Reflected XSS on the WordPress login page allows remote unauthenticated attackers to inject and execute malicious scripts in a victim's browser via specially crafted URLs, with a conditional escalation path to remote code execution. All WordPress versions are affected; exploitation requires active social engineering and explicit victim interaction, and the RCE escalation pathway depends on conditions outside the attacker's direct control. No public exploit has been identified at time of analysis; WordPress 7.0.3 and backported branch releases resolve the vulnerability.
Local file inclusion via path traversal in WP Maps WordPress plugin (before 4.9.7) allows any authenticated Subscriber-level user to include and execute arbitrary existing PHP files on the server, resulting in full compromise of confidentiality, integrity, and availability. The root cause is a missing capability check on an AJAX action combined with unvalidated user-controlled path input - two compounding weaknesses that collectively drop the privilege bar to the lowest registered-user tier. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation activity at time of analysis despite the public POC.
Remote code execution in Subscriptions for WooCommerce WordPress plugin (before 2.0.1) is reachable by any authenticated Shop Manager through a missing capability check on a nonce-protected AJAX action that installs and activates arbitrary plugins from user-supplied slugs. Shop Managers, who by WordPress design are not granted plugin management capabilities, can exploit this gap to install a malicious plugin and achieve full server-side code execution. A publicly available proof-of-concept exists; however, EPSS is low (0.18%, 8th percentile) and the vulnerability is absent from CISA KEV, indicating exploitation remains opportunistic rather than widespread.
Heap-use-after-free in the Ruby json gem's native C extension (versions 2.20.0 through 2.21.1) allows an unauthenticated remote attacker to crash the Ruby process by supplying a crafted truncated JSON stream with duplicate object keys to any application using JSON::ResumableParser. The root cause is that the parser's input buffer is freed without resetting the state.start, state.cursor, and state.end pointers, which are subsequently dereferenced when partial_value processes the duplicate-key warning path via cursor_position, producing a heap-use-after-free confirmed by AddressSanitizer and a native SIGSEGV on official RubyGem releases. Impact is limited to availability - no code execution or information disclosure is claimed - and no public exploit code has been identified at time of analysis, though a private end-to-end TCP proof-of-concept was submitted with the advisory.
Incorrect authorization in the Nexus Repository 3 CE/Pro repository-creation UI allows an authenticated user with a format-scoped delegated repository-admin privilege to create repositories in unauthorized formats - bypassing the intended scope boundary. Affected are all releases from 3.0.0 through 3.94.x; version 3.95.0 resolves the flaw. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the integrity impact is high given that unauthorized repository types could be introduced into a managed artifact store, potentially tainting software supply chain pipelines.
SQL injection in the Content Views WordPress plugin before 4.5 exposes the underlying WordPress database to any authenticated user, including low-privilege Subscribers. Two compounding weaknesses drive this: a missing capability check on an AJAX action allows unprivileged users to reach a sensitive endpoint, and unsanitized attacker-controlled input is then passed directly into a raw SQL query. A publicly available POC exists via WPScan, and SSVC rates the technical impact as total, though EPSS remains low at 0.16%, suggesting no widespread automated exploitation at time of analysis.
Account takeover in MStore API WordPress plugin before 4.21.0 is achievable by unauthenticated remote attackers who know a target's registered phone number, by forging a cryptographically invalid login token that the plugin fails to properly verify. This yields full control over the targeted account, including administrator-level WordPress accounts. A publicly available proof-of-concept exists; however, no CISA KEV listing is present and EPSS at 0.14% (3rd percentile) indicates low observed exploitation to date, likely constrained by the phone-number reconnaissance prerequisite.
Hardcoded plaintext credentials embedded in ZTE device firmware expose the web management interface to unauthorized access. The initial login credentials for the device's web interface are stored unencrypted within the firmware image, allowing any party who obtains the firmware to authenticate to any affected device. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the trivial nature of credential extraction from downloadable firmware files significantly elevates practical risk beyond what EPSS alone may reflect.
Cryptographic signature spoofing in Microsoft Teams exposes enterprise collaboration environments to unauthenticated identity impersonation over the network. The flaw, tagged as a JWT attack enabling authentication bypass, allows a remote attacker with no prior credentials to forge or tamper with token-based identity claims that Teams fails to properly verify. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a low-barrier, remotely exploitable path with high integrity impact.
