SQL injection in the If-So Dynamic Content Personalization WordPress plugin (versions <= 1.10) lets low-privilege users inject arbitrary SQL through an unsanitized input parameter, exposing the entire WordPress database including user credentials and secrets. The flaw was reported by Patchstack and carries a critical CVSS of 9.3; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Patchstack's 'Subscriber' classification indicates a low-privilege authenticated account is the intended prerequisite, which conflicts with the published CVSS PR:N metric.
SQL injection in the WPJAM Basic WordPress plugin (versions 7.0.1 and earlier, vendor denishua) lets attackers inject arbitrary SQL through an application entry point, exposing database contents. The Patchstack advisory classifies it as a 'Subscriber' SQL injection, implying low-privilege authenticated access, though the supplied CVSS vector marks it PR:N; either way the scope-changed impact (S:C) means the injected query reaches data beyond the plugin's own boundary. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass via hard-coded credentials in the Portal Generator add-on for Priority ERP (developed by Soft Solutions) allows remote, unauthenticated attackers to access the portal and read sensitive information belonging to other users or the underlying ERP. Reported by the Israel National Cyber Directorate (INCD) and rated CVSS 9.3, the flaw combines embedded static credentials (CWE-798), sensitive-information exposure (CWE-200), and improper access control (CWE-284). No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Command injection in FreePBX UCP Node server before 17.0.9 allows unauthenticated remote attackers to run arbitrary OS commands as the asterisk service user. The Socket.IO 4 middleware (io.use(checkAuth)) only guards the default namespace, so a client can reach unprotected custom namespaces and inject carriage-return/newline characters into Asterisk Manager Interface actions to execute commands. This is an authentication-bypass-plus-CRLF-injection chain; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated SQL injection in the Church Admin WordPress plugin (all versions through 5.1.1) lets remote attackers inject SQL through an unauthenticated request, exposing the WordPress database without any login. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, no-privilege network exploitation, and the CWE-89 root cause plus scope-change flag point to database compromise reaching beyond the plugin itself. No public exploit identified at time of analysis, but the low complexity and zero-authentication profile make it a strong candidate for opportunistic scanning.
SQL injection in the Everest Backup WordPress plugin (versions up to and including 2.3.12) lets remote attackers inject arbitrary SQL through an unauthenticated request, per a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N and a base score of 9.3. Reported by Patchstack, the flaw primarily exposes backend database contents (C:H) and can affect availability (A:L); no public exploit or active-exploitation evidence is identified at time of analysis. Because it requires no authentication and low complexity, any exposed site running an affected version is reachable directly over the network.
Unauthenticated SQL injection in the RealPress WordPress plugin (by ThimPress) affects all versions up to and including 1.1.2, letting remote attackers with no credentials inject crafted SQL through an exposed parameter and read arbitrary data from the site's database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The primary consequence is disclosure of sensitive database contents such as user records and credential hashes.
SQL injection in the realmag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and including 1.1.1) lets remote attackers inject arbitrary SQL against the site database without authentication. Reported by Patchstack and rated CVSS 9.3 (CWE-89), the flaw exposes back-end WooCommerce/WordPress data to disclosure. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthenticated SQL injection in the Listdom WordPress plugin (Webilia) through version 5.6.0 lets remote attackers inject arbitrary SQL into backend database queries without any authentication or user interaction. Reported by Patchstack and rated CVSS 9.3, it primarily threatens the confidentiality of the WordPress database (user credentials, session data, private listings). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated SQL injection in the Web Directory Free WordPress plugin (by shamalli) through version 1.7.13 lets remote attackers inject arbitrary SQL into backend queries without any credentials or user interaction. Any unauthenticated visitor can reach the vulnerable parameter and read sensitive database contents, including WordPress user records and password hashes. No public exploit has been identified at time of analysis, but the flaw is trivially reachable (CVSS 9.3) and typical of Patchstack-reported plugin SQLi that is quickly reverse-engineered from the patch diff.
SQL injection in the WP Directory Kit WordPress plugin (versions 1.5.4 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through unsanitized input, per a Patchstack disclosure carrying a 9.3 CVSS. Because no login is required (PR:N) and the CVSS marks a scope change with high confidentiality impact, an attacker can read sensitive database contents such as user credentials and WordPress secrets. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Arbitrary command execution in rsync before 3.5.0 arises from multiple unsanitized code paths - the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell newline injection - that let an attacker who controls hostnames, hostspecs, or related input inject shell metacharacters or newlines and run commands as the rsync process or invoking user. VulnCheck reported the cluster of CWE-78 flaws, which are fixed together in the major security release v3.5.0. No public exploit identified at time of analysis and the issue is not on CISA KEV, but the CVSS 4.0 base score of 9.2 reflects full confidentiality, integrity, and availability impact.
