Authentication bypass in the Salon Booking System WordPress plugin (versions 10.30.26 and earlier) allows remote unauthenticated attackers to defeat the plugin's identity/verification logic (CWE-288) and gain access to protected functionality or data without valid credentials. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, low-complexity exploitation with high confidentiality, integrity, and availability impact; Patchstack tags it as Information Disclosure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in the miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin (versions 7.0.0 and earlier) lets an unauthenticated remote attacker defeat the OAuth login flow and authenticate as an arbitrary user, including administrators. The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and the issue is rooted in improper verification of the identity asserted during single sign-on (CWE-290). At the time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the combination of unauthenticated access and full account takeover makes it a high-priority patching target.
Authentication bypass in IBM i (OS/400) versions 7.3, 7.4, 7.5, and 7.6 allows a remote unauthenticated attacker to access server resources with the privileges of an authenticated user by exploiting improper authentication handling during NTLM session negotiation. The CVSS 3.1 base score is 9.8 (network vector, no privileges, no user interaction, total confidentiality/integrity/availability impact), though the EPSS exploitation probability is low (0.40%, 33rd percentile) and CISA's SSVC framework records exploitation status as 'none'. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated PHP object injection in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling property-oriented programming (POP) gadget chains that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 rating with a fully remote, no-authentication, no-interaction vector and was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SSO plugins sit on the authentication path, a successful exploit can compromise the entire WordPress site.
Remote code execution in IBM i (formerly OS/400) releases 7.3 through 7.6 stems from a buffer overflow (out-of-bounds write) that a remote, unauthenticated attacker can trigger to run arbitrary code on the host. IBM has published a fix, and while the CVSS base score is 9.8, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.37% (30th percentile). CISA's SSVC framing rates exploitation as none and the vulnerability as not automatable, tempering the raw-score urgency.
Authentication bypass in IBM i (the operating system for IBM Power/AS-400 midrange systems) versions 7.3, 7.4, 7.5, and 7.6 allows remote attackers to circumvent security restrictions because the system improperly validates a client-asserted identity (CWE-287). Because a caller's claimed identity is trusted without adequate verification, an attacker can impersonate another principal and gain unauthorized access to protected resources with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.34%, 27th percentile), but the CVSS 9.8 rating and network-reachable, unauthenticated vector make this a high-priority patch.
Broken access control in the Nokri WordPress job board theme (versions 1.6.6 and earlier by ScriptsBundle) lets remote unauthenticated attackers bypass authorization controls to access or manipulate resources that should be restricted, with the CWE-640 mapping indicating a weakness in the account/password recovery mechanism. Rated CVSS 9.8 with a full network/no-privilege/no-interaction vector implying full confidentiality, integrity, and availability impact, this issue is reported by Patchstack and tagged as information disclosure. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Privilege escalation in the WooCommerce-focused "SMS Alert Order Notifications" WordPress plugin (versions 3.9.7 and earlier) lets an unauthenticated remote attacker gain elevated privileges on the site. The flaw stems from incorrect privilege handling (CWE-266) and, per its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), is remotely reachable without authentication or user interaction, yielding full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a serious, near-full-compromise risk.
Privilege escalation in the miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) allows unauthenticated remote attackers to elevate their privileges, per a Patchstack advisory. The flaw is rooted in a weak account/OTP verification mechanism (CWE-640) that can be abused without any credentials, and carries a CVSS 9.8 rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the unauthenticated network vector makes this a high-priority patching candidate.
SQL injection in IBM i 7.6, 7.5, and 7.4 lets a remote attacker submit specially crafted SQL statements that read, insert, alter, or delete data in the back-end database. The flaw is vendor-reported by IBM and carries a 9.8 CVSS with a network, unauthenticated vector, though no public exploit identified at time of analysis and EPSS exploitation probability is low (0.27%, 19th percentile).
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 stems from improper neutralization of output written to logs (CWE-117), which a remote attacker can leverage to run arbitrary code with total impact to confidentiality, integrity, and availability. IBM has published a fix, and the vendor CVSS of 9.8 reflects an unauthenticated network-reachable vector; however, EPSS is low (0.27%, 19th percentile) and there is no public exploit identified at time of analysis, so exposure appears theoretical rather than active. Note a signal conflict: the root-cause weakness is log injection, yet the stated impact is code execution - the intermediate mechanism is not documented in the available data.