Unauthenticated REST API bypass in the 'Password Protected - Lock Entire Site' WordPress plugin (versions 2.6.8 through 2.8.3) exposes all password-gated content and account identifiers to unauthenticated visitors when the plugin's REST API restriction option is enabled. This is a confirmed regression of CVE-2024-0437, which was originally patched in version 2.6.7 but silently reintroduced in the very next release (2.6.8), leaving sites unprotected for any version in that range. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.15% (4th percentile), indicating limited observed exploitation at time of analysis.
Integrity bypass in MStore API WordPress plugin (versions before 4.21.0) enables unauthenticated remote attackers to create fraudulent WooCommerce product reviews with arbitrary reviewer names, email addresses, and star ratings, completely circumventing the store's verified-purchase-only review restriction. The plugin's REST API review creation route applies neither authorization nor purchase-ownership validation, rendering the WooCommerce protection setting ineffective when the plugin is active. A publicly available proof-of-concept exists and SSVC confirms the attack is automatable, though the EPSS exploitation probability sits at just 0.14% (3rd percentile), suggesting limited real-world exploitation activity despite ease of execution.
Login CSRF in the Estatik Real Estate Plugin for WordPress (before 4.3.3) enables an unauthenticated attacker to hijack a victim's session by tricking them into completing an OAuth social login flow bound to an attacker-controlled account. Once the victim is logged in as the attacker, all subsequent activity - property searches, saved listings, contact forms, personal profile data - is captured and readable by the attacker. A publicly available proof-of-concept exists per WPScan, and SSVC classifies this as automatable with partial technical impact, though EPSS remains very low (0.10th percentile), suggesting limited observed exploitation to date.
Symlink traversal in go-git's worktree filesystem layer allows a maliciously crafted repository to cause write operations to escape the intended worktree boundary when cloned and operated upon. Affected are all filesystem-backed go-git deployments using v5 prior to 5.19.2 and v6 prior to 6.0.0-alpha.5. An attacker who controls a repository can plant symlinks such that a victim's go-git worktree operations (checkout, add, status) silently overwrite files outside the working directory - including critical Git metadata like .git/config - enabling repository poisoning or arbitrary local file corruption. No public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV).
Local privilege escalation in StableBit Scanner 2.6.13.4088 allows a low-privileged Windows user to exploit permission misconfigurations in Scanner.Service.exe - the Windows service component of the disk health monitoring tool - to achieve high confidentiality, integrity, and availability impact on the local system. The exploit reference titles the technique as 'local privilege escalation via insecure deserialization,' suggesting the ScannerService's IPC or communication surface deserializes attacker-controlled data without adequate permission enforcement. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists per VulDB and the referenced PoC page, though no CISA KEV listing confirms active in-production exploitation.
Improper access control in V-Secure Jingyun Antivirus 2.4.2.39 allows a local low-privileged user to interact with the ZyArk.sys kernel driver in ways that bypass intended access restrictions, yielding high-impact compromise of confidentiality, integrity, and availability on the affected host. A publicly available proof-of-concept exploit (E:P per the CVSS 4.0 vector) lowers the bar for exploitation, though the local-only attack vector limits the exposure to already-authenticated users or post-initial-access scenarios. The vendor was contacted prior to disclosure but did not respond, meaning no official patch exists at time of analysis.
Local privilege escalation in Jiangmin Antivirus 21 exploits improper access controls in the kernel-mode driver kvcore.sys, specifically within the MessageNotifyCallback function of the Minifilter Port component. A low-privileged local attacker can send crafted messages to this communication port to bypass access enforcement, achieving high impact across confidentiality, integrity, and availability on the affected system. No public exploit identified at time of analysis is incorrect here - a publicly available exploit exists on GitHub, and the vendor did not respond to responsible disclosure, leaving no patch available.
