SQL injection in Metabase's '/reset_password' database endpoint lets a remote, unauthenticated attacker inject arbitrary SQL and escalate to administrator on the connected Metabase instance. Rated CVSS 4.0 10.0 (CWE-89), it is network-exploitable with no authentication or user interaction, and full compromise of the application and its subsequent systems is achievable. No public exploit code is identified at time of analysis, but a vendor security advisory (GHSA-vwf4-m7j8-wcjf) and a CISA CSAF advisory (VA-26-222-01) both track the flaw, indicating coordinated, high-priority disclosure.
Unauthenticated remote code execution in the Product Input Fields for WooCommerce WordPress plugin before 2.0.2 arises because the plugin skips file-type validation whenever its accepted-types setting is left blank - a configuration the plugin's own documentation advertises as 'accept all files.' Attackers can upload arbitrary files, including PHP webshells, and execute them on servers whose upload directory does not enforce access restrictions. Publicly available exploit code exists (WPScan), though the EPSS score is low (0.20%, 10th percentile) and it is not listed in CISA KEV.
Password reset abuse in the Single Sign On For TNG WordPress plugin (versions before 2.2.0) allows unauthenticated attackers to reset the password of any account, including administrators, resulting in full site takeover. The flaw stems from improper validation of the password reset request, and publicly available exploit code exists, though EPSS scores the exploitation probability at a low 0.15% (4th percentile). It is not listed in CISA KEV, so exploitation is currently proof-of-concept rather than confirmed active in-the-wild use.
Unauthenticated account takeover in the FoodBoxBooker WordPress plugin (versions before 1.0.7) lets remote attackers reset the password of any user - administrators included - because the plugin fails to properly validate password-reset requests. Successful exploitation yields full administrative control and effective site takeover. Publicly available exploit code exists; the flaw is not listed in CISA KEV and EPSS is low (0.15%, 4th percentile), indicating no confirmed mass exploitation yet.
SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.6) lets remote attackers inject SQL through an unsanitized, unescaped parameter that is reachable without authentication, enabling blind extraction of database contents such as user credentials and secrets. Reported by WPScan, it carries a CVSS of 9.1 and has publicly available exploit code, though its EPSS probability is low (0.16%, 6th percentile) and it is not listed in CISA KEV. Exploitation status: publicly available exploit code exists.
Command injection in CyberPanel 2.4.3's remote backup transfer feature allows authenticated low-privileged users to execute arbitrary OS commands on the host by manipulating the API response of a remote backup server they control. The vulnerability exists in backupManager.py, where the backupDir value returned by the remote server is concatenated unsanitized into shell command strings, bypassing ACLManager middleware validation entirely. A publicly available proof-of-concept exploit exists per the researcher writeup at themcsam.github.io; the vendor has released a fix in commit eca0c3c.
Remote code execution in the Squeeze WordPress plugin (versions prior to 1.7.12) is achievable by any authenticated user holding the upload_files capability - granted by default to the Author role and above. The plugin's attachment-update action writes per-size image data to the uploads directory without validating file type or extension, permitting a PHP webshell to be placed in a web-accessible path and directly invoked via HTTP. A publicly available proof-of-concept exists per WPScan; no public exploit identified at time of analysis in CISA KEV, and EPSS is low at 0.19% (9th percentile), suggesting limited observed in-the-wild exploitation despite the public PoC.
Privilege escalation via REST API authentication bypass in the CheckView WordPress plugin before 2.3.2 allows an unauthenticated attacker to perform any REST action available to a logged-in administrator - including creating a new administrator account - by tricking an admin into opening a crafted link. The plugin's authentication filter is applied globally to all REST routes rather than only to CheckView's own endpoints, and it unconditionally discards authentication errors for any request whose URI merely contains a CheckView-specific string, bypassing WordPress's nonce enforcement entirely. A publicly available exploit from WPScan demonstrates this path; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanently inject arbitrary JavaScript into a site's checkout page by exploiting a missing capability check and nonce validation on a styling option endpoint. The injected payload executes in the browser of every visitor - including administrators - who loads the checkout page, enabling session hijacking, credential theft, or unauthorized admin actions. A publicly available exploit exists; EPSS is low at 0.17% (7th percentile), suggesting limited observed mass exploitation despite the public proof-of-concept.