Arbitrary file write in rsync 2.3.3 through 3.4.4 lets a malicious sender escape a daemon module's root by abusing symlinks that are followed while resolving the --partial-dir or --backup-dir paths, redirecting writes to the module-root parent and beyond. Any rsync daemon exposing a writable module - or a read/write sync where a sender controls symlinks - is exposed, and the CWE-22 path-traversal primitive can be leveraged to overwrite configuration, cron, or authorized_keys files for follow-on code execution. Fixed in v3.5.0; reported by VulnCheck with no public exploit identified at time of analysis.
Missing authorization in SiYuan's /api/av/getAttributeViewSearchTarget endpoint allows an anonymous reader to retrieve database (attribute view) row content that publish-access filtering should hide. The affected route was added by commit 9b8e8956f and exists only in the development branch - it is absent from v3.7.3 and master and was fixed in v3.7.4, so no released stable version is affected. There is no public exploit identified at time of analysis and it is not in CISA KEV; despite the 9.2 CVSS the real-world exposure is limited to self-built development instances.
Authorization bypass (fail-open) in NextAuth.js (Auth.js) v5 affects applications on next-auth 5.0.0-beta.0 through 5.0.0-beta.31 that protect routes by checking only whether the auth() object exists. When Auth.js hits a server-side configuration error, the auth object is populated with a truthy error payload instead of null, so checks like !!auth or if (req.auth) evaluate true for every unauthenticated request. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the impact is a silent, total bypass of session-existence gates once a deployment becomes misconfigured. Fixed in 5.0.0-beta.32.
Account takeover in NextAuth.js / Auth.js email (magic-link) sign-in lets a remote unauthenticated attacker who knows a victim's address hijack the passwordless login. The built-in defaultNormalizer checks for a single ASCII '@' before applying Unicode NFKC normalization, so a homoglyph such as U+FF20 (FULLWIDTH COMMERCIAL AT) passes validation but canonicalizes to a second '@' in a downstream SMTPUTF8/internationalized mailer, misrouting the sign-in link to an attacker mailbox. No public exploit is identified at time of analysis, but a regression test and full commit-level detail are public, and vendor-released patches exist (@auth/core 0.41.3, next-auth 4.24.15 and 5.0.0-beta.32).
IP-based access control bypass in the rsync daemon (rsyncproject/rsync) before version 3.5.0 lets unauthenticated remote attackers forge their source address by injecting a crafted PROXY protocol header, defeating hosts allow/deny restrictions. Reported by VulnCheck and fixed in the v3.5.0 major security release, the flaw applies to daemons that trust PROXY protocol headers yet accept direct client connections. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.1 reflects high confidentiality and integrity impact once the IP allowlist is circumvented.
Access control bypass in rsync daemon versions 3.1.0 through 3.4.4 lets remote unauthenticated attackers evade module-level 'hosts deny' restrictions by forcing DNS resolution to fail during hostname-based access checks, causing the daemon to skip the rule (fail-open) instead of denying. Reported by VulnCheck and fixed in rsync 3.5.0, it exposes file trees in modules that were meant to be IP/hostname-restricted; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Account takeover in IBM Langflow OSS versions 1.0.0 through 1.9.6 is possible because the platform fails to limit repeated failed authentication attempts (CWE-307), letting remote attackers brute-force or credential-stuff their way into user accounts. IBM (the reporting vendor) rates it CVSS 9.1 with high confidentiality and integrity impact, reflecting full compromise of a targeted account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the missing lockout control is trivial to abuse against weak or reused credentials.
Server-side template injection in the Form::Processor::Field::HtmlArea Perl module (versions 0.06 through 1.162360) lets a remote unauthenticated attacker inject Locale::Maketext bracket-notation templates through HTML::Tidy validation diagnostics. Because the default language handle enables _AUTO, unrecognized message keys are compiled as templates, so attacker-controlled attribute names/values in submitted markup become method-dispatch templates on the language handle - yielding unhandled exceptions, near-unbounded memory allocation, and, where the application's handle subclass defines side-effecting public methods, invocation of those methods with attacker-chosen arguments. Reported by CPANSec with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.40%, 33rd percentile).