Local privilege escalation in PowerISO 9.3.0.0 on Windows exposes low-privileged local users to full system compromise via the scdemu.sys kernel driver's improper privilege management (CWE-269). The exploit - publicly detailed as arbitrary registry write or deletion through the driver's IOCTL interface - allows elevation to SYSTEM-level control with high confidentiality, integrity, and availability impact on the vulnerable host. No vendor patch exists; the vendor did not respond to responsible disclosure, and a public proof-of-concept has been released, lowering the skill threshold for exploitation.
DeepCool DisplayService 1.2.12 on Windows exposes an unauthenticated LocalSystem-level named pipe control channel that any low-privileged local user can connect to and manipulate, enabling full privilege escalation to SYSTEM. The root cause is CWE-284 (Improper Access Control) - the service's IPC channel enforces no caller authentication or ACL verification. A public proof-of-concept is available per VulDB and a researcher's writeup; the vulnerability is not currently listed in CISA KEV, indicating no confirmed mass exploitation, though the low attack complexity and available POC materially elevate near-term risk.
Local privilege escalation in StableBit DrivePool 2.3.13.1687 allows a low-privileged local user to achieve high-impact compromise of confidentiality, integrity, and availability on the affected system. The vulnerability resides in DrivePool.Service.exe and stems from CWE-275 permission issues, with the publicly available exploit reference explicitly identifying insecure deserialization as the attack mechanism enabling escalation. No active exploitation has been confirmed by CISA KEV, but a public proof-of-concept exists and the CVSS 4.0 vector includes E:P (exploit proof-of-concept), elevating real-world risk above theoretical.
Path traversal in Microsoft Application Insights Profiler allows an authenticated low-privilege network attacker to escalate privileges, with high confidentiality, integrity, and availability impact. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) indicates exploitation requires no special conditions beyond a valid low-privilege account and network reachability, making the barrier to exploitation low. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and high impact profile warrant prompt remediation.
Privilege escalation in Microsoft Purview eDiscovery enables an authenticated low-privileged attacker to gain elevated access over the network, with full confidentiality, integrity, and availability impact once exploited. The vulnerability stems from improper access control (CWE-284), meaning the service fails to enforce authorization boundaries between privilege levels for eDiscovery operations such as case management, legal holds, and content searches. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible threat in Microsoft 365 enterprise environments.
Missing authentication in VHF Data Link (VDL) CPDLC (Controller-Pilot Data Link Communications) enables rogue ground stations to inject unauthorized clearance messages into cockpit avionics over radio frequency. Pilots receiving spoofed CPDLC messages may follow misleading ATC instructions - altitude changes, heading redirections, or route modifications - with no indication the messages are inauthentic. This ICS-CERT advisory (ICSA-26-219-01) exposes a systemic protocol-level authentication gap with no public exploit identified at time of analysis.
Message injection into Controller-Pilot Data Link Communications (CPDLC) enables remote attackers operating over radio frequency to insert false emergency or operational status messages into aviation communication channels, causing flight crews, air traffic controllers, and ground operations personnel to misallocate resources or take unsafe response actions. Disclosed by CISA ICS-CERT under advisory ICSA-26-219-01, this vulnerability affects CPDLC-equipped aircraft avionics and ATC ground systems globally, with high integrity impact to both the vulnerable communication system and downstream aviation safety systems. No public exploit has been identified at time of analysis, though the high attack complexity constrains the threat actor population to technically sophisticated adversaries with aviation-domain knowledge and RF transmission capability.
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attackers to crash the server by crafting an HTTP password-change request with a non-INI target file of excessive size. The handler activates solely on the presence of the string "(editini)" in the request path with no further validation, triggering a buffer overflow that terminates the server process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trigger mechanism is fully detailed in the InfoGuard coordinated disclosure.
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated low-privileged user - who holds the 'update privilege definitions' permission - to silently elevate themselves to full administrative access by editing wildcard privilege definitions already scoped to their own role. No additional authorization check, role reassignment, or administrator approval is required for this escalation. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.9 and the complete confidentiality, integrity, and availability impact - including lateral impact on downstream systems - indicate high real-world risk for any organization using Nexus Repository 3 as a software supply chain hub.