Authentication bypass in LemonLDAP::NG (CWE-305) allows remote unauthenticated attackers to defeat a primary authentication control and access protected resources, tagged by the reporter as leading to information disclosure. All maintained branches are affected, with fixes shipped in 2.23.3, 2.21.5, and 2.16.9; the issue was disclosed via oss-security and packaged by Ubuntu. There is no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile) despite the 9.8 CVSS.
Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in the rtCamp "Log in with Google" WordPress plugin (versions <= 1.4.2) lets unauthenticated remote attackers assume the identity of legitimate users because the plugin insufficiently verifies the authenticity of the Google OAuth login response. Rated CVSS 9.8, the flaw permits full account takeover without credentials or user interaction; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Patchstack advisory confirms the vulnerability class.
Account takeover in the Customer Email Verification for WooCommerce WordPress plugin (versions 2.4.0 through 3.2.5) lets unauthenticated attackers hijack any registered user who has not yet confirmed their email. The plugin validates the email-activation code with a loose (type-juggling) comparison, so a crafted value type satisfies the check without knowing the real code, marking the target account as verified under attacker control. Rated CVSS 9.8 with a patch available in 3.2.6; no public exploit is identified at time of analysis and EPSS is low (0.15%).
Remote code execution in WebErpMesv2 (SMEWebify) versions 1.19 and prior lets a self-registered user upload an arbitrary PHP file through the HR Expense 'scan_file' parameter, which the vulnerable HumanResourcesController wrote directly into the web-served public/file/Expense directory with no extension or MIME validation. Because registration is open (no invite) and the CheckUserRole middleware silently swallows RouteNotFoundException, the privilege barrier collapses into effectively unauthenticated RCE against a default install. There is no public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-chhq-7p67-2ff9) and fixing commit confirm the flaw and its exploitability.
Template-literal code injection in TypeORM's migration:generate command allows an attacker with database schema write access to achieve arbitrary JavaScript execution on any host that loads the generated migration file. Affected are TypeORM npm versions prior to 0.3.31 (0.x branch) and versions 1.0.0 through 1.0.x (fixed in 1.1.0), spanning PostgreSQL, MySQL, MariaDB, and CockroachDB drivers. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; however, the GHSA advisory provides sufficient technical detail to reproduce the attack.
Improper authentication in IBM i (IBM's integrated midrange operating system, formerly OS/400) versions 7.3, 7.4, 7.5 and 7.6 allows a remote attacker to bypass authentication controls to execute arbitrary code or read sensitive data, provided a legitimate user is induced to interact (UI:R). IBM has published a fix (support node 7283292) and rates it 9.6 critical; there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS score of 0.41% (34th percentile) indicating no observed mass exploitation yet.
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes tenant abuse the AppRole authentication's SecretIDPath configuration to read files from the operator pod's filesystem and exfiltrate their contents to an attacker-controlled endpoint, enabling privilege escalation across the cluster. Because the operator pod typically holds credentials and tokens spanning multiple tenants, a single limited-RBAC tenant can cross trust boundaries (CVSS scope change), yielding a 9.6 rating. No public exploit identified at time of analysis, but the low attack complexity and multi-tenant blast radius make this a high-priority patch.
Prototype pollution in Quasar Framework's public extend() utility (npm package quasar, versions <= 2.21.4) allows attacker-controlled properties to be written to Object.prototype when applications pass user-controlled objects into deep merge calls. The flaw exists because extend(true, target, source) recursively copies source keys including __proto__ without rejection, enabling descent into the prototype chain. A working proof-of-concept is publicly documented in the GitHub security advisory (GHSA-3r53-75j5-3g7j); no public exploit identified at time of analysis as a weaponized payload. Downstream impact ranges from logic bypass and unsafe option injection to denial of service, depending entirely on how polluted properties are later consumed by the application.
Authorization bypass in Open Identity Platform OpenDJ before 5.1.2 lets any authenticated account holding the proxied-auth privilege impersonate arbitrary non-root directory users during a SASL PLAIN bind. The PlainSASLMechanismHandler validated only the PROXIED_AUTH privilege but skipped the mayProxy ACI scope check, so the proxy ACIs meant to constrain which identities may be assumed were not enforced (CVSS 9.6). No public exploit has been identified at time of analysis, but the flaw is confirmed by the vendor GHSA advisory and fixed in 5.1.2.
