Authenticated OS command injection in Tenable Security Center allows a low-privileged user to run arbitrary operating system commands by uploading a specially crafted file that is unsafely handled during upload processing. The flaw was reported by Tenable's own research team (advisory tns-2026-22) and carries a CVSS 4.0 base score of 9.4 with high impact on both the vulnerable system and subsequent systems. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low privilege bar (PR:L) combined with full code-execution impact makes this a high-priority patch for internet-facing or shared consoles.
Remote code execution in Tenable Security Center's report-generation subsystem allows an authenticated, non-administrative user to run arbitrary code with the privileges of the service account by submitting crafted input that is unsafely evaluated during server-side report rendering. Because Security Center is itself a centralized vulnerability-management platform holding scan data and credentials for an entire estate, compromise of the service account is high-impact. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authenticated remote code execution in ImpressCMS allows administrators with access to the custom tag module to store and persistently execute arbitrary PHP code across all frontend page loads. The root mechanism is a decode-then-eval pattern: the application's renderWithPhp() method calls undoHtmlSpecialChars() on stored tag content before passing it to eval(), causing HTML Purifier sanitization to be bypassed entirely since purification operates on the encoded form. Publicly available exploit code exists on GitHub; this vulnerability has not been confirmed as actively exploited by CISA KEV at time of analysis.
Remote unauthenticated OS command injection in the Haiwell IoT Cloud HMI Gateway (version 3.40.1.12) lets attackers run arbitrary operating-system commands as root through the 'Net Check' function's cmdPing Socket.io event on the /setting endpoint. The CVSS 3.1 base score is 10.0 with a scope change, reflecting full compromise of the device with no authentication or user interaction. No public exploit has been identified at time of analysis, and the flaw is documented in CISA ICS advisory ICSA-26-225-02.
OS command injection in the Baicells EG3661M LuCI web interface (firmware BaiCE_BQ6_2.0.5.3_NA) allows an authenticated remote attacker with administrative credentials to execute arbitrary operating system commands by manipulating the MaxHops, Timeout, or Size arguments passed to /cgi-bin/luci. Full confidentiality, integrity, and availability compromise of the device is achievable upon exploitation. A public proof-of-concept exploit is available on GitHub, and no vendor patch exists - the vendor did not respond to responsible disclosure, leaving affected deployments with no official remediation path.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized 'pin' argument to the setWiFiWpsConfig function exposed via /cgi-bin/cstecgi.cgi in the wps.so component. A public proof-of-concept exploit has been released on GitHub, elevating real-world risk despite the absence of a CISA KEV listing. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact with low privilege and no user interaction required.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows network-accessible, low-privilege attackers to potentially execute arbitrary code by sending a crafted request to the UploadCustomModule function in /cgi-bin/cstecgi.cgi. A public proof-of-concept exploit is hosted on GitHub, materially raising practical risk beyond what the absence of a CISA KEV listing might suggest. No vendor patch has been identified, leaving affected deployments reliant on compensating controls.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC enables remote low-privileged attackers to execute arbitrary code by submitting a malformed qosIndex parameter to the /goform/delQos endpoint. The vulnerable formQOSRuleDel function fails to validate input length before writing to a fixed-size stack buffer in the QoS Rule Deletion component. A public proof-of-concept exploit is confirmed available on GitHub, significantly elevating real-world risk for any deployment with the management interface reachable by untrusted parties.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows authenticated remote attackers to achieve likely remote code execution by supplying an oversized urlKeyword argument to the setParentalRules function exposed through /cgi-bin/cstecgi.cgi. The vulnerability resides in the firewall.so component handling parental control URL keyword filtering. A public proof-of-concept exploit has been published on GitHub, elevating practical risk; no vendor patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote low-privileged attackers to achieve arbitrary code execution by submitting an oversized macAddress parameter to the setMacQos QoS firewall function via /cgi-bin/cstecgi.cgi. The CVSS 4.0 score of 8.7 with network attack vector and full CIA impact on the device reflects the severity of exploitation. A public proof-of-concept is confirmed available on GitHub, materially lowering the exploitation barrier; no patch has been identified at time of analysis.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 allows remote low-privileged attackers to execute arbitrary code by supplying an oversized Comment argument to the setIpQosRules function via /cgi-bin/cstecgi.cgi. The flaw resides in firewall.so, the router's QoS firewall shared library, and can result in full device compromise including confidentiality, integrity, and availability loss. A public proof-of-concept exploit is available on GitHub, materially lowering the exploitation barrier; no vendor-released patch has been identified at time of analysis.