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side password files - via direct filesystem access or through the companion 'Random File Read' vulnerability - to reverse the obfuscation applied to locally-created user passwords and recover plaintext credentials. All TeamDavid deployments through Rollout 524 using locally created accounts are affected, making this a critical identity compromise risk for organizations relying on TeamDavid as an M365 alternative. No public exploit has been independently confirmed, but InfoGuard Labs published a 22-CVE research campaign against this product that likely includes technical detail enabling exploitation.
DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows enables a local low-privileged attacker to execute arbitrary code at the privilege level of the SDK process by planting a malicious DLL in a user-controlled directory present in the PATH environment variable. The SDK's dependency resolution fallback traverses PATH when a required DLL is not found locally, making the attack reliable and requiring no special tooling. No public exploit has been identified at time of analysis, but the technique is well-documented and the CVSS scope change (S:C) signals that impact can extend beyond the attacker's own privilege tier if the SDK runs under a higher-privileged account.
Unauthenticated remote denial-of-service in absinthe_federation 0.1.0-0.9.2 allows an attacker to permanently exhaust the BEAM (Erlang VM) atom table and crash the application node by sending crafted GraphQL `_entities` queries with large numbers of unique representation keys. The `convert_key/2` function in `entities_field.ex` unconditionally calls `String.to_atom/1` on all client-supplied keys, bypassing schema coercion through the open-ended `_Any` scalar; since BEAM atoms are never garbage collected and the atom table is hard-capped at approximately 1,048,576 entries, a handful of requests carrying tens of thousands of unique keys exhausts the table and aborts the node. No public exploit code or CISA KEV listing exists at time of analysis, but the attack mechanism is well-understood in the Erlang ecosystem and trivially automatable.
Path traversal in Pathling Server's FHIR bulk export result endpoint (`/$result`) prior to version 2.0.0 allows any caller holding a valid async export job ID to read arbitrary files from the warehouse database root by supplying crafted `file` parameter values containing directory traversal sequences. Because the server validates the job ID but never normalizes or confines the requested file path to the job's designated `jobs/<jobId>` subdirectory, and because export scratch space cohabits the same filesystem root as persisted FHIR resource tables, an attacker can exfiltrate sensitive clinical health data. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with a fully unauthenticated network vector makes this a high-priority patch for healthcare deployments with export operations enabled.
Path traversal in Pathling Server's FHIR async export `/$result` endpoint exposes arbitrary warehouse filesystem files to any caller who can supply a valid export job ID. All Pathling Server deployments prior to version 2.0.0 running without authentication and with async export enabled are affected, as the file handler accepts user-supplied path components without normalization or directory confinement. No public exploit code has been identified at time of analysis, but the technique is straightforward - the attacker need only initiate their own export job to obtain a valid job ID, then traverse out of the job directory to reach co-located FHIR resource tables, which may contain protected health information.
Stored XSS in SP Page Builder (Joomla extension by JoomShaper) prior to version 6.7.0 allows unauthenticated remote attackers to persist arbitrary JavaScript in a Joomla site's database via a single HTTP request to the Shapes API endpoint. When any administrator subsequently opens the SP Page Builder editor, the payload executes automatically in their browser session, enabling session hijacking, credential theft, or full backend site compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection vector combined with automatic detonation on routine admin activity makes this a high-priority patch target for any Joomla installation running this extension.
Remote code execution in Sonatype Nexus Repository 3 is achievable by any user holding the nx-datastores-update permission, who can exploit an insufficiently restricted HikariCP connection-pool property passthrough in the DataStore configuration API to inject arbitrary SQL via the connectionInitSql property. On the default H2 embedded database backend - common in non-production and smaller deployments - H2's ability to invoke Java methods from SQL allows this injection to escalate to OS-level command execution as the Nexus process user. No public exploit has been identified at time of analysis, but the H2-to-RCE escalation path is a well-understood Java ecosystem technique that lowers the practical skill bar significantly.
Credential exfiltration in Pathling Server prior to 2.0.0 allows an allowed submitter to hijack the bulk-submit OAuth flow by supplying an attacker-controlled `oauthMetadataUrl` parameter that is never validated against the server's configured `pathling.bulkSubmit.allowableSources` allowlist. Pathling blindly fetches OAuth metadata from the caller-supplied URL, trusts the returned `token_endpoint`, and transmits stored OAuth client credentials directly to the attacker's infrastructure. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the credential theft impact is severe for any healthcare organization running FHIR bulk data pipelines on this platform.