SQL injection in SourceCodester Simple Student Information System exposes the admin department view endpoint to remote unauthenticated database manipulation via an unsanitized ID parameter in app/admin/departments/view_department.php. A public proof-of-concept is available through a GitHub issue, confirmed by VulDB (EUVD-2026-58068), lowering the barrier for opportunistic exploitation. The CVSS 4.0 score of 6.9 with E:P reflects partial confidentiality, integrity, and availability impact - no authentication or special configuration is required based on the provided vector.
Path traversal in Vitest Browser Mode (@vitest/browser) lets any client reachable via the Browser Mode API read, create, overwrite, or delete arbitrary files on the host running the test process, bypassing the allowWrite permission gate entirely. Affected are Vitest before 3.2.7, 4.x before 4.1.10, and the 5.0.0-beta line before 5.0.0-beta.6, where provider commands (upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, annotateTraces) accept browser-supplied paths without confining them to the project root. There is no public exploit identified at time of analysis and it is not in CISA KEV; the highest-impact primitive is the upload command's arbitrary file read.
Authentication bypass in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows remote attackers to circumvent authentication controls when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled, exposing protected real-time communication functions. The CVSS 3.1 base score is 9.4 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:L), reflecting high confidentiality and integrity impact reachable over the network without credentials. A vendor patch is available; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
SQL injection in the FreePBX missedcall module (versions 16.0.0 through 16.0.10 and 17.0.0 through 17.0.3) lets an unauthenticated caller inject SQL via a crafted SIP From-header Caller ID name that is written unescaped into the missedcalllog INSERT in agi-bin/missedcallnotify.php. When a monitored extension goes unanswered, the injected payload executes against the FreePBX database, enabling corruption of records and modification of administrator accounts to gain unauthorized remote admin access. Rated CVSS 4.0 9.3; no public exploit identified at time of analysis, though the fixing commits are public and clearly reveal the vulnerable code path.
Arbitrary file write in Budibase before 3.40.0 allows authenticated users holding the builder role to plant files with path-traversal sequences that survive the workspace export process, letting them write attacker-controlled content to any location writable by the Budibase server process. The flaw stems from unsanitized S3 object keys whose `..` segments escape the temporary export directory, and successful abuse can pivot to remote code execution or configuration tampering. This is a CVSS 4.0 9.4 issue with no public exploit identified at time of analysis and no CISA KEV listing.
Privilege escalation to root in luci-app-lxc, the LXC container management app for OpenWrt's LuCI web interface, allows low-privileged authenticated users to reach backend container-management routes they should not be authorized for due to an ACL inconsistency, then abuse a path-traversal flaw in the lxc_name parameter to hijack host-side container hooks. Chaining the authorization gap with the traversal yields arbitrary code execution as root on the OpenWrt host. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.4 and full host compromise make this critical.
Arbitrary file write in OpenWrt's luci-app-openvpn (the LuCI web-interface plugin for managing OpenVPN) lets an authenticated web user smuggle a path-traversal sequence through the instance_name2 upload parameter to write files anywhere on the device filesystem. Because OpenWrt processes run as root, an attacker can drop an SSH key into a system directory and obtain persistent root code execution across reboots. No public exploit has been identified at time of analysis, but the CVSS 4.0 base score of 9.4 and root-level impact make this a high-priority patch for exposed OpenWrt routers.
Unauthenticated remote code execution in AgenticSeek (commit fc242c7) lets any network-adjacent attacker run arbitrary OS commands by POSTing crafted queries to the /query API endpoint, which the autonomous agent turns into shell commands executed via BashInterpreter (subprocess.Popen with shell=True and safety=False). The endpoint listens on 0.0.0.0:7777 with wildcard CORS and no authentication, so a single crafted HTTP request yields full host-level command execution, and an incomplete command blocklist fails to contain it. Rated CVSS 4.0 9.3 (critical); no public exploit identified at time of analysis and not listed in CISA KEV, but exploitation is trivial once the port is reachable.
Broken authorization in the Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin (versions before 7.0.9) allows any authenticated WordPress user - including the lowest-privilege subscriber role - to disconnect the site's Ecwid store and take the entire storefront offline. The affected store-management action performs neither a capability check nor a nonce verification, meaning the only barrier to exploitation is a valid WordPress session. A public exploit exists per WPScan reporting, and the fix is confirmed available in version 7.0.9.