Buffer overflow in the Tenda G0 router's httpd web management interface allows authenticated remote attackers to corrupt memory and potentially execute arbitrary code by submitting oversized input to the setPortMapping function via the /goform/module endpoint. All firmware builds up to version 20260625 are confirmed affected per ENISA EUVD-2026-58585. A public proof-of-concept exploit has been released on GitHub, substantially lowering the skill threshold for exploitation; no CISA KEV listing confirming active mass exploitation was present at time of analysis.
Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows low-privileged remote attackers to corrupt stack memory by sending a crafted `staticRouteNet` argument to the `/goform/module` endpoint, potentially enabling arbitrary code execution on the device. All firmware versions up to and including build 20260625 are confirmed affected. A public proof-of-concept exploit is available on GitHub, materially elevating practical risk; however, no CISA KEV listing has been identified, indicating active exploitation is not yet confirmed at scale.
Stack-based buffer overflow in the Tenda G0 router's httpd web management interface allows network-adjacent or remote authenticated attackers to corrupt stack memory by supplying an oversized value to the portMirrorMirroredPorts argument of the formSetPortMirror function at the /goform/module endpoint. All G0 firmware builds through 20260625 are confirmed affected per EUVD-2026-58575 and NVD CPE data. A public proof-of-concept exploit is available on GitHub, materially lowering the bar for exploitation; no CISA KEV listing has been identified, so active widespread exploitation is not confirmed at time of analysis.
Stack-based buffer overflow in Tenda AC1206 firmware 15.03.06.23_multi_TD01 exposes the router's web management interface to remote code execution via a crafted guest WiFi configuration request. The vulnerable function `set_wl_guest_iplist` at the `/goform/WifiGuestSet` endpoint fails to validate the length of the `shareSpeed` argument before copying it onto a fixed-size stack buffer, enabling an attacker with low-privilege router access to overwrite the return address and seize control of the `httpd` process - which typically runs as root on embedded router firmware. A public proof-of-concept exploit has been disclosed on GitHub, materially lowering the barrier to exploitation; no CISA KEV listing is present, so confirmed active exploitation in the wild is not established at time of analysis.
Stack-based buffer overflow in the Tenda AC1206 router firmware 15.03.06.23_multi_TD01 allows a remotely authenticated attacker to overflow a fixed-size stack buffer in the `set_device_name` function by sending an excessively long `devName` value to the `/goform/SetOnlineDevName` endpoint of the httpd web management interface. Successful exploitation could yield arbitrary code execution on the device with the privileges of the httpd process. A public proof-of-concept exploit has been published on GitHub, elevating real-world risk despite the absence of a CISA KEV listing.
Stack-based buffer overflow in TOTOLINK A800R firmware 4.1.2cu.5137_B20200730 enables remote code execution via the router's firewall URL-filtering CGI endpoint. An attacker holding low-privileged credentials can submit a crafted HTTP request to /cgi-bin/cstecgi.cgi targeting the setUrlFilterRules function; an oversized url argument overflows a fixed stack buffer in firewall.so, allowing arbitrary code execution - likely as root on the embedded MIPS platform. A public proof-of-concept exploit is available on GitHub (ENISA EUVD-2026-58735), and no vendor-released patch has been identified at time of analysis.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows remote low-privileged attackers to corrupt stack memory and potentially execute arbitrary code by sending a crafted value in the IPMacBindRule argument to the /goform/addIpMacBind endpoint. The vulnerable function ipMacBindListStore fails to validate input length before writing to a fixed-size stack buffer (CWE-121). Publicly available exploit code exists, raising active risk for any deployment where the web management interface is reachable and low-privilege credentials are obtainable.