Pathling Server before version 2.0.0 permits authenticated callers holding only coarse operation-level authorities (e.g., `pathling:search`) to act on arbitrary FHIR resource families - including resource types they are not explicitly authorized to read or write - because typed search, update, and batch handlers enforce the operation-level authority check but skip the documented per-resource authority check (e.g., `pathling:read:Patient`). The flaw breaks the two-factor authorization model the product documents, exposing potentially all FHIR resource families to any valid operation-authority holder. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis; the vulnerability is fixed in Pathling Server 2.0.0.
Authorization bypass in Pathling Server (prior to 2.0.0) allows an authenticated caller holding only coarse operation-level permissions (e.g., `pathling:search`) to access arbitrary FHIR resource types without possessing the required per-resource authority (e.g., `pathling:read:Patient`), enabling unauthorized disclosure of clinical health records across the FHIR repository. The root cause is that typed search, update, and related FHIR handlers are annotated solely with `@OperationAccess(...)` and omit the second-layer per-resource authority check mandated by the documented authorization model. No public exploit has been identified at time of analysis and a vendor-released patch is available in version 2.0.0.
Stored cross-site scripting in lakeFS Web UI allows an authenticated contributor to execute arbitrary JavaScript in any other user's authenticated browser session. The renderer for `.md` objects and `README.md` files in both the open-source edition (< 1.81.1) and Enterprise edition (< 1.84.0) passes Markdown-derived HTML to the DOM without sanitization, making any writable branch a potential injection point. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and automatic rendering of `README.md` on directory browse materially lower the barrier to exploitation for any insider or contributor with write access.
Insufficient session expiration in Sonatype Nexus Repository 3 allows a previously-authenticated user to retain full repository access after their account is deleted, deactivated, or their password is changed. Any user holding an active session at the moment of an administrative revocation event can continue reading, modifying, or deleting repository content until that session naturally times out - bypassing the intended access control action. No public exploit has been identified and this is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects the high-impact triad of confidentiality, integrity, and availability against network-accessible repositories once the prerequisite session exists.
Privilege escalation in Sonatype Nexus Repository 3 allows an authenticated user holding privilege-management rights to elevate their own access to full administrator by exploiting a type-confusion flaw (CWE-843) in the REST privilege update endpoint. Exploitation is constrained to specific role configurations, but the network-accessible attack surface and high confidentiality and integrity impact (VC:H/VI:H per the CVSS 4.0 vector) make this a meaningful insider or compromised-account risk in enterprise DevOps environments. A vendor-released patch is available in the Nexus Repository 3.95.0 release; no public exploit code or CISA KEV listing has been identified at time of analysis.
The `$import-pnp` operation in Pathling Server allows low-privileged callers to supply an arbitrary `exportUrl`, causing the server to forward its configured PNP credentials to an attacker-controlled FHIR endpoint and stage the returned files as trusted local sources - effectively bypassing the `allowableSources` allowlist that guards the standard `$import` operation. All Pathling Server deployments prior to version 2.0.0 with PNP credentials configured are affected, with high confidentiality and integrity impact (credential theft and unauthorized data import). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the attack requires only low-privilege API access and is low-complexity.
Command injection via unsanitized backup filenames in Kakoune (all versions prior to 2026.05.21) enables arbitrary Kakoune script and shell command execution when a victim opens a file in the editor. The bundled `autorestore.kak` script - enabled by default - discovers backup files by pattern-matching filenames in the same directory as the opened file, then incorporates those filenames directly into shell command strings without validating special characters in the suffix component. No public standalone exploit has been identified at time of analysis, though the fix commit (25c7b13) includes test cases that explicitly demonstrate the injection pattern using filenames such as `.out.kak.;"foo"`, confirming exploitability.
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthenticated remote attackers to create or overwrite server-side files with attacker-controlled content, enabling persistent stored cross-site scripting. Because user input is written directly to disk without content or file-type validation, an attacker can plant .htm files containing malicious JavaScript that execute in any victim's browser upon access. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the unauthenticated write primitive combined with stored XSS persistence makes this a high-priority remediation target for TeamDavid operators.