Missing authorization controls in the File Manager WordPress plugin before version 6.9.1 allow any authenticated user - including low-privilege subscribers - to read and delete arbitrary files under the WordPress installation directory. The weakness exposes sensitive configuration secrets such as database credentials stored in wp-config.php, and enables deliberate denial of service through file deletion. A publicly available exploit exists per WPScan reporting, though EPSS remains very low (0.14%, 4th percentile), suggesting targeted rather than broadly automated exploitation at time of analysis.
Remote code execution in Cachet through version 2.4.1 allows authenticated low-privilege users to inject Blade directives or Twig-style filters into incident templates, which are interpreted and executed as arbitrary PHP by the server when incidents are rendered. Any account with permission to create or edit incident templates can run OS commands as the web server process, yielding full compromise of the hosting environment. A publicly available proof-of-concept has been confirmed by VulnCheck and the upstream GitHub issue; no active exploitation has been recorded in CISA KEV at time of analysis.
Unauthenticated file exfiltration in Flowise 2.2.4-3.1.4 is possible because the POST /api/v1/openai-assistants-file/download endpoint was incorrectly added to the application's global authentication whitelist, causing all session and API key verification to be skipped unconditionally. Any remote, unauthenticated attacker who can supply valid chatflowId, chatId, and fileName identifiers can retrieve private files from any chatflow on the instance, including those belonging to other workspaces or organizations in a multi-tenant deployment. A public proof-of-concept exploit is available via GitHub, and no KEV listing has been confirmed at time of analysis.
Authenticated remote code execution in CyberPanel 2.4.3 allows any logged-in user to escalate to persistent root-level SSH access by exploiting command injection in the remote backup destination feature. The backup module concatenates user-controlled parameters-IP address, SSH port, username, and password-directly into OS-level shell commands without sanitization, and the SSH key retrieval process fails to verify host authenticity, enabling a malicious server to supply a public key that CyberPanel writes to /root/.ssh/authorized_keys. A publicly available proof-of-concept demonstrates the complete exploit chain; the vendor has released a fix in upstream commit eca0c3c, though no tagged release version has been independently confirmed.
Unauthenticated SQL injection in the ProSolution WP Client WordPress plugin (all versions before 2.0.9) exposes arbitrary WordPress database contents to any remote attacker and permits deletion of plugin-managed records without any login or capability check. The plugin blindly embeds an unsanitized cookie value into SQL queries and executes this logic on every HTTP request site-wide, meaning any page load against a vulnerable site is a valid attack surface. A publicly available exploit exists via WPScan; no confirmed active exploitation in CISA KEV, and EPSS sits at 0.21% (11th percentile), suggesting opportunistic rather than widespread automated attack activity at time of analysis.
Unauthenticated content injection in Arvow AI SEO Writer WordPress plugin (before 1.5.4) allows remote attackers to create arbitrary posts and pages and extract author account and taxonomy information by exploiting a PHP type juggling flaw in a REST endpoint. The bypass is effective exclusively when the plugin has not been configured post-installation, making freshly deployed or abandoned instances the primary target. A public proof-of-concept is available via WPScan; despite this, EPSS sits at 0.15% (5th percentile) and no CISA KEV listing exists, indicating no public exploit has driven mass exploitation at time of analysis.
Authentication bypass in the AutoNetTV Relay WordPress plugin (all versions before 3.0.14) allows unauthenticated remote attackers to obtain a WordPress administrator session cookie by triggering the plugin's scheduled content-synchronization task under a specific server configuration. The plugin issues an admin authentication cookie during the sync task without performing any capability or authorization check, and on servers where the scheduled task completes before the HTTP response is committed, the cookie is returned to the triggering request. A public proof-of-concept exploit exists, reported by WPScan; no KEV listing has been identified at time of analysis.