Stack-based buffer overflow in Tenda W20E firmware 15.11.0.6(1068_1546_841)_CN_TDC allows authenticated remote attackers to execute arbitrary code by supplying an oversized qosListConnecttedNum argument to the lstAdd function via the /goform/editQos endpoint. The vulnerability affects the QoS Edit component of this SOHO router and carries high impact across confidentiality, integrity, and availability - consistent with full device takeover. A publicly available proof-of-concept exploit exists on GitHub, meaningfully elevating operational urgency despite the absence of CISA KEV confirmation.
Unauthenticated remote code execution in MindsDB Minds Platform (version 26.1.0 and earlier) lets any network-reachable attacker run arbitrary OS commands on the host by chaining two unprotected API endpoints. The attacker first sets a controlled LLM API key via the unauthenticated PUT /api/v1/settings/ endpoint, then submits a crafted prompt to POST /api/v1/responses/ that steers the Anton agent into calling its scratchpad tool, which passes attacker-influenced Python directly into exec() with no sandbox. Reported by VulnCheck with a maximum CVSS 4.0 score of 10.0 and CWE-94; no public exploit identified at time of analysis, but the trivial attack complexity and lack of authentication make it high priority.
Remote code execution in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) allows a remote unauthenticated attacker to run arbitrary code by exploiting external control of a file name or path (CWE-73). The flaw carries a CVSS 9.8 rating with a network attack vector and no privileges or user interaction required, and IBM has published a fix. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in IBM Db2 Mirror for i (versions 7.4, 7.5, and 7.6) lets a remote, unauthenticated attacker read or modify sensitive information by exploiting improper validation of request URI path segments. Because the flaw is reachable over the network without credentials or user interaction, an attacker can defeat access controls on the replication/administration interface and reach protected functionality or data. No public exploit has been identified at time of analysis, but the maximal CVSS 9.8 rating and the low attack complexity make this a high-priority patching target.
SQL injection in SiYuan's backlink/mention search (kernel/model/backlink.go) lets unauthenticated attackers execute arbitrary SQL against the self-hosted note-taking application through v3.7.2. Because the search routine escapes only double quotes and leaves single quotes intact, a crafted keyword or malicious stored block metadata breaks out of the SQL string literal on the primary read-write siyuan.db handle, enabling cross-notebook read and write. VulnCheck reports the flaw (CVSS 4.0 base 9.9); no public exploit identified at time of analysis, and it is fixed in v3.7.4.
Authentication bypass and re-installation abuse in Emlog 2.6.26 and earlier lets a remote unauthenticated attacker POST to install.php with action=reinstall, which deliberately skips the already-installed guard because that check only runs when the action is not 'reinstall'. By supplying attacker-chosen database and admin credentials, the attacker overwrites config.php via file_put_contents and provisions a new administrator account, achieving full takeover of an already-live site. No public exploit has been identified at time of analysis and no vendor-released patch is available, though the flaw is trivially reachable against default installations.
Remote CL command execution in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 lets a remote attacker run arbitrary Control Language commands on the IBM i host because special elements in a command are not properly neutralized (CWE-78). The CVSS 3.1 base score is 9.8 with a fully network-facing, no-privilege, no-interaction vector, meaning an unauthenticated remote attacker can achieve high-impact code execution. There is no public exploit identified at time of analysis and EPSS is modest at 0.47% (39th percentile), but the combination of unauthenticated network reach and full CIA impact makes this a high-priority patch.
Unauthenticated SQL injection in Metacat 2.0.0 through 3.4.0 lets remote attackers read, modify, and delete the entire backing PostgreSQL database via the nodeId parameter of the /cn/v1/object and /cn/v2/object REST endpoints. Because SQL errors are mirrored back inside Metacat's XML error responses, an attacker can use error-based extraction (e.g. PostgreSQL CAST) to exfiltrate arbitrary data with no credentials. Full working proof-of-concept exploits have been developed and verified by the reporter, though there is no public exploit identified and no CISA KEV listing at time of analysis.
