Authentication bypass in Tenda AC10 firmware 16.03.10.09_multi_TDE01 allows unauthenticated remote attackers to circumvent the httpd web management interface's access controls via manipulation of the R7WebsSecurityHandler function. The vulnerability carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact against the vulnerable system. A publicly available proof-of-concept exploit has been published on GitHub, materially lowering the exploitation barrier and enabling opportunistic mass-targeting of exposed devices.
Stack-based buffer overflow in Edimax EW-7478APC wireless access point firmware 1.04 enables remote code execution against the device by submitting an oversized PPPoE username to the WAN configuration endpoint. Low-privilege authenticated attackers with network access to the management interface can exploit the `pppUserName` parameter in `/goform/formWanTcpipSetup` to overwrite stack memory and gain arbitrary code execution on the device. A public proof-of-concept exploit exists; the vendor did not respond to responsible disclosure, leaving the device with no available patch.
Customer-uploaded file disclosure in Extra Product Options Builder for WooCommerce (all versions before 1.2.176) allows unauthenticated requesters who know a file's stored name to retrieve it via an unprotected plugin endpoint, bypassing a missing authorization check (CWE-862). The real-world severity is conditional on web server type: the plugin writes deny-all rules to upload directories, meaning this endpoint only crosses a new security boundary on Apache-hosted sites; on default nginx deployments, those files are already directly URL-accessible and the endpoint adds no measurable additional exposure. Publicly available exploit code exists, but no public exploit identified at time of analysis confirms active exploitation, and EPSS sits at 0.22% (12th percentile) despite the elevated CVSS score.
Unauthenticated information disclosure in CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 exposes media attachment metadata - including titles, file types, sizes, and direct URLs - from any configured folder, including those never published to a gallery. The missing authorization checks on REST API endpoints mean any external party can enumerate private document libraries without credentials. A publicly available exploit exists per WPScan, though EPSS sits at just 0.17% (7th percentile), suggesting limited observed exploitation activity at time of analysis.
SQL injection in WP Directory Kit WordPress plugin before 1.5.7 is exploitable by authenticated administrators, with materially elevated impact on WordPress multisite networks where a single-site admin can read data belonging to the entire network - data outside their authorized scope. A public PoC is available via WPScan, though EPSS sits at 0.17% (6th percentile), indicating targeted rather than opportunistic exploitation. No CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
Privilege escalation in the All-in-One WP Migration and Backup WordPress plugin (versions prior to 7.108) on multisite installations allows subsite administrators to execute arbitrary PHP code across the entire WordPress network. The vulnerability stems from missing access control enforcement on the migration import feature, which should be restricted to network-level administrators but is accessible to lower-privileged subsite admins. A publicly available exploit exists per WPScan and SSVC classification; however, EPSS sits at only 0.14% (4th percentile), and CISA KEV does not list this as actively exploited at time of analysis.
Arbitrary file deletion leading to remote code execution in the Podlove Podcast Publisher WordPress plugin (all versions through 4.5.3) allows authenticated contributors to destroy critical server files and fully compromise the WordPress installation. The root cause is a PHP deserialization flaw in the shownotes REST API that activates a native POP chain via GenerationGuard::__destruct(), invoking wp_delete_file() on an attacker-controlled path - enabling deletion of wp-config.php to force WordPress into reinstallation mode. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the POP chain is explicitly mapped in the CVE with source code references, indicating high confidence in exploitability.
Remote code execution in the Query Wrangler WordPress plugin affects all versions up to and including 1.5.57, allowing any authenticated subscriber-level user to invoke arbitrary PHP callables on the server. The vulnerability combines a missing capability check and absent nonce verification on the wp_ajax_qw_form_ajax AJAX handler with unsanitized attacker-controlled input passed directly to call_user_func_array(), making the only barrier a trivially satisfied function_exists() check. No public exploit has been identified at time of analysis and the vulnerability is not confirmed in CISA KEV, but the low privilege requirement and straightforward exploitation path make this a critical patching priority for any WordPress site running the affected plugin.
Server-Side Request Forgery in Royal Elementor Addons for WordPress (versions ≤1.7.1064) allows authenticated Contributor-level users to persistently configure a malicious webhook URL via the Form Builder widget, which is then dispatched by an AJAX handler registered for both authenticated and unauthenticated callers - meaning the trigger phase requires no authentication at all. The root flaw is that wp_remote_post() is invoked on the stored URL with no host allowlist, no scheme restriction, and no private/loopback IP filtering, despite the plugin containing wpr_is_blocked_remote_host and wpr_is_private_or_local_ip helpers that are simply not called on this code path. No public exploit or CISA KEV listing has been identified at time of analysis.