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privilege remote attackers to create directories in arbitrary filesystem locations, including sensitive Windows system paths such as C:\Windows and other users' directories. All TeamDavid releases through Rollout 524 are affected, as confirmed by NCSC.ch and detailed in InfoGuard's research disclosing 22 CVEs across the David platform. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.5 reflects significant potential impact on both the vulnerable host and downstream systems.
Remote code execution in ZenML 0.94.6 allows any attacker with write access to a shared artifact store to plant a malicious cloudpickle payload that executes arbitrary system commands when a legitimate user or pipeline materializes the tampered artifact. The root cause is unsanitized deserialization via cloudpickle.load() in CloudpickleMaterializer without any integrity verification of the stored artifact.pkl file before loading. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the attack is conceptually straightforward for any attacker with artifact store write access in a multi-user ZenML deployment.
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to bypass server-side path filters using NTFS alternate data stream (ADS) notation, enabling access to highly sensitive files including other users' credential files containing plaintext passwords and the server's private key. The flaw exists in the Webbox messaging component where the proprietary '@@attach' directive, supplied via the 'scjob' form field, is processed without adequate path canonicalization - the filter blocking access to David configuration and user directories is bypassed entirely by ADS-encoded paths. No public exploit has been identified at time of analysis, though this vulnerability is part of a multi-CVE research disclosure of 22 issues in the David platform by Infoguard.
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file on the underlying server by injecting the internal @@COMMENTFILE directive into the scjob form field of the messaging interface. All deployments through Rollout 524 are affected per NVD and NCSC.ch reporting. No public exploit has been identified at time of analysis, though this CVE is one of 22 vulnerabilities disclosed by infoguard.ch in the same research campaign, indicating broad systemic security weaknesses in the product.
Phoca Commander (Joomla file manager extension by phoca.cz, versions 1.0.0-6.1.3) exposes arbitrary server-side files through a path traversal flaw in its getSource function, allowing attackers with Joomla administrator credentials to read files outside the extension's intended directory scope - including sensitive configuration files, credentials, and system files. The CVSS 4.0 score of 8.2 reflects a high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H), meaning the disclosure can extend beyond the Joomla application boundary to the underlying server filesystem. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, making active exploitation unconfirmed at time of analysis.
PATH hijacking in NexTor IP Changer prior to 2.0.0 allows a local attacker with low privileges to execute arbitrary code by substituting malicious binaries for trusted executables such as sudo. The root cause is unsafe use of Python's subprocess with shell=True without resolving executables to absolute paths, making the tool vulnerable to CWE-78 (OS Command Injection) and CWE-426 (Untrusted Search Path). No public exploit or active exploitation has been identified at time of analysis; version 2.0.0 resolves the issue by hardcoding absolute paths for all system commands.
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Environment (REE) kernel control to corrupt GPU Firmware data across the TEE security boundary. The GPU Firmware blindly dereferences a pointer sourced from non-secure memory when moving internal data between tightly coupled private memory and main memory - a trust boundary violation that undermines the fundamental isolation guarantee of Trusted Execution Environment platforms. No active exploitation has been confirmed (CISA KEV absent), and EPSS sits at 0.15% (5th percentile), but the cross-domain nature of this flaw makes it relevant for embedded, mobile, and automotive threat models where TEE integrity is a security anchor.
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rollout 524 via Server-Side Request Forgery using UNC paths. The search endpoint's 'pathnameroot' parameter accepts network location strings (e.g., \\Server\Share) without sanitization, causing the server to initiate outbound SMB authentication to attacker-controlled infrastructure and leak NTLM hashes or session tokens. Where outbound port 445 is not filtered, an unauthenticated remote attacker can exploit this for SMB relay attacks or offline credential cracking, potentially enabling lateral movement into Active Directory environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL injection in Plesk Obsidian up to version 18.0.80 on Linux and Windows allows any authenticated panel user to read arbitrary data from the underlying control panel database. The CVSS scope change (S:C) reflects that the injected queries cross the application boundary into the database tier, and the high confidentiality impact (C:H) is consistent with a hosting control panel whose database contains cross-tenant customer records, credentials, and configuration data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.