Unauthenticated account takeover in the Wishlist Member WordPress membership plugin (versions up to and including 3.34.1) lets remote attackers seize any existing account, including administrators. The wpm_register() function verifies the registration cookie only against the GET reg parameter while trusting the POST mergewith and wpm_id parameters, so an attacker who supplies a victim's numeric user ID as mergewith causes wp_update_user() (plus a direct $wpdb query) to overwrite that account's username, password, email, and name with attacker values while suppressing WordPress notification emails. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network vector make this a critical-priority issue for any site running the plugin.
OS command injection in Tenable Security Center (formerly Tenable.sc) lets a remote attacker run arbitrary operating-system commands as the service account, yielding full control of the vulnerability-management console. Rated CVSS 9.4 (CVSS 4.0) with high confidentiality, integrity, and availability impact extending to the underlying host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; note the vendor description says 'unauthenticated' while the published CVSS vector carries PR:L, an unresolved discrepancy affecting who can actually trigger it.
Path traversal in DTStack Taier 1.4.0's Chunk-Check Endpoint exposes the server's filesystem to remote unauthenticated attackers who can manipulate the Name parameter in FileChunkController.java to escape the intended upload directory. The Java Paths.get() function processes attacker-controlled input without sanitization, enabling directory traversal sequences to reference arbitrary files accessible to the Taier process. A public proof-of-concept exploit is available via GitHub issue #1203, and no exploitation confirmation from CISA KEV exists at time of analysis.
Unauthenticated SQL injection in Raisecom Communication Command and Dispatch Management Platform (versions up to 7.6.5) exposes backend database contents via the `sip` parameter in `/app/users/getpwd.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully remote, zero-prerequisite exploitation, and a public proof-of-concept exploit is already available. The vendor did not respond to disclosure, leaving no patch available and no official guidance for affected operators.
Path traversal in AllData up to version 0.6.8 enables remote unauthenticated attackers to read arbitrary files from the server filesystem via the logDetailCat endpoint. The executorAddress parameter is passed unsanitized to FileInputStream in JobLogController.java, allowing directory traversal sequences to escape the intended file access boundary. A public exploit has been published on GitHub; no patch exists and the vendor has permanently declined to fix the issue by closing the bug report as 'not planned.'
Authentication bypass in Roskus Prospero Flow CRM before 5.15.9 lets unauthenticated remote attackers log in as any employee onboarded through the standard HR flow using only that employee's email address. The employee save controller assigns a hard-coded fallback password of "changeme" (CWE-798) because the onboarding form exposes no password field, leaving newly created accounts with a universally known credential. No public exploit code or CISA KEV listing is identified at time of analysis, but the flaw is trivially reproducible from the public fix commit, and the CVSS 4.0 base score is 9.3 (Critical).
CVE-2026-73251 concerns built-in TLS certificate-chain verification involving CA bundles, reported by Ubuntu. The available intelligence is critically sparse - no description of the actual flaw, no CVSS vector, no CWE classification, and no references have been provided. No meaningful synthesis of attacker capability, affected versions, or exploitability is possible from the supplied data alone. Security teams should treat this record as preliminary pending vendor disclosure.
Authentication bypass in Laravel Socialite's Facebook provider (versions before 5.29.0) lets unauthenticated remote attackers replay captured OIDC id_tokens because getUserByOIDCToken() in FacebookProvider.php validates signature, aud, and iss but never checks a session-bound nonce. An attacker holding any valid, unexpired id_token minted for the same Facebook App ID can submit it to the backend's userFromToken() endpoint and be logged in as the victim, achieving full account takeover. Reported by VulnCheck and assigned CVSS 4.0 9.2; no public exploit has been identified at time of analysis and it is not on CISA KEV.
Horizontal privilege escalation / cross-account file access in FileBrowser before 2.63.19 lets a self-registering user take over another user's files when the server runs on a case-insensitive filesystem (e.g. Windows/NTFS). Because the home-directory ownership scope is persisted and compared as an exact case-sensitive string, two signups differing only in letter case (e.g. CaseVictim vs casevictim) become separate accounts that map to the same physical directory, giving the second registrant read, overwrite, and delete access to the first user's data over authenticated HTTP. Reported by VulnCheck; a vendor patch is available and no public exploit has been identified at time of analysis.