Scriban template engine versions 3.0.0 through 7.2.5 expose any application accepting untrusted templates to complete CPU exhaustion and garbage collection collapse via crafted array-multiplication expressions. The ScriptArray.Multiply operator fails to credit iterations against the caller-configured LoopLimit, rendering the safety mechanism entirely ineffective on this code path - even LoopLimit=1 provides no protection against the bypass. Vendor patches are available as two upstream commits referenced in GitHub security advisory GHSA-89cf-6hmv-8rxm, with no active exploitation confirmed at time of analysis.
Uncontrolled resource consumption in Scriban's .NET templating engine allows any party who can submit template input to bypass the LoopLimit safety control and exhaust CPU or memory on the host process. Versions 0 through 6.6.0 of the nuget/scriban and nuget/Scriban.Signed packages are affected; the root cause is that LoopLimit enforcement is coupled exclusively to script-level loop statements and is never invoked by built-in operators such as the range constructor or string multiplication. A working proof-of-concept is publicly available in the GitHub Security Advisory GHSA-c875-h985-hvrc, making exploitation trivially reproducible for any application that renders attacker-controlled templates; no public exploit identified at time of analysis for CISA KEV status.
Remote denial of service in Scriban before 6.6.0 allows unauthenticated attackers to crash the entire .NET hosting process by submitting deeply nested template expressions to the recursive-descent parser. Because the ExpressionDepthLimit property in ParserOptions defaults to null (disabled), an attacker can supply thousands of nested parentheses or blocks that exhaust thread stack space, triggering a StackOverflowException - which .NET cannot intercept - causing immediate, unrecoverable process termination. A proof-of-concept is publicly documented in the vendor's GitHub Security Advisory GHSA-wgh7-7m3c-fx25; no authentication is required, and the fix is available in version 6.6.0.
Process-terminating stack overflow in Scriban's template parser affects all versions before 7.0.0, allowing any attacker who can supply content to Template.Parse to crash the hosting .NET application via an uncatchable StackOverflowException. The flaw exploits a recursion path (ParseArrayInitializer → ParseExpression → ParseArrayInitializer) that is structurally separate from the ExpressionDepthLimit guard introduced in the prior fix for GHSA-wgh7-7m3c-fx25, meaning teams who applied that earlier patch retain a false sense of protection and remain fully vulnerable. A proof-of-concept is publicly available in the GitHub Security Advisory; no confirmed active exploitation appears in the CISA KEV catalog at time of analysis.
Scriban's template rendering engine before version 6.6.0 crashes the entire .NET hosting process when object graphs containing circular references are passed to the template context, because the ObjectRecursionLimit property defaults to 0 (unlimited) rather than a bounded safe value. Any endpoint that maps user-controlled input - such as a JSON request body or ORM entity graph - to a Scriban TemplateContext is susceptible to complete process termination with no authentication required (CVSS 4.0 AV:N/AC:L/PR:N). No public exploit or CISA KEV listing has been identified at time of analysis; however, a proof-of-concept is published in GitHub Security Advisory GHSA-grr9-747v-xvcp.
Uncontrolled memory allocation in Scriban's string.pad_left and string.pad_right template functions enables unauthenticated remote denial of service against any application that exposes Scriban to attacker-controlled template input. All NuGet releases of scriban and scriban.Signed prior to 7.0.0 are affected, with a publicly documented 39-byte proof-of-concept payload capable of forcing ~1GB synchronous allocations per request, crashing the host process via OutOfMemoryException. No active exploitation has been confirmed in CISA KEV at time of analysis, but the trivial PoC and zero-complexity attack lower the effective risk bar significantly for exposed deployments.
Uncontrolled recursion in Scriban's `object.to_json` builtin allows any attacker who can submit template content to fatally terminate the hosting .NET process. The internal `WriteValue()` serialization function (ObjectFunctions.cs:494) recurses through object members and arrays without depth limits or circular reference detection - bypassing the `ObjectRecursionLimit`, `EnterRecursive()`, and `EnsureSufficientExecutionStack()` guards used everywhere else in Scriban. Because `StackOverflowException` is unrecoverable in .NET, a single crafted template request causes immediate, irreversible process death. No public exploit or CISA KEV listing identified at time of analysis; vendor-confirmed fix is available in version 7.0.0.
