Command injection in Edimax EW-7478APC firmware 1.04 enables remote attackers with low-privilege access to execute arbitrary OS commands by supplying shell metacharacters in WAN credential fields (pppUserName, pptpUserName, or L2TPUserName) through the /goform/setWAN endpoint. A publicly available proof-of-concept exploit has been published, raising real-world exploitation risk despite the moderate CVSS score. No vendor patch exists - the vendor did not respond to the coordinated disclosure, leaving affected users without an official remediation path.
Command injection in Edimax EW-7478APC firmware 1.04 allows authenticated remote attackers to execute arbitrary OS commands by manipulating the `rootAPmac` parameter submitted to the `/goform/formWlbasic` CGI endpoint. A public proof-of-concept exploit has been disclosed via VulDB and a linked Notion page. The vendor did not respond to coordinated disclosure, leaving no patch available and the exposure window indefinite.
Server-side request forgery in graphlit-mcp-server 1.0.1 allows authenticated remote attackers to manipulate the url argument of the fetch function at the ssrf-test endpoint in src/tools.ts, causing the server to issue arbitrary outbound HTTP requests to attacker-controlled destinations including internal network resources. A public proof-of-concept exists via a GitHub issue report; the vendor has not responded to disclosure and no patch has been released. No public exploit indicates active widespread exploitation, but the POC lowers the technical barrier for abuse.
Stack-based buffer overflow in DefaultFuction's Customer-Relationship-Management-In-C-Project 2.0 exposes authenticated remote attackers to arbitrary code execution or application crash by supplying oversized input to the Customer Search Module's unsafe `gets()` call. A public proof-of-concept exploit is available on GitHub, and the project maintainer has acknowledged the issue is only 'being processed,' meaning no patch has been released. The vulnerability is not listed in CISA KEV, but the combination of network accessibility, low access complexity, and public exploit code makes it a credible risk in any environment running this software.
Improper privilege management in OpenBoxes up to 0.9.7 allows authenticated low-privileged users to escalate their roles by injecting unsanitized role parameters into the UserController's GORM data binding layer. The RoleInterceptor's needManager function additionally failed to enforce manager-level access on the user/show and user/edit endpoints, compounding the access control gap. A public proof-of-concept exploit is available; patched releases 0.9.8-hotfix1 and 0.9.8 are confirmed available from the vendor.
Server-side request forgery in OpenBoxes up to v0.9.7 allows authenticated remote attackers to coerce the application server into issuing HTTP requests to arbitrary internal or external URLs via the unvalidated `params.url` parameter in the Product Upload endpoint. The vulnerable code in `ProductController.groovy` passes the attacker-supplied URL directly to `new URL(params.url).openStream()` with no allowlist, blocklist, or scheme restriction - a textbook CWE-918 implementation flaw. A public proof-of-concept exploit exists on GitHub Gist, and the fix (removing the URL-based upload code path entirely) is available in v0.9.8 and v0.9.8-hotfix1; no CISA KEV listing at time of analysis.
LDAP injection in Dolibarr's User Cloning component (htdocs/user/card.php) through version 23.0.3 allows authenticated remote attackers to manipulate LDAP query logic by crafting the user ID argument. Any valid Dolibarr user with access to the User Cloning feature can exploit this without additional privileges or user interaction. A public exploit has been released on Google Drive, substantially lowering the barrier for abuse; no active exploitation is confirmed in CISA KEV at time of analysis.
Remote code injection in DefaultFuction Notice-System-Managent 2.0 allows low-privilege authenticated attackers to execute arbitrary Groovy code by sending crafted input to the /execute endpoint, which passes unsanitized values directly to GroovyShell.evaluate in NoticeController. A public proof-of-concept exploit is available via the project's GitHub issue tracker. The vulnerability is not yet in CISA KEV, but the combination of network accessibility (AV:N), a low authentication barrier (PR:L), and a live public POC substantially elevates real-world risk beyond what the CVSS 4.0 score of 5.3 conveys.
Code injection in iatsiuk pptr-mcp through version 0.2.7 enables authenticated remote attackers to execute arbitrary code via the `executeCode` function in `src/vm-executor.ts`, a component of the MCP `execute` tool. The underlying sandbox fails to isolate user-supplied input from the execution context, a class of vulnerability closely associated with Node.js `vm` module escapes. A publicly available proof-of-concept exists on GitHub, and the project maintainer has not responded to responsible disclosure, leaving all known deployments unpatched.