Unauthorized disclosure of private content in SiYuan (siyuan-note) versions before v3.7.4 lets anonymous, unauthenticated clients subscribe to the WebSocket broadcast channel on the publish surface and receive real-time editing events for every document, including password-protected and explicitly forbidden ones. Reported by VulnCheck and documented in the vendor's GHSA advisory, the flaw is a missing authorization (CWE-862) check on broadcast sessions rather than a memory-corruption bug. No public exploit identified at time of analysis, but the trivial network-only access path and 9.2 CVSS 4.0 score make this a high-priority confidentiality issue for any exposed publish deployment.
SQL injection in the iCagenda event-management extension for Joomla lets remote unauthenticated attackers inject arbitrary SQL through the mod_icagenda_calendar calendar module, which is reachable via Joomla's com_ajax endpoint without any session, CSRF token, or user account. Affected versions run from 4.0.0 through 4.0.11, and the CVSS 4.0 base score of 9.2 (Critical) reflects high confidentiality impact with additional integrity and availability effects. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, but the trivial reachability makes it a strong patch priority.
External control of file name or path (CWE-73) in Johnson Controls Airwall before version 4.1 enables file manipulation via network-accessible endpoints, with the primary impact being high confidentiality exposure alongside limited integrity and availability effects. The CVSS 4.0 vector (AV:N/UI:A/PR:N) indicates no privileges are required but user interaction must occur, and the SSVC assessment confirms no observed exploitation and a non-automatable attack path. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Hard-coded cryptographic key exposure in Johnson Controls Airwall before version 4.1 enables local attackers to conduct cryptanalytic attacks against the product's cryptographic protections. Because the same key material is embedded across all product instances, reverse engineering one installation yields a key applicable to all deployments. No public exploitation has been identified (SSVC: Exploitation none), and the vendor has confirmed a patch is available in version 4.1, limiting the urgency window. The CVSS 4.0 score of 7.0 reflects high confidentiality impact with low integrity exposure, constrained by a local attack vector.
Command injection in Tenable Security Center's file upload handler allows an authenticated low-privilege network attacker to execute arbitrary OS commands on the underlying server. The root cause is insufficient sanitization of user-supplied filenames before they are passed to a downstream shell-invocable operation, classified under CWE-78. With a CVSS base score of 8.8 and full confidentiality, integrity, and availability impact, this represents a serious privilege escalation path within a product that itself manages vulnerability data across enterprise environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Semaphore prior to version 2.18.20 allows authenticated project Managers and Owners to execute arbitrary shell commands on the Semaphore server host by injecting git arguments through a crafted repository git_url value. The root cause (CWE-88, Argument Injection) lies in the default cmd_git client passing user-supplied input unsanitized to the system git binary, enabling exploitation via git's --upload-pack= option to specify an arbitrary server-side command. No public exploit code has been confirmed at time of analysis, but the --upload-pack argument injection technique is extensively documented in open-source security research and requires no specialized tooling for any holder of the requisite project role.
Command injection in Tenable Security Center enables an authenticated administrator to achieve arbitrary OS command execution by embedding shell metacharacters in application configuration values, which are later executed unsanitized when specific backend operations are triggered. The CWE-78 root cause and the PR:H CVSS 4.0 metric confirm exploitation is gated behind administrator-level access, restricting the realistic attacker population to insiders, compromised admin credentials, or post-escalation actors. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Tenable self-reported this via vulnreport@tenable.com and published advisory TNS-2026-22.
Command injection in Cockpit CMS 2.14.0 and earlier allows any authenticated user holding only the assets/upload permission to execute arbitrary OS commands as the web-server user. The FFmpeg integration passes the raw, user-controlled upload filename directly into Process::fromShellCommandline() before slug sanitization runs, meaning shell metacharacters - backticks, $(), semicolons - in the filename escape the FFmpeg invocation context. No public exploit has been identified at time of analysis, but the fix is confirmed in upstream commit 28813596f57685f63d3a48f655e8e9bd2b535cab, which migrates all FFmpeg invocations from shell-interpolated command strings to argument-array Process construction.
