Missing authorization in code-projects Task Management System 1.0 allows remote unauthenticated attackers to manipulate task records by sending crafted requests to /user/UpdateTaskStatus.php with arbitrary task_id and val parameters. The server performs no permission check before processing the status update, enabling any network-reachable party to alter task data belonging to any user. A public proof-of-concept exploit exists per VulDB and a GitHub issue report, making opportunistic abuse straightforward despite the absence of a CISA KEV listing.
SQL injection in dresende/node-sql-query versions 0.1.25-0.1.28 allows attackers who can influence the joinType option passed to SelectQuery.from() to inject arbitrary SQL into JOIN clauses, because the joinType string was interpolated directly into the query without any allowlist validation. Applications built on this Node.js SQL query-builder library that pass user-controlled input to the joinType parameter are exploitable remotely with no authentication (per the CVSS 4.0 AV:N/PR:N vector). A publicly available exploit exists per the E:P maturity flag and referenced GitHub issue; no confirmed active exploitation (not in CISA KEV). A vendor-released patch is available as v0.1.29.
SQL injection in code-projects Task Management System 1.0 exposes unauthenticated remote attackers a path to manipulate database queries through the task_id parameter in /user/comment_count_user.php. The flaw is a textbook CWE-89 input-neutralization failure in a PHP application with no authentication barrier, and exploit code has been publicly disclosed via GitHub. No CISA KEV listing exists at time of analysis, but the zero-authentication network attack vector combined with available proof-of-concept code significantly lowers the exploitation bar.
Authentication bypass in code-projects Task Management System 1.0 exposes the login endpoint at /index.php to remote unauthenticated attackers who can manipulate the Password parameter to circumvent credential verification entirely. The flaw is classified under CWE-287 (Improper Authentication) and affects all known versions of this PHP application per the wildcard CPE string. A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.
Unauthenticated remote exploitation of Badaso 3.0.0-alpha's File API allows attackers to bypass permission controls in ApiRequest::class (src/Routes/api.php), resulting in unauthorized read, write, and access operations on file resources. The vulnerability stems from improper permission assignment (CWE-275) in the PHP-based File API route handler. A public exploit has been disclosed via a GitHub issue; the vendor has not responded to the coordinated disclosure.
SQL injection in code-projects Task Management System 1.0 exposes the pre-authentication admin login endpoint at /admin/AdminLogin.php to unauthenticated remote attackers who can manipulate the email or password parameters to execute arbitrary SQL commands. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, low-complexity network exploitation with no special conditions required. A public proof-of-concept exploit has been published on GitHub, materially lowering the skill threshold for exploitation; however, this CVE does not appear in the CISA KEV catalog at time of analysis.
Local file inclusion in WP Maps Pro (all versions before 6.1.3) allows unauthenticated remote attackers to include and execute arbitrary existing PHP files on the server by exploiting an AJAX action that lacks both a capability check and path sanitization. Any internet-exposed WordPress installation running the affected plugin is susceptible with no authentication, user interaction, or special configuration required. No public exploit identified at time of analysis and EPSS is low (0.32%), but the zero-barrier entry point and code execution potential elevate the real-world priority well above what the CVSS 6.5 score implies.
Missing authorization and ownership checks in the PiWeb Cancel order / Refund request for WooCommerce WordPress plugin (versions before 1.3.4.34) expose two distinct attack surfaces: unauthenticated order content disclosure and unauthenticated cart manipulation against logged-in users. Any unauthenticated actor can query another customer's order contents by supplying an arbitrary order ID, and can clear and repopulate a logged-in user's cart via a crafted request, degrading shopping session integrity without any privilege. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates low observed exploitation probability.
Missing authorization on a public REST API route in the Create WordPress plugin before 2.5.4 exposes unpublished content to unauthenticated remote attackers and permanently publishes it as a side effect of the read request. Any WordPress site running an affected version of this plugin may have draft, scheduled, or private posts silently promoted to public visibility without any author or administrator action. No public exploit code has been identified at time of analysis, and EPSS at 0.14% (3rd percentile) signals low current exploitation interest, though the trivially low attack complexity makes opportunistic targeting straightforward once the endpoint is known.
Unauthenticated remote access to unpublished WordPress content is possible through a missing authorization check in the Create plugin (all versions before 2.5.4), with the compounding side effect that accessing the vulnerable REST API route also forces the requested content to be published publicly. Both the confidentiality breach (reading private drafts) and the integrity violation (forced publication) occur in a single unauthenticated request, making this a dual-impact flaw affecting any WordPress site with the plugin installed below version 2.5.4. No public exploit has been identified at time of analysis, and EPSS is low at 0.14% (3rd percentile), though the zero-barrier network vector warrants prompt patching on content-sensitive sites.