Account takeover via broken password-reset rate limiting in the Login & Register Forms WordPress plugin (versions before 4.0.2) allows unauthenticated remote attackers to brute-force verification codes and seize any account, including administrator accounts. Both the verification code and the per-source attempt counter are keyed on client-controlled data, meaning an attacker can reset the rate limit at will by manipulating that value - rendering the lockout mechanism entirely ineffective. Exploitation requires the 'verification-code reset mode' to be enabled; a publicly available proof-of-concept from WPScan demonstrates the technique, though EPSS sits at only 0.15% (4th percentile), indicating limited observed exploitation activity to date.
Account takeover in the Login & Register Forms WordPress plugin (before 4.0.2) is enabled by a fundamentally broken password reset verification design: the plugin keys the 'verification completed' state to a client-controlled value rather than binding it server-side to the account under reset or to the authenticated session of the party completing verification. An unauthenticated attacker who can observe or manipulate this state during or after a legitimate reset flow can claim ownership of that completed verification and set a new password for any targeted account, including administrator accounts. A publicly available exploit has been published by WPScan, and no public exploit identified at time of analysis translates to KEV, though POC availability materially lowers the exploitation threshold.
Account takeover in the BricksForge WordPress plugin (versions before 3.1.8.8) is enabled by a missing server-side identity check during password change form submissions, allowing unauthenticated remote attackers to set arbitrary passwords for any WordPress user, including site administrators. The vulnerable state is effectively the default configuration for any site that has deployed BricksForge's password update form action, since current-password verification is disabled by default in that action. A publicly available exploit exists; active exploitation has not been confirmed by CISA KEV, but the direct path to admin-level account takeover makes this a critical remediation priority for affected deployments.
Unauthenticated access to saved form draft data in the HT Contact Form WordPress plugin (versions before 2.9.3) exposes personally identifiable information - including names, email addresses, phone numbers, and physical addresses - to any remote attacker without credentials. The plugin's draft-retrieval endpoint performs no authorization check, meaning any unauthenticated HTTP request can enumerate or retrieve stored draft submissions. A publicly available exploit exists, though EPSS remains low at 0.16%, suggesting limited widespread automated scanning to date but real feasibility for targeted data harvesting against sites using this plugin.
Unauthenticated email enumeration in the Login & Register Forms WordPress plugin (versions 3.0.0 through 4.0.1) exposes all registered user email addresses, including administrator accounts, via a flawed password reset mechanism. The plugin neither verifies that a reset request originates from the account owner nor adequately redacts email addresses in its HTTP response, allowing any unauthenticated attacker to harvest a site's full user roster through repeated requests. A publicly available proof-of-concept exploit exists, though EPSS remains low at 0.16%, indicating limited observed exploitation at time of analysis despite the trivial attack complexity.
Unauthenticated information disclosure in the File Manager WordPress plugin before 6.9.1 exposes a REST API route without any authorization controls, allowing any remote user to retrieve the plugin's complete file activity log. The leaked log reveals filesystem paths within the WordPress installation and the usernames of administrators who performed file operations, providing reconnaissance data useful for chaining further attacks. A publicly available proof-of-concept exploit exists per WPScan's disclosure, though EPSS at 0.16% (5th percentile) indicates limited observed exploitation activity; the vulnerability is not listed in CISA KEV.
Missing capability checks in the File Manager WordPress plugin before version 6.9.1 expose the entire WordPress installation directory to any authenticated user, including low-privilege subscribers. Exploitation allows traversal of server-side directories and download of sensitive file types such as archives and documents, which frequently contain database credentials, configuration backups, and private documents. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting opportunistic rather than widespread automated exploitation at this time; no CISA KEV listing is present.
Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) exposes other customers' personal information via sequential identifier enumeration. The booking-wizard confirmation flow loads booking records using a numeric booking ID without properly verifying that the requestor holds the associated ownership token, enabling any unauthenticated remote attacker to iterate through IDs and retrieve arbitrary bookings. A publicly available exploit exists per WPScan, and the vulnerability is trivially automatable, making mass customer PII harvesting a realistic outcome.
File enumeration and unauthorized download is possible in the Contact Form to Any API WordPress plugin (all versions before 3.0.7) because uploaded contact form attachments are stored in a publicly accessible directory using predictable, non-random filenames. Unauthenticated remote attackers can discover the upload path by submitting a form themselves, then systematically enumerate filenames to retrieve files - potentially containing PII, identity documents, or sensitive business attachments - submitted by other users. A publicly available proof-of-concept exists, and a vendor patch (3.0.7) has been released.