Process-terminating denial-of-service in Scriban 6.6.0-7.2.0 allows any network-reachable attacker to crash a host .NET application by submitting a crafted template containing deeply nested parentheses, array initializers, object initializers, or unary operators. The `ExpressionDepthLimit` parser guard is structurally non-enforcing: it logs a non-fatal error and sets a flag but never halts recursive descent, allowing the call stack to exhaust until an uncatchable `StackOverflowException` terminates the process - roughly achievable with an 8 KB payload. This is a regression that re-opens two previously reported 'fixed' advisories (GHSA-wgh7-7m3c-fx25, fixed in 6.6.0; GHSA-p6q4-fgr8-vx4p, fixed in 7.0.0), confirming both prior fixes are incomplete; no public exploit or KEV listing exists at time of analysis.
Resource exhaustion in Scriban 3.0.0 through 7.2.0 allows unauthenticated remote attackers to force multi-gigabyte memory allocations using a ~40-byte template containing the array multiplication operator. The flaw is an overlooked sibling of operations hardened in prior releases: `string * integer` and `array.insert_at` received LoopLimit guards in versions 7.0.0 and 7.2.0, but `array * integer` in `ScriptArray<T>.TryEvaluate` was never subjected to those checks. The vendor-released fix is available in Scriban 7.2.1 and Scriban.Signed 7.2.1; no public exploit identified at time of analysis.
Memory exhaustion denial of service in stoatchat before 0.15.0 allows unauthenticated remote attackers to crash the service by submitting concurrent proxy requests referencing attacker-hosted SVGs with arbitrarily large viewBox width and height values. The proxy endpoint allocates memory proportional to declared SVG dimensions without enforcing any upper bound (CWE-400), and concurrent exploitation amplifies impact across all running replicas simultaneously. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects the high availability impact with no confidentiality or integrity component.
Unbounded memory allocation in Scriban's `array.insert_at` built-in function allows any template author to crash the host process with a single template call. Affected are all releases of the nuget/scriban and nuget/Scriban.Signed packages up to and including version 7.1.0. By supplying a sufficiently large index parameter, an attacker triggers a tight C# fill loop that allocates hundreds of millions of null entries, causing an `OutOfMemoryException` that terminates the host process in under a second - bypassing all existing safety controls including `LoopLimit` and `LimitToString`. A public proof-of-concept template is documented in the vendor's GHSA advisory; no CISA KEV listing has been issued at the time of analysis.
Remote buffer overflow in Edimax EW-7478APC firmware 1.04 allows network-authenticated attackers to corrupt memory via the selSSID argument in the formWlSiteSurvey handler, with potential for arbitrary code execution on both the vulnerable device and downstream systems. The CVSS 4.0 vector scores this at 8.6 with full high-impact triad across both vulnerable and subsequent systems, reflecting the embedded device context where exploitation typically yields root-level access. A public exploit exists (CVSS 4.0 E:P confirmed), and the vendor has not responded to coordinated disclosure, meaning no patch is available or expected in the near term.
Unauthenticated PII exposure in WP Travel Engine (WordPress plugin, all versions ≤ 6.8.4) allows any visitor to retrieve private customer booking details - including full name, email, street address, city, and phone number - by supplying an arbitrary booking ID to the checkout endpoint. The plugin's only access control on the affected AJAX handler is a frontend nonce broadcast publicly to all visitors via the wteL10n JavaScript global, meaning it functions solely as a CSRF token and does not gate unauthenticated access. No public exploit code has been identified at time of analysis, but the attack is mechanically trivial and requires no prior account or privileges.
Remote code execution in the WCPOS Point of Sale plugin for WordPress/WooCommerce (all versions through 1.9.14) allows authenticated Shop Manager-level users to inject and execute arbitrary PHP on the server. The flaw lies in Receipt_Renderer_Factory incorrectly routing 'thermal' engine templates to Legacy_Php_Renderer, which writes attacker-controlled content to a temporary file and executes it via PHP's include(). No public exploit or CISA KEV listing identified at time of analysis; however, full server compromise is achievable by any user holding the manage_woocommerce_pos capability.
Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enables unauthenticated remote attackers to inject persistent JavaScript via the bookly_speed_up_update_addons AJAX endpoint, with payloads stored verbatim in the bookly_log.details database column and executing in administrator browser sessions when they navigate to the Diagnostics → Logs page. The injection point is registered under the wp_ajax_nopriv_* hook prefix, making it reachable without any authentication via the standard WordPress AJAX endpoint; the error-logging code path in lib/PluginsUpdater.php writes attacker-controlled input directly to the database when a request is submitted without a valid signature. No public exploit code or CISA KEV listing has been confirmed at time of analysis, though the zero-barrier injection path combined with privileged execution context represents a realistic and impactful threat to any active Bookly installation.
