unpatched flaw affecting any deployment whose routing script invokes sip_to_json().
Out-of-bounds write in the multimodal serving topology of NVIDIA Dynamo for Linux allows remote unauthenticated attackers to corrupt memory, with a rated 9.8 CVSS potentially enabling remote code execution, privilege escalation, data tampering, information disclosure, and denial of service. NVIDIA (the reporting vendor) rates it critical with a network-reachable, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the score reflects potential rather than observed impact.
Authentication bypass in the REST API interface of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and data on the orchestrator. HPE reports the flaw as a cluster of multiple REST API weaknesses rated critical (CVSS 9.8). No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch target for any organization running the orchestrator.
Authentication bypass in the REST API of HPE Networking (Aruba) EdgeConnect SD-WAN Orchestrator lets an unauthenticated remote attacker circumvent web authentication and reach protected system functions, then view and modify sensitive configuration and network data. HPE (the reporting vendor) rates it CVSS 9.8 with a fully remote, no-privilege, no-interaction vector. No public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitation profile on an internet-facing management plane makes it a high patch priority.
Remote code execution in Bilin Software HUMANIST Digital Human Resources versions 26.0 through 26.1 allows unauthenticated attackers to upload a web shell to the server due to unrestricted file-type validation (CWE-434), resulting in full compromise of the HR application host. Any remote attacker can reach the upload functionality without credentials or user interaction and execute arbitrary commands. No public exploit identified at time of analysis, though the maximal CVSS 9.8 severity and trivial exploitability make this a high-priority fix for affected deployments.
Privilege escalation in the Android kernel VPU (Video Processing Unit) driver stems from a use-after-free in vpu_ioctl.c, allowing an attacker to elevate to kernel-level privileges without any additional execution privileges or user interaction. It affects Google Android devices (per the Pixel security bulletin for 2026-08-01), and Android's advisory states no user interaction is required; SSVC rates the technical impact as total and the flaw as automatable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the total-impact, no-interaction profile makes it a high-priority patch target.
Cleartext storage of sensitive information combined with SQL injection affects Bilin Software's HUMANIST Digital Human Resources platform in versions 26.0 up to (but not including) 26.1, allowing remote attackers to compromise the underlying database and recover sensitive HR data that is stored without encryption. Rated CVSS 9.8 by TR-CERT with a fully remote, unauthenticated network vector and high impact to confidentiality, integrity, and availability. Currently there is no public exploit identified at time of analysis and no EPSS or KEV signal provided in the source data.
Command injection in Google::Auth for Perl before 0.06 lets an attacker who controls an Application Default Credentials configuration achieve arbitrary code execution. When a 'type: external_account' credentials JSON contains a credential_source.executable block, the Pluggable subclass runs the named command via a single-argument system($command), handing the whole string to /bin/sh -c, and copies the JSON's environment_variables into %ENV first - all with no opt-in gate (the GOOGLE_EXTERNAL_ACCOUNT_ALLOW_EXECUTABLES check was added only in the fix). Reported by CPANSec with no public exploit identified at time of analysis and a low EPSS of 0.20%, but the code path is trivially reachable from the standard ADC flow via GOOGLE_APPLICATION_CREDENTIALS.
Kernel memory corruption in the Linux kernel SCTP stack allows a remote peer to trigger a use-after-free during ASCONF DEL-IP processing, corrupting an association's transport list and leaving primary_path/active_path pointing at freed memory. The flaw affects the SCTP dynamic address reconfiguration (ASCONF) path across a wide range of kernel versions and, given kernel-level impact, can lead to denial of service and potentially privilege escalation or code execution. Despite the 9.8 CVSS and 'Information Disclosure' tag, there is no public exploit identified at time of analysis and EPSS is low (0.16%), reflecting the SCTP/ASCONF-specific conditions required.
Blind Server-Side Request Forgery in the EmbedPress WordPress plugin (all versions before 4.6.1) allows unauthenticated remote attackers to coerce the WordPress server into issuing arbitrary HTTP requests to internal hosts and services, bypassing WordPress core URL validation entirely. The vulnerability exists on unauthenticated endpoints, requiring zero credentials or user interaction, making mass exploitation trivially automatable against any site running a vulnerable plugin version. A publicly available proof-of-concept exists (via WPScan), though EPSS of 0.14% (4th percentile) suggests exploitation remains limited in practice; no active exploitation is confirmed by CISA KEV.
