Authorization bypass via Insecure Direct Object Reference (IDOR) in Webkul Bagisto's backend customer detail endpoint allows remote authenticated users to enumerate and retrieve customer records outside their authorized scope by manipulating the ID parameter in requests to /admin/customers/view. Versions up to and including 2.4.4 are confirmed affected per NVD CPE data, and publicly available exploit code exists on GitHub. The vendor has acknowledged the vulnerability class and confirmed that partial remediation is underway internally, though no specific patched release version has been publicly confirmed.
Path traversal in wvp-GB28181-pro 2.7.4-20260107 exposes arbitrary server files through the Snapshot Endpoint in PlayController.java, where the deviceId and channelId parameters are incorporated into file system operations without sanitization. Authenticated remote attackers with low-privilege access can escape the intended snapshot directory by injecting traversal sequences into these parameters, yielding partial confidentiality, integrity, and availability impact. A publicly available proof-of-concept exploit exists on GitHub (issue #2175), materially lowering the barrier to exploitation despite the moderate CVSS 5.3 score and absence from the CISA KEV catalog.
Authorization bypass via Insecure Direct Object Reference (IDOR) in RosarioSIS up to version 12.8 allows authenticated low-privilege users to manipulate numeric record IDs in HTTP requests to save or delete records belonging to other schools within the same multi-tenant installation. The vulnerability is program-wide, affecting at least Accounting, Attendance, and Discipline modules - not limited to Discipline/Referrals.php as the CVE description implies. A publicly available exploit exists (GitHub issue #301); the flaw is not in CISA KEV and CVSS 4.0 scores it at 2.1 with an active proof-of-concept modifier.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the delid parameter in viewdoctortimings.php. A low-privileged user account is required to exploit the flaw, after which an attacker can extract, modify, or potentially delete sensitive data from the underlying database - including patient records and physician scheduling data. A public proof-of-concept exploit has been published on GitHub, materially lowering the barrier for opportunistic exploitation.
Server-side request forgery in eyaushev swagger-testcase-mcp enables authenticated remote attackers to forge arbitrary server-side HTTP requests through the loadSource function of the fetch_swagger component, potentially reaching internal network resources, cloud metadata endpoints, or other services inaccessible from the attacker's position. All versions under the project's rolling release model are affected at commit 5babb27c951fb404bc2b25ec80593616e49054e5, with no patch or maintainer response confirmed at time of analysis. A public proof-of-concept exploit exists via GitHub issue, though no active exploitation has been confirmed by CISA KEV; the CVSS 4.0 base score of 2.1 reflects limited but real impact across confidentiality, integrity, and availability on the vulnerable system.
Authorization bypass in Webkul Bagisto's backend reporting endpoint (/admin/reporting/sales/) allows authenticated low-privilege users to access sales reporting data outside their intended authorization scope. Affected deployments include Bagisto versions up to and including 2.4.4, confirmed via CPE cpe:2.3:a:webkul:bagisto. A publicly available proof-of-concept exploit has been published on GitHub, and while not listed in CISA KEV, the vendor has acknowledged the issue through internal security assessment, indicating awareness but no confirmed patched release version at this time.
Authorization bypass in Webkul Bagisto's Admin Customer Impersonation Feature (versions up to 2.4.4) allows authenticated administrators to manipulate the ID parameter at /admin/customers/login-as-customer/ to impersonate arbitrary customers beyond their intended authorization scope. The CVSS 4.0 score of 5.1 reflects high-privilege prerequisites (PR:H) and limited impact metrics, but a publicly available proof-of-concept on GitHub meaningfully lowers the exploitation barrier for any attacker who already holds admin credentials. The vendor has acknowledged the vulnerability and confirmed partial internal remediation, with remaining fixes planned for upcoming releases.
Unrestricted file upload in SourceCodester Simple Doctors Appointment System 1.0 allows a remote, high-privilege attacker to upload arbitrary file types - including server-executable PHP scripts - via the save_doctor function at /save_file.php. The confidentiality, integrity, and availability impact is rated low-to-moderate per the CVSS 4.0 vector (5.1 Medium), as exploitation is constrained to authenticated sessions with high-privilege credentials. A public proof-of-concept exploit exists (GitHub issue linked from VulDB), though the vulnerability has not been added to the CISA KEV catalog.