Stored cross-site scripting in the LWS Optimize WordPress plugin (all versions before 4.1.2) enables unauthenticated remote attackers to inject persistent JavaScript via the plugin's analytics endpoint, which then executes in the browser of any administrator who views the affected dashboard page. The vulnerability requires no authentication to exploit the injection phase, making mass poisoning of sites feasible before any admin interaction occurs. No public exploit is identified at time of analysis; a vendor-released patch is available in version 4.1.2.
Memory exhaustion via decompression bomb in Ash Framework's keyset pagination can terminate Erlang nodes running versions 1.17.0 through 3.31.0. The `decode_values/2` function in `lib/ash/page/keyset.ex` deserializes client-supplied `page[:after]` or `page[:before]` cursors using `:erlang.binary_to_term/2` without rejecting compressed Erlang external term format payloads or bounding the deserialized size, allowing a cursor of a few kilobytes on the wire to inflate to tens of megabytes of heap per request. No active exploitation (CISA KEV) has been identified, but the attack is mechanically trivial for any caller reaching a keyset-paginated endpoint, and the vendor patch test suite includes a working reproduction payload.
Heap out-of-bounds reads and writes in Perl's regular expression engine through version 5.45.1 arise from a signed 32-bit integer overflow when computing the superlinear cache size in S_regmatch. When a subject string of approximately 286,331,153 bytes is matched against a pattern containing 15 or more WHILEM-participating nodes, the bit-count product overflows to 14, producing a two-byte cache allocation that is then indexed far beyond its bounds. A caller passing attacker-controlled input of this size to such a pattern can crash the Perl process or corrupt heap memory; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unsafe deserialization in lmammino/oidc-authorizer (versions up to 0.4.0) exposes confidential data via manipulated JWT claims submitted to the Fixed Message Handler component. The vulnerable code path runs through the `unwrap` function in `src/handler.rs`, which processes the `jwtClaims` argument without adequate deserialization controls - particularly concerning given this component's role as an OIDC authorization gatekeeper. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation with low complexity; a public proof-of-concept exists (E:P), and the vendor has not responded to disclosure, meaning no patch has been confirmed.
Denial of service in lmammino oidc-authorizer 0.4.0 can be triggered remotely by submitting a crafted value for the authorization_token argument processed by the parse_token_from_header function in the Authorization Header Parsing component. Any service using this Rust library to validate OIDC tokens via the HTTP Authorization header is exposed to availability disruption without requiring authentication. A public proof-of-concept exploit has been disclosed, though the vulnerability is not confirmed as actively exploited in CISA KEV.
Server-side request forgery in adafap's api-mcp Proxy API Endpoint exposes the server as an open proxy, allowing remote unauthenticated attackers to manipulate the `url` argument passed to the `customAxios` function in `app/api/proxy/route.ts` and force the server to issue arbitrary outbound HTTP requests. All commits up to 92b9a5d04acfec165c7d4ef852496593aa87be06 are affected; the project's rolling release model means no discrete patched version exists. The CVSS 4.0 E:P modifier confirms a proof-of-concept exploit exists, and the vendor has not responded to the coordinated disclosure filed via GitHub issue #4.
Unauthenticated information disclosure in MingSoft MCMS up to version 3.0.6 allows remote attackers to extract sensitive data via the /mdiy/form/get endpoint of the ms-mdiy component. The vulnerability requires no credentials or user interaction and is exploitable over the network, making it trivially accessible to any attacker with HTTP reach to the application. A public exploit has been released (CVSS 4.0 E:P), though the vulnerability is not currently listed in the CISA KEV catalog; the vendor did not respond to pre-disclosure notification, leaving no official patch available at time of analysis.
Information disclosure in MingSoft MCMS through version 3.0.6 exposes sensitive data via the `/mdiy/form/data/list` endpoint in the ms-mdiy component, exploitable by unauthenticated remote attackers with no configuration prerequisites. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial network reachability, and a public exploit has been released (E:P). The vendor did not respond to responsible disclosure, leaving no official patch available at time of analysis.
SQL injection in MingSoft MCMS up to version 3.0.6 exposes the application's database to unauthenticated remote attackers via the formFields argument in the ModelDataImpl.queryDiyFormData function at /mdiy/form/data/list.do. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication or special conditions are required, making the endpoint directly exploitable over the internet. A public exploit has been disclosed (E:P in CVSS 4.0 supplemental metrics), and the vendor failed to respond to responsible disclosure, leaving users without an official patch.