Unauthenticated remote root compromise affects CyberPanel before 3.0.0 through a hard-coded JWT signing secret in the WebTerminal FastAPI SSH service. Because the secret is baked into the code, an attacker can mint a valid token specifying ssh_user=root and connect to the WebSocket terminal on TCP 8888 with no credentials, receiving a fully interactive root shell. No public exploit identified at time of analysis, but the trivial exploitation path (known secret, single forged token) makes reliable weaponization straightforward for any actor who reads the source.
Authentication bypass in the Portal Generator Addon (developed by Soft Solutions) for Priority ERP allows remote, unauthenticated attackers to invoke a critical function that should be gated behind authentication, exposing sensitive ERP data. Rated CVSS 9.3 with a scope change, the flaw stems from a missing authentication check (CWE-306) on a network-reachable function. It was reported by Israel's National Cyber Directorate (INCD); no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Privilege escalation in File Browser (filebrowser) through version 2.63.16 lets unauthenticated attackers self-register accounts that inherit the server's root scope with full create, modify, delete, rename, share, and download permissions, granting complete access to every file the server can reach. The flaw only manifests when the optional self-signup feature is enabled together with the default CreateUserDir behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 reflects trivial, unauthenticated exploitation once signup is exposed.
SQL injection in the If-So Dynamic Content Personalization WordPress plugin (versions <= 1.10) lets low-privilege users inject arbitrary SQL through an unsanitized input parameter, exposing the entire WordPress database including user credentials and secrets. The flaw was reported by Patchstack and carries a critical CVSS of 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Patchstack's 'Subscriber' classification indicates a low-privilege authenticated account is the intended prerequisite, which conflicts with the published CVSS PR:N metric.
SQL injection in the WPJAM Basic WordPress plugin (versions 7.0.1 and earlier, vendor denishua) lets attackers inject arbitrary SQL through an application entry point, exposing database contents. The Patchstack advisory classifies it as a 'Subscriber' SQL injection, implying low-privilege authenticated access, though the supplied CVSS vector marks it PR:N; either way the scope-changed impact (S:C) means the injected query reaches data beyond the plugin's own boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Command injection in the ATE (Automatic Test Equipment) module across ten Tenda camera and hub models allows a remote unauthenticated attacker to execute arbitrary OS commands on affected devices. The vulnerable function CAte::HandleCmd in the Kylin binary fails to sanitize user-supplied input before passing it to a system command interpreter (CWE-77), granting full device compromise. A proof-of-concept exists on GitHub (E:P in the CVSS 4.0 supplemental metrics) and no KEV listing is present at time of analysis, though the unauthenticated network vector and PoC availability elevate near-term exploitation risk.
Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solutions) allows remote, unauthenticated attackers to access the portal and read sensitive information belonging to other users or the underlying ERP. Reported by the Israel National Cyber Directorate (INCD) and rated CVSS 9.3, the flaw combines embedded static credentials (CWE-798), sensitive-information exposure (CWE-200), and improper access control (CWE-284). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Uncontrolled resource consumption in vLLM's lm-format-enforcer structured output backend (all versions prior to 0.26.0) enables unauthenticated remote denial of service via the /v1/completions API endpoint. By submitting a crafted catastrophically backtracking regular expression to the structured_outputs.regex parameter, a remote attacker can saturate an entire CPU core and stall the structured-output engine path indefinitely - blocking inference requests that rely on the lm-format-enforcer backend for all concurrent users. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the attack primitive (ReDoS against an exposed API) is well-understood and trivially constructible by any attacker familiar with catastrophic regex patterns.
Command injection in FreePBX UCP Node server before 17.0.9 allows unauthenticated remote attackers to run arbitrary OS commands as the asterisk service user. The Socket.IO 4 middleware (io.use(checkAuth)) only guards the default namespace, so a client can reach unprotected custom namespaces and inject carriage-return/newline characters into Asterisk Manager Interface actions to execute commands. This is an authentication-bypass-plus-CRLF-injection chain; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated SQL injection in the Church Admin WordPress plugin (all versions through 5.1.1) lets remote attackers inject SQL through an unauthenticated request, exposing the WordPress database without any login. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, no-privilege network exploitation, and the CWE-89 root cause plus scope-change flag point to database compromise reaching beyond the plugin itself. No public exploit identified at time of analysis, but the low complexity and zero-authentication profile make it a strong candidate for opportunistic scanning.