Memory corruption in Qualcomm Snapdragon Wi-Fi/NAN firmware allows an attacker within wireless range to overflow a stack buffer by sending Neighbor Awareness Networking (NAN) Service Discovery Frames whose Device Capability Extended attributes carry invalid length values (CWE-121). With CVSS:3.1/AV:A/AC:L/PR:N/UI:N and a scope-changed 9.6 score, an unauthenticated adjacent attacker can achieve high-impact compromise potentially crossing from the wireless subsystem into the host. No public exploit identified at time of analysis, and it is not on CISA KEV.
Unrestricted file upload in Trippo ResponsiveFilemanager (all versions through 9.14.0) exposes the dialog.php endpoint to unauthenticated remote attackers, enabling arbitrary file upload to the server. The product is end-of-life with no vendor support and no patch forthcoming; the vendor did not respond to disclosure. A public proof-of-concept exploit is available on GitHub, making exploitation accessible to a wide range of threat actors. The CVSS 4.0 vector rates the score at 6.9 (E:P), but the underlying CWE-434 class in a PHP application typically enables web shell deployment and full server compromise beyond what the assigned impact metrics suggest.
Path traversal in Ghost's database backup export endpoint allows Administrator-level users to remotely overwrite arbitrary files on the server filesystem, affecting all Ghost installations from version 1.20.1 through v6.54.0 (npm package pkg:npm/ghost). An authenticated admin can supply a crafted export filename containing path separators (e.g., '../../etc/crontab') when triggering a database export, causing Ghost to write the JSON export blob outside the intended directory to an attacker-controlled path. No public exploit code exists and this CVE does not appear in CISA KEV at the time of analysis; however, the CVSS Scope:Changed rating reflects that successful exploitation crosses the application's filesystem boundary, with integrity and availability consequences beyond Ghost's own data directory.
Improper authorization in KodBox 1.67 Build 02 allows unauthenticated remote attackers to bypass access controls via the msgWarning plugin endpoint, resulting in limited unauthorized access to confidential data. The CVSS 4.0 vector (PR:N/UI:N) confirms no authentication is required, and a public proof-of-concept exploit has been published on GitHub. The vendor did not respond to responsible disclosure, leaving no confirmed patch available at time of analysis.
Credential theft via agent impersonation in Veeam Service Provider Console (VSPC) allows a remote, unauthenticated attacker to masquerade as a legitimately managed backup agent and harvest that agent's credentials. Because VSPC is the multi-tenant management plane MSPs use to orchestrate backups across customer estates, captured agent credentials give an attacker a foothold to pivot into managed endpoints. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it critical (9.5) and CWE-288 identifies an authentication-bypass root cause.
Persistent unauthenticated remote code execution in MaxSite CMS lets attackers POST a crafted db_dbprefix value to the install endpoint even after installation is complete, injecting attacker-controlled PHP into application/config/database.php that executes on every subsequent request. Reported by VulnCheck with a vendor patch available and rated CVSS 4.0 9.3 (AV:N/AC:L/PR:N/UI:N), it grants code execution as the web-server process user; no public exploit identified at time of analysis, though the advisory describes the technique in detail.
Unauthenticated remote code execution in MaxSite CMS is possible because the application passes attacker-controlled serialized data from the maxsite_comuser cookie directly into PHP's unserialize() without validation or class allowlisting. Any remote attacker can send a single crafted HTTP request carrying a malicious serialized PHP object to trigger property-oriented programming (POP) gadget chains and execute arbitrary code. The flaw was reported by VulnCheck and a vendor patch is available (MaxSite CMS 109.6); no public exploit code or CISA KEV listing is identified at time of analysis, though the CVSS 4.0 score of 9.3 reflects trivially triggerable, high-impact exploitation.
