Authorization bypass in Kubio AI Page Builder (WordPress plugin, all versions ≤2.8.5) enables any authenticated Contributor to overwrite front-page configuration options, rewrite primary navigation menus, replace template parts, and overwrite the plugin's global-data post. The plugin emits the AJAX nonce unconditionally into the JavaScript global window.kubioUtilsData for every user who can load the block editor - including Contributors - making the check_ajax_referer() call a non-functional authorization barrier. No public exploit identified at time of analysis, but the exploitation mechanism is fully documented in the Wordfence advisory and the vulnerable code paths are publicly visible in the WordPress plugin Trac repository.
Denial of service in OpenTofu's `tofu init` command allows an attacker who controls a provider or module registry to cause excessive CPU consumption on an operator's machine by serving a maliciously crafted `.zip` archive during dependency installation. All OpenTofu versions before 1.11.4 are affected; the root cause is a flaw in Go's standard library zip implementation, resolved in Go 1.25.6. No public exploit has been identified and this vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 appropriately reflects the high complexity and mandatory social engineering prerequisite.
Server-side template injection in OpenBoxes up to v0.9.6 allows authenticated low-privilege users to execute arbitrary Groovy code via the Zebra label template rendering endpoint. The root cause is that the original TemplateService passed user-controlled template content to GroovyPagesTemplateEngine, which evaluates ${...} placeholders as full Groovy expressions — enabling OS command execution and classloader traversal analogous to Spring4Shell. A public proof-of-concept is referenced in the NVD advisory; no active exploitation is confirmed in CISA KEV. The provided CVSS 4.0 score of 2.1 materially underestimates real-world risk for this vulnerability class.
Improper access controls in the gRPC Management Interface of SpaceX Starlink Router Gen 3 (firmware 2025.11.14.mr64708.3) permit adjacent-network attackers to invoke the get_status function without authentication, exposing router state information and enabling limited unauthorized modifications. Exploitation is constrained to the local network segment, but a public proof-of-concept exists (confirmed by CVSS 4.0 E:P modifier). SpaceX did not respond to coordinated disclosure, leaving no vendor-issued patch or official advisory as of the time of analysis.
SQL injection in the `cat_id` parameter of `/homeaction.php` in code-projects Online Shopping System 1.0 exposes the backend database to remote attackers holding low-privilege authenticated sessions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms low-complexity network exploitation with a public proof-of-concept documented on GitHub, lowering the skill bar for abuse. Successful exploitation yields limited read, write, and availability impact against the application's database; no public active exploitation (KEV) has been confirmed.
SQL injection in code-projects Online Shopping System 1.0 exposes the `/action.php` endpoint to database manipulation via the unsanitized `proId` parameter. Attackers with low-privilege application access can send crafted HTTP requests over the network to read, alter, or corrupt backend database contents - impacting confidentiality, integrity, and availability. Publicly available exploit code exists per the GitHub disclosure, significantly lowering the skill barrier for opportunistic attackers despite the low CVSS 4.0 base score of 2.1.
Out-of-bounds read in TrailDB 0.6 allows a remote attacker with low privileges to crash an application processing a crafted TrailDB file. The vulnerable code path is the TOC (Table of Contents) validation logic inside tdb_open() in /src/tdb.c, triggered when a maliciously formed TrailDB file is opened. Publicly available exploit code exists (CVSS 4.0 E:P); no KEV listing and no patch - the project has not responded to the coordinated disclosure filed via GitHub issue #149.