SQL injection in itsourcecode Hospital Management System 1.0 exposes the `/vieworder.php` endpoint to database manipulation via the unvalidated `delid` parameter, exploitable by authenticated remote attackers. A publicly available exploit has been disclosed on GitHub, raising the realistic likelihood of opportunistic exploitation against unpatched deployments. No CISA KEV listing is present, but the healthcare-sector context and public POC make this a meaningful remediation priority for any operator running this software.
SQL injection in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to manipulate the `total_count` parameter in `/checkout_process.php` to execute arbitrary SQL commands against the backend database. The CVSS 4.0 score is 5.3 (Medium) with partial confidentiality, integrity, and availability impact; no subsequent-system scope change is indicated. A public proof-of-concept exploit is available on GitHub, substantially lowering the bar for opportunistic exploitation - though the product's niche footprint limits broad real-world blast radius.
SQL injection in SourceCodester Stock Management System 1.0 exposes the `/classes/Master.php?f=delete_supplier` endpoint to database manipulation by authenticated high-privileged users. The `id` parameter is passed unsanitized to the backend SQL query, enabling an attacker to read, modify, or delete database records. A publicly available exploit exists on GitHub, though exploitation is bounded by the high-privilege authentication requirement and the CVSS 4.0 base score of 2.0 reflects limited real-world blast radius. No active exploitation (CISA KEV) has been confirmed.
Cross-site scripting in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to inject arbitrary JavaScript into victim browsers via the unsanitized `amount_1` parameter in `/checkout.php`, enabling session hijacking, credential theft, or UI manipulation against users who interact with the crafted response. The affected product is a PHP-based e-commerce application distributed by code-projects.org, with the vulnerability tracked exclusively through VulDB. A public proof-of-concept exploit has been released on GitHub, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.1 suggests in isolation.
Denial of service in OpenTofu's `tofu init` command allows an attacker who controls a provider or module registry to cause excessive CPU consumption on an operator's machine by serving a maliciously crafted `.zip` archive during dependency installation. All OpenTofu versions before 1.11.4 are affected; the root cause is a flaw in Go's standard library zip implementation, resolved in Go 1.25.6. No public exploit has been identified and this vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 appropriately reflects the high complexity and mandatory social engineering prerequisite.
Server-side template injection in OpenBoxes up to v0.9.6 allows authenticated low-privilege users to execute arbitrary Groovy code via the Zebra label template rendering endpoint. The root cause is that the original TemplateService passed user-controlled template content to GroovyPagesTemplateEngine, which evaluates ${...} placeholders as full Groovy expressions — enabling OS command execution and classloader traversal analogous to Spring4Shell. A public proof-of-concept is referenced in the NVD advisory; no active exploitation is confirmed in CISA KEV. The provided CVSS 4.0 score of 2.1 materially underestimates real-world risk for this vulnerability class.
Improper access controls in the gRPC Management Interface of SpaceX Starlink Router Gen 3 (firmware 2025.11.14.mr64708.3) permit adjacent-network attackers to invoke the get_status function without authentication, exposing router state information and enabling limited unauthorized modifications. Exploitation is constrained to the local network segment, but a public proof-of-concept exists (confirmed by CVSS 4.0 E:P modifier). SpaceX did not respond to coordinated disclosure, leaving no vendor-issued patch or official advisory as of the time of analysis.
SQL injection in the `cat_id` parameter of `/homeaction.php` in code-projects Online Shopping System 1.0 exposes the backend database to remote attackers holding low-privilege authenticated sessions. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms low-complexity network exploitation with a public proof-of-concept documented on GitHub, lowering the skill bar for abuse. Successful exploitation yields limited read, write, and availability impact against the application's database; no public active exploitation (KEV) has been confirmed.
SQL injection in code-projects Online Shopping System 1.0 exposes the `/action.php` endpoint to database manipulation via the unsanitized `proId` parameter. Attackers with low-privilege application access can send crafted HTTP requests over the network to read, alter, or corrupt backend database contents - impacting confidentiality, integrity, and availability. Publicly available exploit code exists per the GitHub disclosure, significantly lowering the skill barrier for opportunistic attackers despite the low CVSS 4.0 base score of 2.1.
Out-of-bounds read in TrailDB 0.6 allows a remote attacker with low privileges to crash an application processing a crafted TrailDB file. The vulnerable code path is the TOC (Table of Contents) validation logic inside tdb_open() in /src/tdb.c, triggered when a maliciously formed TrailDB file is opened. Publicly available exploit code exists (CVSS 4.0 E:P); no KEV listing and no patch - the project has not responded to the coordinated disclosure filed via GitHub issue #149.