Path traversal in the unearth Python package discovery library through version 0.18.2 allows an attacker who controls or compromises a package source to write arbitrary files to any filesystem location accessible to the extracting process. The flaw resides in the is_within_directory function, which performs only a lexical path containment check without resolving symlinks or normalizing ../ sequences via os.path.realpath(), meaning maliciously crafted tar archive members silently bypass the extraction guard. A publicly available proof-of-concept exists at GitHub issue #180; the upstream fix was merged in commit 6c78164, but no confirmed active exploitation per CISA KEV has been reported.
Local file inclusion in the Eventin WordPress plugin (all versions before 4.1.20) allows authenticated users holding editor-level or higher WordPress roles to supply an arbitrary local filesystem path as a template setting, causing the plugin to include and execute any reachable PHP file on the server. Full confidentiality, integrity, and availability impact is achievable on a successful exploitation. A publicly available proof-of-concept from WPScan exists, though the CVE carries no CISA KEV listing and an EPSS of only 0.16%, indicating no confirmed widespread active exploitation campaigns at time of analysis.
Privilege escalation in the Vitepos WordPress point-of-sale plugin allows any user holding the custom Outlet Manager role to reset the password of any WordPress account - including site administrators - and achieve full account takeover. The flaw stems from a missing per-target authorization check in the password-reset API endpoint, combined with the plugin granting the Outlet Manager role overly broad reset capabilities by default. A publicly available proof-of-concept exists per WPScan, though EPSS remains low (0.13%, 3rd percentile), suggesting exploitation has not yet been observed at scale.
Symlink escape in tar-rs versions 0.4.11 through 0.4.46 exposes arbitrary host filesystem files when a privileged process archives an attacker-controlled directory using the Builder::append_dir_all() function. The function resolves symbolic links during recursive directory traversal without verifying that resolved target paths remain within the specified source root, causing out-of-bounds files to be silently captured into the archive as regular file entries and disclosed to the attacker. A publicly available proof-of-concept exists; the CVE is not listed in CISA KEV, but low attack complexity combined with high confidentiality impact makes this a meaningful risk for affected Rust-based archiving pipelines.
Arbitrary file read in CyberPanel 2.4.3's file manager allows authenticated panel users to escape their home-directory sandbox by uploading a crafted ZIP archive containing symbolic links that target arbitrary filesystem paths. The application extracts ZIP contents without validating whether entries are symlinks, causing those links to persist on disk and remain accessible through the web interface, enabling retrieval of sensitive files such as /etc/shadow or SSH private keys. A publicly available exploit exists and a vendor patch is available at commit eca0c3c; no CISA KEV listing has been identified, but the low authentication barrier makes this a credible privilege escalation vector on any multi-tenant CyberPanel instance.
Cross-channel message deletion in Spacebar Server (all commits before 8d126f4) permits authenticated users holding MANAGE_MESSAGES permission in any channel to delete messages residing in channels they do not control. Both the single-delete and bulk-delete API handlers failed to scope their database queries to the channel_id present in the request path, allowing attacker-supplied message IDs from foreign channels to be processed and destroyed. A publicly available exploit exists, with the root cause and fix confirmed by the upstream security advisory GHSA-62g6-28hv-h6hc; no CISA KEV listing has been issued at time of analysis.
Path traversal in the Sucuri Security WordPress plugin through version 2.7.3 allows authenticated administrators to delete arbitrary files outside the WordPress installation directory. The pageIntegritySubmission() method in src/integrity.lib.php concatenates the unsanitized sucuriscan_integrity parameter directly with ABSPATH before passing it to PHP's unlink(), enabling traversal sequences to reach sensitive files such as wp-config.php and .htaccess. A publicly available exploit exists (reported by VulnCheck); no CISA KEV listing has been confirmed, but file deletion of wp-config.php can cause immediate site outage and enable full WordPress reinstallation by a follow-on attacker.