Broken object-level authorization in Open WebUI's standard channel messaging API allows any authenticated channel member with write access to overwrite or permanently delete messages authored by other members. Affected versions are open-webui 0.5.0 through 0.10.2 (pip). The `update_message_by_id` and `delete_message_by_id` route handlers in `channels.py` enforced a write-permission check for standard channels instead of an authorship check, meaning the same credential that grants posting rights silently granted full edit and delete authority over every other member's messages in that channel. A proof-of-concept script demonstrating end-to-end exploitation was included in the report; no public exploit code is independently confirmed at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Remote code execution in Keysight IxChariot Endpoint and related Keysight network-test products (Hawkeye, IxTap, IxProbe, IxBypass) allows an unauthenticated attacker to run arbitrary code with administrative privileges by sending a single specially crafted packet. The flaw is a classic stack-based buffer overflow reachable over the network with no user interaction (CVSS 4.0 9.3). No public exploit identified at time of analysis, but the trivial attack complexity and lack of any authentication make it a high-priority patch for any environment running these test tools.
Horizontal privilege escalation in the Paid Membership Subscriptions WordPress plugin (all versions before 3.0.8) allows any subscriber-level authenticated user to hijack and overwrite another member's subscription - including plan tier, status, and expiration date - by submitting a crafted change-subscription checkout request with an arbitrary subscription ID. The root cause is a missing ownership verification check at the business logic layer of the checkout flow (CWE-284). A publicly available proof-of-concept exploit has been published by WPScan, though EPSS sits at just 0.13% (3rd percentile), suggesting limited automated exploitation so far. The vulnerability is not listed in CISA KEV at time of analysis.
Authentication bypass in MaxSite CMS version 109.5 and earlier lets unauthenticated remote attackers reach admin-gated AJAX endpoints by sending any X-Requested-With header alongside a base64-encoded path that resolves to any *-ajax.php file in the codebase. Because the dispatcher never verifies an admin session, attackers can invoke privileged plugin operations - demonstrated by manipulating poll states and vote counts - and can amplify any dangerous action exposed by admin-only AJAX files across the plugin tree. No public exploit identified at time of analysis, but the flaw was reported by VulnCheck and a fixed release (109.6) is available.
Stored (second-order) SQL injection in OpenMeter (v1.0.0-beta.218 through v1.0.0-beta.231) lets an actor who can create or update a customer plant a malicious payload in the usageAttribution.key or usageAttribution.subjectKeys fields, which is later concatenated unsanitized into a ClickHouse WITH map(...) expression when the customer is referenced in a meter or event query. The delayed execution means the injection fires during downstream analytics/metering operations rather than at input time, giving an attacker read/manipulation access to the ClickHouse backend that stores usage and billing telemetry. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 9.3 (Critical).
Server-Side Request Forgery in Simple Google Calendar Outlook Events Widget WordPress plugin (all versions before 3.1.0) permits unauthenticated remote attackers to supply arbitrary URLs that the server fetches without validation, potentially exposing responses from internal services. The plugin is confirmed vulnerable by WPScan and a public exploit exists, though EPSS at 0.14% (4th percentile) indicates limited observed exploitation despite the available POC. This vulnerability is not listed in CISA KEV at time of analysis.
Authentication bypass in Atlas-Livre, a PHP guestbook/livre d'or web application by maximeAmini, lets unauthenticated remote attackers reach admin-only controller endpoints under Espace_admin/controleur/ and trigger destructive actions such as record deletion. The flaw stems from PHP redirect guards that call header() without a following exit/die, so protected code keeps executing regardless of session state. No public exploit is confirmed via KEV, though a referenced GitHub gist may contain proof-of-concept material; there is no active-exploitation listing at time of analysis.
Unauthenticated OAuth2 access-token theft in Flowise (npm/flowise <= 3.1.2) stems from the token-refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId being listed in WHITELIST_URLS, so it bypasses authentication entirely. Any remote party who knows or guesses a credential ID can force the server to decrypt the stored OAuth2 credential, refresh it against the provider using the victim's client secret, and receive the fresh access_token directly in the response body. No public exploit code has been identified, but the researcher (Shinobi Security) validated the missing-auth behavior in Docker, and a vendor-released patch is available in 3.1.3.
Remote code execution in FlowiseAI Flowise (npm packages flowise and flowise-components) versions 3.1.2 and earlier lets an authenticated user achieve root command execution on the host by injecting Python into the CSV Agent's Pyodide sandbox, which bridges back to the host Node.js process. Attackers reach OS command execution, credential theft, arbitrary file read, and server crash. A working Metasploit module and root Meterpreter session are documented, so publicly available exploit code exists, though the flaw is not listed in CISA KEV.