Security restriction bypass in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 permits remote authenticated attackers to exceed their authorized privilege level via manipulated user-supplied input processed without adequate authorization checks. With a CVSS score of 8.8 and full confidentiality, integrity, and availability impact, exploitation could allow an attacker with only low-privilege credentials to read, modify, or disrupt mirrored database content. No public exploit code and no CISA KEV listing have been identified at time of analysis, though a vendor patch is available.
Privilege escalation via a deterministic use-after-free in Zephyr RTOS's dynamic kernel-object disposal path affects any firmware build compiled with both CONFIG_USERSPACE and CONFIG_DYNAMIC_OBJECTS enabled. An unprivileged user thread can arm a dynamically-allocated k_timer, then release its last permission - causing unref_check() to free the timer's backing storage while the embedded struct _timeout dnode remains linked in the global _timeout_q; when the timer subsequently fires, z_timer_expiration_handler() dereferences and writes the freed - and potentially reallocated - kernel heap at ISR privilege. The bug constitutes a reliable sandbox-escape memory-corruption primitive scored CVSS 8.8 with scope change (S:C), and no public exploit has been identified at time of analysis.
Remote code execution in Grav CMS before 2.0.13 allows authenticated low-privilege users to plant and execute arbitrary PHP files on the server by exploiting a validation bypass in the Flex Objects plugin. The attacker crafts a ZIP archive containing PHP code, circumvents routine-name validation by substituting array notation for the expected string notation, and triggers the unZip routine to write the payload directly into the web root where it becomes immediately executable via HTTP. No public exploit has been identified at time of analysis, but the precise bypass technique disclosed in the advisory substantially lowers the barrier to exploitation for any attacker holding valid credentials.
Server-side template injection in Grav CMS before 2.0.13 allows low-privileged page editors to execute arbitrary operating-system commands via the Twig templating engine. Attackers exploit the unsandboxed `find` filter in email-action form parameters - injecting Twig payloads into subject, body, to, or from fields - which are evaluated server-side upon form submission, yielding full RCE. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.7 (VC:H/VI:H/VA:H) reflects full-compromise potential on the vulnerable system for any actor holding a page editor account.
Server-side template injection (SSTI) leading to remote code execution in the Grav CMS API plugin (getgrav/grav-plugin-api) before version 1.0.13 is reachable by any low-privilege API key holder whose key was minted on a super-admin account. The root flaw is in PagesController::guardTwigContent(), which gates Twig processing via a bare isSuperAdmin() call that ignores the api_key_scopes array, allowing a key deliberately scoped to api.pages.write to enable process.twig on page save despite admin.pages_twig being intentionally excluded from that scope. A public proof-of-concept exists per SSVC data; exploitation is classified as automatable with total technical impact, making this a high-priority patch target for any Grav deployment where the required non-default configuration is active.
Remote code execution in Grav API plugin versions before 1.0.13 is achievable by any attacker holding a scoped api.config.write API key. The ConfigController fails to enforce its super-scope gates, permitting scoped keys to overwrite scheduler.custom_jobs configuration that Grav subsequently executes via the Symfony Process component. A public exploit exists per SSVC data, the attack is rated automatable, and technical impact is assessed as total - making this a high-priority patching target despite a low EPSS score.
Force-disabling of two-factor authentication on Grav CMS user accounts is achievable through a missing scope enforcement check in the grav-plugin-api Composer package before version 1.0.13. Any holder of a low-privilege API key carrying api.users.write permission - or any scoped key on a super account - can POST to /api/v1/users/{user}/2fa/disable without supplying a TOTP code, stripping 2FA from any non-super target account and enabling direct account takeover. No active exploitation is currently confirmed (SSVC Exploitation: none; EPSS 0.34%), but SSVC rates this automatable with total technical impact, making prompt patching critical for any instance exposing the API with delegated keys.