Local privilege escalation in Kingston FURY CTRL RGB Control Software 2.0.65.0 allows a low-privileged local user to gain full system-level access through the NTIOLib_KSFX.sys kernel driver component. The driver's privilege management is improperly implemented (CWE-269), enabling manipulation that elevates attacker control without requiring user interaction or elevated starting privileges. A public proof-of-concept exploit has been released via Google Drive, and the vendor did not respond to disclosure - meaning no patch exists and the exploit is freely usable against unmitigated systems.
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may inject forged, arbitrarily backdated event entries into organizations they have no membership in by sending crafted POST /collect API requests. All self-hosted Bitwarden Server instances prior to version 2026.7.2 are affected. A publicly available proof-of-concept exploit exists per researcher Sanjok Karki's blog post; no active exploitation has been confirmed in CISA KEV, but the low exploitation barrier and available PoC make patching urgent for compliance-sensitive deployments.
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafted sharded checkpoint: sensitive file disclosure via relative (../) or absolute path entries in the weight_map index, and indefinite process blocking via named pipe references enabling denial of service. A publicly available proof-of-concept exists at GitHub issue #4067, reported by VulnCheck. With no system-level privileges required (PR:N per CVSS 4.0), this is a supply chain risk for any ML practitioner who loads untrusted model checkpoints - particularly from public model registries - without needing any foothold on the target system beyond delivering the malicious checkpoint.
Stored cross-site scripting in the s2Member WordPress plugin (all versions before 260805) allows contributors to inject arbitrary JavaScript into post content via unescaped shortcode attributes rendered inside an inline script block. Any site visitor who opens the affected post will execute the attacker's script in their browser. A publicly available proof-of-concept exploit exists, reported by WPScan, though EPSS sits at the 5th percentile suggesting opportunistic rather than widespread active exploitation at time of analysis.
Duplicate Post WordPress plugin before version 1.5.5 contains an IDOR flaw (CWE-639) in its bulk copy and delete operations that enables authenticated users with plugin-level access to permanently delete arbitrary posts across the entire site, including content owned by other users. The missing per-object authorization check means that any WordPress user role an administrator has configured to use the plugin can bypass ownership boundaries and destroy content they did not create. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.13% (3rd percentile) and absence from CISA KEV indicate no confirmed widespread exploitation at time of analysis.
Remote code execution in the Fabrik application-builder extension for Joomla (versions before 4.6.7) allows unauthenticated attackers to execute arbitrary code by abusing the ajax_calc endpoint of the bundled calc form plugin. The calc plugin evaluates user-influenced expressions server-side, and the AJAX handler exposes that evaluation without authentication, giving remote attackers full control of the underlying PHP process. CVSS 4.0 rates this 10.0 (maximum); no public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remote attackers to upload SVG files containing arbitrary JavaScript, which then executes persistently in the browser of any user who views the file. The plugin neither sanitizes SVG content on upload nor restricts the upload endpoint to authenticated users, making the attack fully unauthenticated. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains targeted rather than widespread at this time.
SQL injection in Metabase lets an unauthenticated remote attacker execute arbitrary SQL against the connected database by abusing a field-filter (dimension) parameter exposed through a publicly shared card or dashboard. Because public sharing requires no login, any internet-reachable Metabase instance with a shared object that surfaces a field-filter parameter is exploitable with a single crafted request. No public exploit has been identified at time of analysis, but the maximal CVSS 4.0 score of 10.0 (AV:N/AC:L/PR:N/UI:N, full C/I/A on both the target and subsequent systems) reflects direct, unauthenticated database compromise.
Cron/OS command injection in alseambusher's crontab-ui (through 0.4.2) lets a remote attacker who can reach the web interface inject arbitrary cron entries via a crafted GET request to /crontab, where the env_vars parameter is written into the crontab file without stripping newlines. Because scheduled cron jobs execute shell commands, successful injection yields arbitrary command execution as the account running the cron daemon/crontab-ui service. CVSS is rated 9.8 (network, low complexity, no privileges per the supplied vector); no public exploit and no CISA KEV entry are indicated at time of analysis, though the technique is simple to reproduce.