SQL injection in SourceCodester Air Cargo Management System 1.0 exposes the `/classes/Master.php?f=save_cargo_type` endpoint to database manipulation via a crafted `id` argument. Exploitation requires high-privilege authenticated access (CVSS 4.0 PR:H), constraining the realistic attacker pool to compromised or shared administrator accounts. A public proof-of-concept is available on GitHub, confirmed by VulDB reporting; no patch has been identified at time of analysis.
Information disclosure in Webkul Bagisto up to version 2.4.4 allows authenticated admin users to extract unintended customer data by manipulating the `query` parameter at the `/admin/customers/search` endpoint. The vulnerability carries a CVSS 4.0 score of 2.0 - reflecting limited confidentiality impact (VC:L) and a high-privilege requirement (PR:H) - meaning only actors already holding admin credentials can trigger it. A public proof-of-concept exploit exists on GitHub; however, no active exploitation has been confirmed via CISA KEV, and the vendor has acknowledged the issue, stating partial remediation is already underway with remaining fixes planned for upcoming releases.
Improper access control in Webkul Bagisto's Customer Item Deletion Endpoint (versions up to 2.4.4) permits a remotely-accessible, authenticated attacker to delete customer items beyond their authorization scope. A public proof-of-concept exploit is available on GitHub, and the vendor has acknowledged the issue, confirming partial fixes have shipped with remaining remediation planned for future releases. This is not currently listed in the CISA KEV catalog, and real-world impact is moderated by the PR:H authentication requirement.
Server-side request forgery in feedmob fm-mcp-servers 0.0.3 allows a locally authenticated attacker to manipulate the `downloadUrl` argument in the `downloadReport` function, causing the server to issue arbitrary outbound HTTP requests to attacker-controlled internal or external targets. Exploitation is constrained to local access only (AV:L), significantly limiting the practical attack surface, though a public proof-of-concept is available via GitHub issue #198. No vendor patch exists; the vendor has not responded to the coordinated disclosure.
Broken or risky cryptographic algorithm use in Johnson Controls TL280 communicator firmware exposes device communications to cryptanalytic attack, affecting all versions before 5.63. An unauthenticated network attacker who can satisfy specific attack prerequisites - most likely a man-in-the-middle network position - can achieve limited confidentiality, integrity, and availability impact against communications to and from the device. No active exploitation is confirmed (CISA KEV absent, SSVC exploitation status: none), and automatable exploitation is assessed as unlikely due to the AT:P requirement in the CVSS 4.0 vector.
Information disclosure in CKAN MCP Server prior to v0.4.112 exposes raw upstream HTTP response bodies, internal hostnames, IP addresses, database error messages, and stack fragments to callers via unsanitized error paths. The flaw is reachable over the network without authentication (CVSS AV:N/PR:N) but requires high complexity, specifically the ability to direct the server at a non-CKAN host - either legitimately or via SSRF chaining. No public exploit code has been identified at time of analysis, and a vendor-released patch is available at v0.4.112.
Incorrect default file permissions on /etc/vsftpd.conf in TrendNet TEW-813DRU firmware 1.01b01 allow a remote low-privileged attacker to manipulate FTP server configuration, resulting in low-severity integrity compromise. The affected product is end-of-life and will receive no vendor patch. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects the high attack complexity and minimal impact scope.
Path traversal in wvp-GB28181-pro 2.7.4-20260107 exposes arbitrary server-side files through the Log File Download Endpoint in LogController.java, where the unsanitized `fileName` parameter allows directory escape sequences to be supplied by authenticated remote attackers. A public proof-of-concept exploit has been released per the CVSS 4.0 supplemental metric (E:P) and VulDB submission, lowering the bar for exploitation. Impact is limited to low-severity confidentiality loss with no integrity or availability effects, consistent with the CVSS 4.0 score of 2.1 and a PR:L/VC:L vector.
Integer truncation in Capstone's WebAssembly disassembly backend allows a crafted br_table instruction to cause either an infinite decode loop or misaligned parser advancement, undermining both availability and parser integrity in any application that passes attacker-controlled WASM bytes to cs_disasm() or cs_disasm_iter(). All Capstone versions prior to 6.0.0-Alpha9 are affected. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 2.0 reflects the local attack vector and constrained real-world impact.