Adjacent-buffer overflow in OpenSIPS 3.4.0-beta through 3.6.5 and 4.0.0-beta arises in the {s.b64encode} string transformation, where the size check only validates that the input fits the 64 KB transformation buffer but ignores the ~33% expansion that base64 encoding introduces. Remote attackers can send a SIP message with a header value of roughly 50,000+ bytes to overflow the buffer by up to 21,844 bytes into an adjacent transformation buffer, corrupting values used by chained transformations on the same message; exploitability hinges on the routing script applying {s.b64encode} to attacker-controlled input. No public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available in 3.6.6 and 4.0.0-rc1.
Password recovery in Eclipse Milo (the open-source OPC UA SDK for Java) versions 0.6.0 through 1.1.4 allows an on-path attacker to break username-token confidentiality via a Bleichenbacher-style padding oracle. The server returns distinguishable error responses for invalid RSA PKCS#1 v1.5 padding versus other authentication failures during username-token processing, so an attacker who captures a victim's Basic128Rsa15-encrypted username token can send repeated unauthenticated ActivateSession requests to recover the cleartext password and then authenticate as the victim. No public exploit identified at time of analysis and it is not listed in CISA KEV; the weakness and its upstream fix are confirmed by the Eclipse Foundation.
Memory corruption in the OpenSIPS SIP server (versions prior to 3.6.6 and 4.0.0-rc1) lets remote attackers overflow a fixed 1024-byte global buffer via an oversized SIP URI username, deterministically corrupting adjacent global state such as the disable_503_translation flag and altering the server's routing behavior for subsequent messages. Exploitation requires that the deployed routing script pass an attacker-controlled username into construct_uri(); where that pattern exists, the flaw affects integrity and availability without authentication. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.
Hard-coded RSA private key exposure in GeoVision GV-AS1620 (GV-Cloud) access-control appliances lets remote attackers decrypt and forge the device's HTTPS traffic. The firmware ships an embedded, static RSA private key used by the built-in Lighttpd web server for TLS termination, so anyone who extracts it from one device can passively decrypt or actively impersonate the management interface of every device sharing that key. No public exploit identified at time of analysis, but the shared-secret nature makes the flaw broadly reusable once the key is recovered.
Hard-coded RSA private key exposure in the GeoVision GV-AS1620 (AS Manager) access-control device lets attackers who extract the firmware-embedded key decrypt and forge the Lighttpd TLS session used for the device's HTTPS management interface. Because the key is static and shared across all units of the same firmware, a single extraction compromises every deployed device, enabling passive traffic decryption and active server impersonation. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
Sensitive-data exposure in Bilin Software's HUMANIST Digital Human Resources (versions 26.0 up to but not including 26.1) stems from a cryptographic key embedded directly in the application binary, letting attackers recover the same static key from any deployment and abuse it against protected data. Because the key is identical across all installations, its extraction undermines confidentiality and integrity of anything it protects. No public exploit identified at time of analysis, and the flaw was reported through Turkey's national CSIRT (TR-CERT).
Arbitrary code execution in NASA's core Flight System (cFS) v7.0.1 is possible through the Executive Services (ES) dynamic application start path, where improper access control lets an attacker plant a malicious shared object on target storage that is then loaded and run as a flight application. SSVC records a proof-of-concept exploit (publicly available exploit code exists) and rates technical impact as total with automatable exploitation, though EPSS is very low at 0.15% (5th percentile). The published NVD vector is CVSS 9.1 (AV:N), but the described mechanism - dropping a shared object onto storage - implies local write access is a genuine prerequisite.
Cross-site scripting in Perspective 5.0.0's built-in Debug plugin enables an authenticated attacker with low privileges to inject arbitrary HTML and JavaScript into the embedding page's origin by writing crafted table cell values that bypass RFC 4180 quoting. The Debug plugin's CSV serialization renderer assigns table cell content directly to innerHTML without sanitization, meaning event handler attributes and unquoted injection payloads execute as script in any page embedding the component. A publicly available proof-of-concept exists; the vulnerability is not listed in CISA KEV, but the low attack complexity and available exploit code elevate practical risk above the moderate CVSS 4.0 score of 5.1.
