SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/viewmedicine.php` endpoint to database manipulation via the unsanitized `delid` parameter, allowing remote low-privileged attackers to read, alter, or delete hospital database contents including patient and medication records. A public proof-of-concept exploit is confirmed available on GitHub, lowering the bar for exploitation significantly. No vendor-released patch exists, making manual code remediation or decommissioning the only available mitigations.
VMAuth, the authentication proxy component of VictoriaMetrics through version 1.146.0, fails to restrict the rate of authentication attempts in its requestHandler function, enabling remote brute-force attacks against credentials protecting proxied metrics backends. The missing delay or lockout mechanism allows an attacker to enumerate credential combinations at network speed with no server-side throttling. Publicly available exploit code exists (CVSS 4.0 E:P supplemental), though this CVE does not appear in the CISA KEV catalog and real-world exploitation risk is tempered by the high attack complexity rating.
Unbounded authentication attempts against Open Source Point of Sale (versions 3.4.0-3.4.2) allow remote attackers to brute-force user credentials via the login endpoint without triggering any lockout or throttle. The Login::index function in app/Config/Validation/OSPOSRules.php performs no rate limiting on failed authentication attempts, leaving all user accounts exposed to automated credential guessing. Publicly available exploit code exists (CVSS 4.0 E:P); the vulnerability is not listed in CISA KEV, and the official upstream project has not yet responded to the responsible disclosure.
Brute-force authentication bypass in dtale (man-group) up to version 3.22.0 allows remote attackers to submit unlimited login attempts against the Login Endpoint in dtale/auth.py due to the absence of rate limiting or account lockout controls (CWE-307). The CVSS 4.0 score of 2.9 reflects high attack complexity and limited confidentiality impact, consistent with the description's characterization of exploitation as difficult. Publicly available exploit code exists (CVSS 4.0 E:P modifier), and no vendor patch has been released - the project has not responded to the coordinated disclosure via GitHub issue.
Weak session key generation in dtale up to version 3.22.0 allows remote attackers with network access and session cookie capture capability to predict or brute-force the Flask SECRET_KEY and subsequently forge session cookies. The build_secret_key function in dtale/app.py generates a 10-character key using NumPy's non-cryptographic PRNG over a 36-character alphabet, yielding severely insufficient entropy for a security-sensitive value. Publicly available exploit code exists per the CVE description and corroborated by CVSS 4.0 E:P, but no active exploitation has been confirmed by CISA KEV; an upstream fix PR has been submitted but not yet merged.
Incorrect default permissions in the vsftpd FTP service on D-Link DIR-842 firmware 2.01.B04 allow a remotely authenticated low-privileged attacker to achieve limited integrity impact under high-complexity conditions via manipulation of /etc/vsftpd.conf. The vulnerability carries a CVSS 4.0 score of 2.3, placing it in the low-severity tier with no active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis. The discrepancy between the 'Information Disclosure' tag and the CVSS showing no confidentiality impact (VC:N) introduces some ambiguity about the full impact scope.
SQL injection in code-projects Online Food Order System 1.0 allows remote authenticated attackers to manipulate the `checkbox` parameter in delete_food_items1.php to inject arbitrary SQL into the backend database. A proof-of-concept exploit has been publicly published on GitHub, and the CVSS 4.0 score of 2.1 reflects bounded confidentiality, integrity, and availability impact limited to the application's data scope. No CISA KEV listing and no vendor patch have been identified; this appears to be a researcher-reported vulnerability in niche academic software with negligible enterprise deployment.
Cross-site scripting in code-projects Online Food Order System 1.0 allows authenticated remote attackers to inject malicious scripts via the dname parameter in edit_food_items.php. When a separate victim user views the manipulated food item entry, the injected script executes within their browser session. Publicly available exploit code exists per a GitHub proof-of-concept, though no active exploitation has been confirmed by CISA KEV.
Stored cross-site scripting in SourceCodester Online Book Store System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the System Settings Module at /admin/index.php?page=site_settings, which subsequently executes in the browser of any user who loads the affected settings page. A public proof-of-concept has been disclosed (CVSS 4.0 E:P modifier confirmed), though the CVSS 4.0 base score of 1.9 reflects the significant constraint of requiring prior administrative access. No active exploitation has been identified in CISA KEV, and no vendor-issued patch is confirmed at time of analysis.