Unauthenticated information disclosure in the Portal Generator add-on to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve restricted data by bypassing security controls that are enforced only in the client rather than on the server. Any actor who can reach the portal over the network can craft direct server requests that skip the intended access checks, exposing sensitive data without credentials or user interaction. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated sensitive information disclosure in the Portal Generator Addon to Priority ERP (developed by Soft Solutions) allows remote attackers to retrieve private personal and business data without credentials or user interaction. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N) and reported by Israel's National Cyber Directorate (INCD), the flaw combines CWE-200 and CWE-359 exposure classes. No public exploit identified at time of analysis, and the product has a primarily Israeli deployment footprint.
Path confinement bypass in the rsync daemon (versions before 3.5.0) lets remote clients escape the intended per-module chroot root when a module path contains a '/./' boundary marker, granting unauthorized read or write access to files outside the module subtree. Reported by VulnCheck and carrying a CVSS 4.0 score of 9.1, the flaw is exploitable by mishandling the '/./' notation or by forging delta-basis (xname) transfers that cross the boundary. No public exploit has been identified at time of analysis, but the fix is a coordinated advisory (GHSA-wj7w-vh23-mm44) shipped in the major 3.5.0 security release.
Information disclosure and denial of service in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 lets a remote unauthenticated attacker trigger a stack-based buffer overflow, potentially reading sensitive memory contents and crashing the affected service. IBM (the reporter) has released a patch, and no public exploit has been identified at time of analysis. Despite a CVSS of 9.1, the EPSS probability is low (0.25%, 17th percentile) and CISA SSVC records no known exploitation.
Broken access control in Gitea (self-hosted Git service) versions up to and including 1.26.4 lets the team-repository linking endpoint ignore the RepoAdminChangeTeamAccess organization setting, so repository administrators can grant or alter team access to repositories even when an org owner has explicitly restricted that ability. This CWE-862 missing-authorization flaw undermines an intended org-level guardrail, exposing private repository contents (C:H) and permitting unauthorized permission changes (I:H). No public exploit has been identified at time of analysis, and the EPSS probability is low (0.15%, 5th percentile).
Server-side request forgery in Gitea Open Source Git Server (all versions through 1.26.4) lets attackers abuse the repository migration and mirror features to reach internal network resources. Two distinct weaknesses are involved: a DNS-rebinding bypass where a hostname resolves to a permitted address during validation and to an internal address when the actual request is made, and a missing re-validation flaw where redirect or subsequent fetch targets are not re-checked against the allow/deny policy. No public exploit was identified at time of analysis, EPSS is low (0.15%), and it is not in CISA KEV, but the vendor rates technical impact as total and the issue is fixed in 1.27.0.
Account takeover in the Budibase low-code platform (prior to 3.39.30) lets an attacker impersonate any existing user by abusing OIDC SSO account-linking. Because the OIDC verify callback in oidc.ts resolved the email claim without ever reading email_verified, and sso.ts fell back to getGlobalUserByEmail as the linking key, a fresh attacker identity from a configured IdP asserting a victim's email - even as unverified - is silently merged into the victim's account, inheriting its _id and roles up to global admin/builder. No public exploit is identified at time of analysis, but the root cause is confirmed by the vendor GHSA advisory and the fixing commit; the issue carries a CVSS 4.0 base score of 9.0.
SQL injection in Budibase's webhook-triggered automation engine (versions before 3.40.0) lets remote attackers reach EXECUTE_QUERY automation steps and inject SQL that runs with the builder-configured datasource credentials. Because the webhook trigger endpoint accepts attacker-controlled JSON without authentication, an attacker can exfiltrate, modify, or persist data in connected backends such as Snowflake. No public exploit identified at time of analysis; the flaw is fixed in 3.40.0 and documented in GHSA-x7h8-ww3q-xv7c.
Server-side code injection in Elastic Fleet Server (8.5.0-8.19.19, 9.0.0-9.4.4, and 9.5.0) lets an actor who can define an output configuration in Kibana smuggle script syntax through an output identifier that is never restricted to safe characters. Because Fleet Server later concatenates that identifier into a script it builds during routine agent policy processing, embedded script fragments execute on the server rather than being treated as inert data, yielding attacker-controlled code execution (CWE-94). No public exploit identified at time of analysis and EPSS is low (0.36%), but SSVC rates technical impact as total.