Remote command injection in the Shenzhen Aitemi M300 Wi-Fi Repeater (firmware r0-ea7890a) enables unauthenticated network-adjacent attackers to execute arbitrary OS commands by manipulating the enable, name, or mac parameters of the MAC address filter configuration CGI endpoint. The vulnerable sprintf call in the protocol.csp handler passes user-supplied input directly into a shell command string without sanitization. A public proof-of-concept exploit has been published on GitHub, significantly lowering the exploitation barrier, though no CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in UTT HiPER 1200GW firmware (versions up to 2.5.3-170306) enables authenticated remote attackers to corrupt stack memory via the EncryptionMode parameter in the PPTP VPN configuration endpoint, potentially achieving arbitrary code execution on the device. The root cause is unsafe use of strcpy() without bounds validation in the /goform/pptpSrvGlobalConfig handler. A public proof-of-concept exploit has been disclosed on GitHub; the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis. No public exploit identified at time of analysis as KEV, but POC lowers the practical exploitation barrier significantly.
SQL injection in the Iptanus File Upload WordPress plugin (all versions before 5.1.8) enables unauthenticated remote attackers to query the underlying WordPress database without any credentials or user interaction. The CVSS scope-change indicator (S:C) reflects that the injection can reach data beyond the plugin's own tables - including WordPress core tables containing admin password hashes, user emails, and site configuration. No public exploit identified at time of analysis, and EPSS at 0.18% (7th percentile) suggests exploitation has not yet been observed at scale, though the unauthenticated attack surface makes it an attractive target as awareness grows.
SQL injection in the CubeWP Framework WordPress plugin (all versions before 1.1.31) allows any authenticated user with Subscriber-level access or above to execute arbitrary SQL queries against the WordPress database via a crafted AJAX action. The vulnerability is compounded by a missing capability check on the affected AJAX endpoint, meaning the lowest-privilege WordPress user role can reach and exploit it without restriction. EPSS is low at 0.16% (5th percentile) and no public exploit or CISA KEV listing has been identified at time of analysis, though the low authentication bar makes mass exploitation feasible on sites with open registration.
Command injection in Tenda CH22 firmware version 1.0.0.1 allows a low-privilege authenticated remote attacker to execute arbitrary OS-level commands by supplying a malicious Name parameter to the formCertListInfo function at the /goform/CertListInfo endpoint. The vulnerability carries a CVSS 4.0 score of 7.4 with high impact across confidentiality, integrity, and availability of the affected device. A public proof-of-concept has been disclosed via a VulDB submission and associated Notion writeup, materially lowering the exploitation bar; no vendor-released patch has been identified at time of analysis.
Path traversal in parisneo/lollms 2.1.0 exposes arbitrary server files to unauthenticated remote attackers via the SPA catch-all route in `backend/routers/ui.py`. URL-encoded dot-dot sequences (`%2e%2e`) bypass Starlette's built-in path normalization and are decoded by Python's `pathlib.resolve()`, allowing directory escape from the static file root with no privileges or user interaction required. No public exploit has been independently confirmed at time of analysis, though the public fix commit at GitHub fully documents the vulnerable code pattern and the bypass technique, substantially lowering the bar for exploit development.
NULL pointer dereference in Crypt::OpenSSL::PKCS12 before version 1.98 for Perl enables process crashes when any caller invokes info_as_hash() on a crafted PKCS#12 file containing a zero-length BMPSTRING bag attribute. The root cause is a zero-size Renew() call that Perl's memory allocator implements as a free() returning NULL, which is subsequently dereferenced inside strlen() within a call to newSVpvn(). With no public exploit identified at time of analysis and an EPSS of 0.19%, active exploitation is currently unlikely, though any service that parses attacker-supplied PKCS#12 data and calls info_as_hash() is directly exposed to denial of service.
Unauthenticated denial-of-service in WP Maps Pro WordPress plugin before 6.1.3 allows any remote attacker without credentials to exhaust server resources by triggering uncontrolled recursion through an exposed AJAX endpoint. The plugin fails to perform a capability check on at least one AJAX action accessible via the wp-ajax-nopriv_ hook and does not restrict the operation that action dispatches. No public exploit code has been identified at time of analysis and EPSS exploitation probability is very low (0.14%, 4th percentile), though successful exploitation can fully degrade availability of the affected WordPress installation.
WPC Order Tip for WooCommerce plugin (all versions before 3.3.1) exposes sensitive customer order data to unauthenticated remote attackers via an unprotected reporting feature that performs no authorization or nonce verification. Any unauthenticated party with network access to the WordPress store can query the endpoint and retrieve billing names, order IDs, statuses, fee amounts, and order dates for any customer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; EPSS sits at the 4th percentile, indicating low current exploitation activity despite a high CVSS score.
Unauthenticated column enumeration in the WP Data Access WordPress plugin (all versions before 5.5.79) allows remote attackers to read arbitrary database column values from any table bound to a public front-end form, with the most critical exposure occurring when that table is the WordPress users table - enabling retrieval of all stored password hashes. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with no authentication required. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates negligible observed exploitation activity, though the attack surface is straightforward once a vulnerable form is located.
GeoDirectory WordPress plugin versions before 2.8.169 leak the title and exact geographic coordinates of non-public (pending or draft) listings to unauthenticated HTTP requests due to a missing authorization check on the map marker data endpoint. Any internet-accessible WordPress site running an affected version inadvertently exposes private listing location data to anonymous callers. No public exploit code has been identified at time of analysis, and the vendor has released a fix in version 2.8.169.