SQL injection in the Gallery by BestWebSoft WordPress plugin (all versions through 4.7.9) allows Editor-level or higher authenticated attackers to exfiltrate or manipulate the entire WordPress database by injecting arbitrary SQL via crafted array key names in the `_gallery_order_{post_id}` POST parameter. The `gllr_save_postdata()` function writes these unsanitized array keys directly into post meta without escaping or prepared statements, and downstream SQL queries consume them verbatim. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored XSS in the Autopay (Platnosci Online Blue Media) WordPress plugin through version 5.0.0 permits unauthenticated remote attackers to permanently inject arbitrary JavaScript into the WooCommerce checkout page by sending a single crafted POST request targeting the bm_woocommerce_css_editor_content parameter. The plugin's CSS editor save handler is registered on WordPress's 'init' hook with no capability check, no nonce verification, and no input sanitization, causing raw attacker-controlled content to be persisted in the WordPress options table and rendered unescaped inside a style block on every subsequent checkout page load. No public exploit has been identified at time of analysis and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the unauthenticated write path combined with persistent execution on a high-value payment page represents a credible payment-skimming threat vector.
Stored Cross-Site Scripting in the Infility Global WordPress plugin (versions ≤ 2.15.21) allows unauthenticated remote attackers to inject persistent malicious scripts via the /cf7_record log endpoint, which then execute in the browsers of any authenticated WordPress user who accesses the /cf7_records viewer - including those with only Subscriber-level access. Reported by Wordfence with source-code references corroborating the unsanitized input and unescaped output in InfilityGlobalErrorRecord.php; no public exploit code or CISA KEV listing has been confirmed at time of analysis. The CVSS 7.2 rating reflects a changed-scope attack: the unauthenticated submission context crosses into authenticated user sessions, amplifying impact beyond a typical stored XSS.
Denial of service in Scriban's .NET template engine (all versions before 7.0.0) allows low-privileged attackers who can supply templates to exhaust host application memory and crash the process. By rendering a string just under the 1MB LimitToString default inside a template loop, each iteration resets the per-call length counter in ObjectToString while the underlying StringBuilderOutput appends to a StringBuilder with no cumulative size guard - enabling ~1GB of allocation across 1,000 loop iterations. No public exploit tool has been separately released, but the GitHub security advisory (GHSA-m2p3-hwv5-xpqw) contains full source-level reproduction detail sufficient to implement the attack without further research.
Three distinct denial-of-service vulnerabilities in Scriban's expression evaluator (all versions before 7.0.0) allow any low-privileged attacker who can supply templates to exhaust host process memory or CPU, typically crashing the entire .NET application. The flaws are particularly deceptive because they bypass Scriban's own built-in safety controls - LimitToString and LoopLimit - through unbounded string multiplication, uncapped BigInteger left-shift operations, and lazy range enumeration passed to builtin functions, giving developers a false sense of protection. No public exploit has been identified at time of analysis, but the GHSA advisory provides full source-code-level disclosure of all three code paths with file and line references.
Permission bypass in stoatchat before 0.15.0 allows authenticated users holding only ViewChannel access to read individual message content through the message_fetch route, circumventing the ReadMessageHistory restriction that bulk read routes correctly enforce. Organizations that deliberately deny ReadMessageHistory to specific users or roles - intending to block historical message access - are exposed because the single-message fetch path uses a weaker authorization check. No public exploit code has been identified and the product is not listed in CISA KEV, but the authorization inconsistency is straightforward to exploit for any actor already authenticated to the platform.
IV race condition in the Linux kernel's AF_ALG skcipher interface allows local unprivileged users to inject attacker-controlled initialization vectors into in-flight AIO cryptographic operations. For CTR and CBC modes, IV reuse enables keystream derivation and plaintext recovery of concurrent cipher operations sharing the same AF_ALG socket. No public exploit has been identified at time of analysis; patches are confirmed available across all major stable kernel branches (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, 7.2-rc1).
OpenTofu's provider cache installer in all versions before 1.11.7 (and 1.10.x before 1.10.10) writes provider package contents to arbitrary filesystem locations when a malicious symlink is pre-positioned inside the .terraform/providers directory, allowing files controlled by the attacker to be placed anywhere the OpenTofu process has write permission. If an attacker can control the contents of a working directory — for instance through a malicious git repository, shared filesystem, or coerced developer workflow — they can include a crafted symlink pointing to a sensitive path outside the working tree, and a subsequent `tofu init` will follow that symlink and overwrite its target with attacker-supplied provider package content. No public exploit has been identified at time of analysis and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog; vendor-released patches for both active release branches are available.