Missing authorization in Dolibarr ERP's TakePOS module through version 23.0.3 permits authenticated users with only basic cashier-level access to perform sensitive invoice operations - deleting line items, adjusting quantities, modifying prices, and applying discounts - that require the elevated `editlines` permission. The flaw exists because htdocs/takepos/invoice.php processes these actions without verifying the caller holds the `takepos.editlines` right, creating a privilege boundary bypass within the POS subsystem. An upstream patch commit (8992ce8704da947b6abe7b65a6fe59aed736bb81) is available; no CISA KEV listing and no public exploit code identified at time of analysis.
Improper access control in 3CORESec Trapdoor versions up to and including 1.2.2 allows remote low-privileged attackers to bypass authorization logic via the DefaultFunction handler, yielding limited but real confidentiality, integrity, and availability impacts on the vulnerable system. The 'Authentication Bypass' tag and CWE-284 classification together indicate that the DefaultFunction fails to enforce expected access restrictions, a particularly concerning pattern for a product category whose core purpose is access gating. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; the CVSS 4.0 score of 5.3 (Medium) reflects low-tier CIA impacts constrained to the vulnerable system itself with no lateral scope change.
SQL injection in lock-upme OPMS allows remote low-privileged attackers to manipulate the `ids` argument within the IN Clause Handler of controllers/messages/message.go, potentially enabling unauthorized read and write access to underlying database contents. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network exploitation with low complexity, requiring only a valid low-privileged session, yielding partial confidentiality, integrity, and availability impact. No vendor patch exists as the maintainer did not respond to the coordinated disclosure, and no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated file deletion in WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) exposes a public REST endpoint that performs no capability or nonce verification, permitting any remote actor to delete generated album export ZIP archives stored by the plugin. The CVSS 3.1 score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N reflecting zero authentication and trivial access requirements, though impact is scoped only to those regenerable archive files. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) confirms negligible current exploitation activity.
Improper IAM permission configuration in NXP GoldVIP's SitewiseCustomFunction Lambda Function Handler exposes AWS resources to remote attackers holding high-privilege credentials in the affected environment. The flaw, tracked as CWE-284, allows authorized high-privileged principals to exceed their intended access boundaries within the AWS deployment - a misconfigured IAM role rather than a missing authentication check. The vendor acknowledged this as a known historical issue resolved beginning with version 1.13.0 and fully addressed in 1.15.0; no public exploit code or active exploitation has been identified at time of analysis.
Improper privilege management in wongcyrus ExcelLexBot through version 0.0.3 allows remote high-privileged attackers to perform unauthorized actions via the ExcelLexBotS3TriggerFunction Lambda handler, resulting in limited confidentiality, integrity, and availability impact. The affected product is end-of-life and will receive no vendor patch, as the maintainer is no longer supporting it. No public exploit code or active exploitation has been identified at time of analysis, though the remote attack vector and absence of a patch increase residual risk for any remaining deployments.
Path traversal in PV-Bhat gemsuite-mcp 1.0.0 exposes arbitrary local files to any authenticated local user who can invoke the tool's Gemini handler functions. The flaw resides in src/handlers/unified-gemini.ts and affects the gemini_search, gemini_reason, gemini_process, and gemini_analyze handlers, all of which accept file_path or file_paths arguments without sufficient sanitization. No patch has been released and the project has not responded to the responsible disclosure; no public exploit or active exploitation has been identified at time of analysis.
Path traversal in Pimzino spec-workflow-mcp versions up to 2.2.6 allows a local low-privileged user to write approval files outside the intended .spec-workflow/approvals directory by supplying crafted values such as '../../../etc/cron.d/evil' as the categoryName argument to ApprovalStorage.createApproval(). The vulnerability is strictly local (AV:L, PR:L) and carries a CVSS 4.0 score of 4.8, indicating limited blast radius. No public exploit code and no CISA KEV listing exist at time of analysis; version 2.2.7, released 2026-05-04, fully remediated the issue.
Solace Extra WordPress plugin before version 1.6.1 exposes an unauthenticated-to-low-privilege write path via an unprotected AJAX action, enabling any subscriber-level user to overwrite post meta on arbitrary posts and deactivate the site's active templates. The dual vulnerability - missing capability check and missing nonce verification - means exploitation is achievable both directly by authenticated subscribers and indirectly via CSRF against any logged-in user, including administrators. No public exploit code or active exploitation has been identified at time of analysis; the vendor has released a corrected version (1.6.1).