OS command injection in the Zyxel WAH7601 4G/LTE CPE router lets an attacker inject arbitrary operating-system commands through improperly neutralized input, affecting all firmware builds up to and including version 20072026. Successful exploitation yields full command execution on the device with high confidentiality, integrity, and availability impact, per the TR-CERT-assigned CVSS 9.8 rating. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis, so risk is currently theoretical-but-severe rather than confirmed active exploitation.
OS command injection in alseambusher/crontab-ui through 0.4.2 lets a remote, unauthenticated attacker POST a crafted crontab database to the /import endpoint, which silently overwrites the application's job database; a malicious 'hook' value is then concatenated into a shell command by makeCommand() and runs on the next cron cycle. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects trivial, pre-authentication reachability with full confidentiality, integrity, and availability impact on the host. Any internet- or LAN-exposed crontab-ui instance without an external access-control layer should be treated as high priority.
Unauthenticated remote code execution affects Feast (the open-source ML feature store), where user-defined functions stored in the registry are serialized with Python's 'dill' library and deserialized without validation. In default configurations a remote attacker can store a malicious UDF and achieve unauthenticated code execution on the feature server; an authenticated attacker can bypass authorization during deserialization to run code on the registry server, enabling cross-tenant data access and lateral movement. Rated CVSS 9.9 with a scope change; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Feast is bundled in Red Hat OpenShift AI (RHOAI), which is the reporting vendor's affected product.
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated low-privilege member run arbitrary OS commands on the control-plane host. The volumeName field in the volumeBackup.create and volumeBackup.runManually tRPC endpoints is interpolated unquoted into a shell string passed to child_process.exec; because the process holds Docker socket access, injected commands run with host/root-equivalent privileges. No public exploit is identified at time of analysis, but the fix is a one-character-class change and the vulnerable code path is well documented in the published PR and advisory.
Command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated panel user run arbitrary commands on managed remote servers by embedding a single quote in Traefik configuration fields. The flaw sits in writeTraefikConfigRemote, which interpolates yaml.stringify output into an unsanitized 'echo '...' > file' shell command run over SSH via execAsyncRemote. It is a scope-changing (CVSS 9.9) issue and, notably, an incomplete fix for the earlier CVE-2026-45630; no public exploit is identified at time of analysis, though the fixing commit and advisory are public.
Command injection in Dokploy (self-hostable PaaS) before 0.29.13 lets an authenticated user run arbitrary OS commands on the Dokploy host or any SSH-connected target server. The registry.testRegistry and registry.testRegistryById tRPC endpoints interpolate the attacker-supplied registry password directly into a shell command (echo <password> | docker ...) via execAsyncRemote instead of the safe safeDockerLoginCommand helper. Rated CVSS 9.9; no public exploit identified at time of analysis, though the fix commit publicly reveals the vulnerable code path.
OS command injection in Dokploy self-hosted PaaS before 0.29.13 lets an authenticated member with service-deployment permission and an attached SSH key run arbitrary commands on the Dokploy host. The flaw lives in the custom-Git deployment path, where the host portion of a user-supplied customGitUrl is interpolated unquoted into an ssh-keyscan shell command that executes during deployment. No public exploit is identified at time of analysis, but the fix commit is public and the trigger is trivial for anyone with deploy rights.
Command injection in Dokploy self-hostable PaaS before 0.29.13 lets an authenticated user with backup:read permission run arbitrary OS commands on the Dokploy host. The backup.listBackupFiles tRPC endpoint routes an attacker-controlled search parameter through normalizeS3Path and interpolates it unescaped into an rclone lsjson string executed via child_process.exec(). No public exploit identified at time of analysis, but the root cause and fix are confirmed in the vendor commit and the CVSS 9.9 rating reflects full host compromise from a low-privilege application role.
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged user achieve arbitrary host command execution by storing a malicious Git branch value and triggering a deployment. The branch fields (customGitBranch, branch, gitlabBranch, bitbucketBranch, giteaBranch) were left without server-side validation because the earlier fix for CVE-2026-45628 was incomplete, so attacker-controlled input flows unescaped into shell-based git clone commands. No public exploit has been identified at time of analysis, but the flaw carries a CVSS of 9.9 and is fixed in 0.29.13.