SQL injection in the Everest Backup WordPress plugin (versions up to and including 2.3.12) lets remote attackers inject arbitrary SQL through an unauthenticated request, per a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N and a base score of 9.3. Reported by Patchstack, the flaw primarily exposes backend database contents (C:H) and can affect availability (A:L); no public exploit or active-exploitation evidence is identified at time of analysis. Because it requires no authentication and low complexity, any exposed site running an affected version is reachable directly over the network.
Unauthenticated SQL injection in the RealPress WordPress plugin (by ThimPress) affects all versions up to and including 1.1.2, letting remote attackers with no credentials inject crafted SQL through an exposed parameter and read arbitrary data from the site's database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The primary consequence is disclosure of sensitive database contents such as user records and credential hashes.
SQL injection in the realmag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and including 1.1.1) lets remote attackers inject arbitrary SQL against the site database without authentication. Reported by Patchstack and rated CVSS 9.3 (CWE-89), the flaw exposes back-end WooCommerce/WordPress data to disclosure. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthenticated SQL injection in the Listdom WordPress plugin (Webilia) through version 5.6.0 lets remote attackers inject arbitrary SQL into backend database queries without any authentication or user interaction. Reported by Patchstack and rated CVSS 9.3, it primarily threatens the confidentiality of the WordPress database (user credentials, session data, private listings). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated SQL injection in the Web Directory Free WordPress plugin (by shamalli) through version 1.7.13 lets remote attackers inject arbitrary SQL into backend queries without any credentials or user interaction. Any unauthenticated visitor can reach the vulnerable parameter and read sensitive database contents, including WordPress user records and password hashes. No public exploit has been identified at time of analysis, but the flaw is trivially reachable (CVSS 9.3) and typical of Patchstack-reported plugin SQLi that is quickly reverse-engineered from the patch diff.
SQL injection in the WP Directory Kit WordPress plugin (versions 1.5.4 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through unsanitized input, per a Patchstack disclosure carrying a 9.3 CVSS. Because no login is required (PR:N) and the CVSS marks a scope change with high confidentiality impact, an attacker can read sensitive database contents such as user credentials and WordPress secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Cross-user inference data leakage in vLLM prior to 0.27.0 exposes one batched user's prompt or completion output to another user sharing the same GPU inference batch. The root cause is a 32-bit integer overflow in the CUDA kernel `act_and_mul_kernel` within `activation_kernels.cu`, where the pointer arithmetic `blockIdx.x * 2 * d` wraps around when token indices and hidden-dimension sizes are large enough, redirecting the kernel to read from an adjacent user's input buffer. No active exploitation has been confirmed (no CISA KEV listing), but the vendor has patched the issue in v0.27.0 and a detailed GitHub advisory and PR diff are publicly available.
Information disclosure in vLLM prior to version 0.26.0 leaks server filesystem internals - including OS usernames, home and virtual-environment directory paths, Python version, internal package structure, line numbers, and endpoint handler names - through HTTP error responses. Any unauthenticated network attacker can trigger this by sending malformed JSON to the OpenAI-compatible API endpoints, requiring zero privileges and no special configuration beyond a default vLLM deployment. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; however, the trivial exploitation bar (a single malformed HTTP request) and the reconnaissance value of the leaked data elevate real-world risk above the CVSS 5.3 score alone implies.
Unauthenticated build triggering in OpenChoreo before v1.0.3, v1.1.3, and v1.2.0-rc.2 allows any remote attacker to fire CI/CD pipeline jobs without valid webhook credentials. The POST /api/v1alpha1/autobuild endpoint trusts the caller-controlled X-Event-Key header to select a webhook provider and does not enforce HMAC-SHA256 validation for Bitbucket events, permitting cross-provider spoofing and build triggers using attacker-supplied commit SHAs against any matched repository and branch. No public exploit is identified at time of analysis, and vendor-confirmed patches exist for all affected release lines.
Cross-site request forgery in phpList before 3.7.0-RC5 allows a remote, unauthenticated attacker to delete arbitrary bounce rules from a target phpList installation by tricking an authenticated administrator into loading a crafted URL. The deletion endpoint (bouncerules.php) accepts state-changing operations over GET and passes enforce=false to verifyCsrfGetToken, meaning the CSRF token check is only performed when the tk parameter is voluntarily present - effectively disabling the protection entirely. A publicly available exploit exists (GitHub issue #1116); the vendor has released a fix in v3.7.0-RC5, and no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.