Arbitrary file write in Veeam Service Provider Console (VSPC) lets an authenticated, low-privileged remote attacker plant or overwrite files on the management server via path traversal (CWE-22), which can be escalated to remote code execution on that server. All versions matched by the wildcard CPE are provisionally in scope pending vendor confirmation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.0 (Critical), driven by high confidentiality, integrity and availability impact plus subsequent-system impact.
Cross-site scripting in Ghost CMS (versions 5.26.0 through 6.54.0) allows a high-privileged administrator to plant arbitrary JavaScript via the Universal Import feature, which fails to sanitize the `feature_image_caption` field and link card URLs before storing and rendering them. The fix in v6.54.1 introduces DOMPurify sanitization across both the Ember-based admin post history modal and the Node.js frontend rendering pipeline, alongside a strict URL protocol allowlist in the JSON-to-HTML importer. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept is known; the high-privilege prerequisite substantially limits the realistic attacker pool.
Silent authorization bypass in Eclipse Milo OPC UA server SDK versions 1.0.0-1.1.4 allows anonymous network clients to invoke protected methods, read role-permission metadata, and delete protected nodes. The defect is a missing field copy in `OpcUaServerConfig.copy()`: when servers construct their running configuration via this method, the configured `RoleMapper` is silently dropped, causing the `DefaultAccessController` to receive empty role ID lists for every session and skip all role-permission enforcement. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Missing authorization controls in HAVELSAN Liman MYS (versions 2.2.3 through before 2.3.1) allow a low-privileged authenticated user to access and invoke functionality that should be restricted to higher-privileged roles, resulting in full confidentiality, integrity, and availability compromise of the managed system. The flaw stems from CWE-862 - the application fails to enforce ACL checks before granting access to privileged operations, effectively allowing privilege escalation within the platform. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this straightforward to exploit by any authenticated user.
SQL injection in Koha's circulation statistics report (reports/issues_stats.pl) exposes the entire Koha database to authenticated staff members holding the reports module permission. The vulnerability arises from direct string concatenation of at least six user-controlled HTTP parameters - PeriodTypeSel, PeriodDaySel, PeriodMonthSel, multiple Filter slots, and the Line and Column report-dimension identifiers - into raw SQL with no parameterized binding or whitelist validation, enabling extraction of the borrowers table (password hashes, two-factor TOTP secrets, personal data), api_keys, and active session tokens. No public exploit has been identified at time of analysis and SSVC rates exploitation as none, but vendor-released patches are available across all four active Koha release branches.
SQL injection in Koha's staff-facing report endpoint `reports/bor_issues_top.pl` enables any authenticated staff member holding the reports module permission to extract arbitrary data from the underlying database, including patron password hashes, two-factor authentication secrets, personal identifying information, API keys, and active session tokens. The vulnerability spans four concurrent release branches (24.11.x, 25.05.x, 25.11.x, 26.05.x) and is addressable by upgrading to patched releases issued by the Koha community. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as 'none' and the attack as non-automatable.
SQL injection in Koha's reports module allows an authenticated staff user with the reports permission to execute arbitrary SQL against the Koha database via `reports/issues_avg_stats.pl`. The `Line` and `Column` HTTP parameters are inserted verbatim into SQL identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY) and Filter slots are concatenated raw into comparison predicates without parameterized queries, exposing the full Koha database to read and potential write operations. Sensitive tables including `borrowers` (password hashes, two-factor secrets, patron PII), `api_keys`, and `sessions` are all reachable; no public exploit identified at time of analysis and CISA KEV does not list this CVE.
SQL injection in Koha's reports/catalogue_stats.pl allows an authenticated staff user with the reports module permission to read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions. Affected releases span all Koha branches prior to 24.11.17, 25.05.12, 25.11.06, and 26.05.01, with vendor-released fixes now available. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the SSVC framework rates exploitation status as none and automatable as no, reflecting the authenticated staff-account prerequisite.
SQL injection in Koha's acquisitions statistics module exposes sensitive library patron data to authenticated staff. The reports/acquisitions_stats.pl endpoint interpolates nine user-controlled Filter parameters directly into SQL WHERE fragments without prepared-statement binding, giving any staff account holding the reports permission arbitrary read access to the Koha database - including borrower password hashes, two-factor secrets, API keys, and active session tokens. No public exploit or active exploitation has been identified, but the attack is straightforward for any insider or compromised staff account.