Cross-site scripting in the Templately WordPress plugin (versions ≤ 3.7.1) enables unauthenticated remote attackers to inject arbitrary JavaScript that executes in victim browsers upon user interaction, with scope change indicating cross-context impact. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and that injected scripts escape the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious content injection. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available at version 6.2.12.
Reflected Cross-Site Scripting in the Mayosis Core WordPress plugin (versions 5.4.7 and earlier) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking authenticated WordPress users into clicking a crafted URL. The CVSS Scope Change (S:C) indicator confirms the injected script escapes the plugin's context, enabling session hijacking, credential theft, or malicious redirects targeting site administrators or editors. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Reflected Cross-Site Scripting in the SSL Zen WordPress plugin (versions 4.7.43 and earlier) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of authenticated WordPress users who interact with a crafted URL. The Scope:Changed CVSS metric confirms the injected script executes outside the plugin's own trust boundary, making admin session hijacking and site takeover realistic outcomes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Quill Forms WordPress plugin version 5.7.1 and earlier allows remote attackers without any credentials to inject malicious scripts into pages rendered by the plugin. Because the CVSS vector indicates a scope change (S:C), successful exploitation can affect the browser session of authenticated users - including site administrators - who view attacker-controlled content. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Improper access control in Oracle Hyperion Data Relationship Management 11.2.25.0.000 enables a local attacker to bypass application-level authentication and gain full read and write access to all DRM-managed data. The affected component is the Access and Security module (CWE-284), meaning the flaw sits at the authorization enforcement layer rather than in data processing logic. No public exploit or active exploitation is confirmed; SSVC rates technical impact as total, making successful compromise highly damaging despite the local attack vector requirement.
Local authentication bypass in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows any user with OS-level logon access to the hosting infrastructure to read all data managed by the Content Server component without Oracle application credentials. The scope change designation (S:C in the CVSS vector) indicates successful exploitation may further compromise additional Oracle Fusion Middleware products co-located on the same host. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Local authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables a low-privileged OS-level attacker to gain full read and write access to all data accessible by the Hyperion platform. The flaw resides in the Installation and Configuration component, where access controls can be circumvented without requiring elevated system privileges or user interaction. No active exploitation has been confirmed (not in CISA KEV), and no public proof-of-concept code has been identified at time of analysis.
Local authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 enables a low-privileged attacker with infrastructure logon to read and modify all application-accessible financial data. The CVSS 7.1 score reflects high confidentiality and integrity impact with no availability disruption, constrained entirely to the local attack surface. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Local data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables a low-privileged local OS user to fully breach confidentiality and integrity of all data accessible to the Hyperion platform via a flaw in the Installation and Configuration component. Tagged as an authentication bypass, the vulnerability suggests internal Hyperion access controls fail to restrict a minimally-privileged local account from accessing or manipulating critical data beyond its authorization. No public exploit code or CISA KEV listing has been identified at time of analysis.
Code injection in Vim prior to 9.2.0845 enables arbitrary operating-system command execution by an attacker who can supply a malicious ctags-format tags file. The StructMembers() function in ccomplete.vim embeds typeref: and typename: field values from that tags file into a dynamically constructed vimgrep pattern using escaping that only covers '/' and '\', leaving regex metacharacters such as '[' active; an unclosed bracket breaks Vim's pattern parser, causing the remainder of the tag value to be interpreted as Ex commands where '|' acts as a command separator. Exploitation requires the victim to actively invoke C omni-completion (CTRL-X CTRL-O) while editing a C file referencing the malicious tags entry; no public exploit is identified at time of analysis, though the fix commit's test suite embeds a working proof-of-concept payload, substantially lowering the barrier to weaponization.
Oracle E-Business Tax versions 12.2.3 through 12.2.15 allows a low-privileged local attacker to compromise data integrity and trigger a repeatable denial-of-service condition in the Internal Operations component. Successful exploitation enables unauthorized creation, deletion, or modification of critical tax data, and can cause the application to hang or crash completely, disrupting core business tax processing workflows. No public exploit has been identified at time of analysis, though the low complexity and low privilege requirements make this an accessible target for any authenticated local user on the affected infrastructure.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated local attacker - one with OS-level logon to the host infrastructure but no Oracle application credentials - to compromise the Security component and gain complete unauthorized read access to all data accessible by Hyperion Calculation Manager. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to impact additional Oracle products co-hosted on the same infrastructure. No public exploit has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Unauthorized data access and integrity compromise in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a local attacker holding low-privilege infrastructure credentials to fully circumvent application-level access controls, yielding complete read and write access to all DRM-managed master data. The vulnerability resides in the Access and security component and is tagged as an Authentication Bypass, suggesting internal authorization enforcement fails once basic OS-level access to the host is obtained. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a local privilege abuse path in its Installation and Configuration component, enabling a low-privileged authenticated user with system logon to gain unauthorized read and write access to all critical Hyperion data. The CVSS 3.1 score of 7.1 (High) reflects high confidentiality and integrity impacts, though the local attack vector constrains the attacker pool to insiders or those with pre-existing system access. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Path traversal via unsanitized cluster node names in Wazuh Manager 4.0.0 through 4.14.5 enables authenticated cluster peers to delete arbitrary directory contents on the master node. An attacker holding a valid cluster Fernet key can supply a traversal-shaped node name (e.g., '../../etc') in the cluster hello handshake, then disconnect - causing the master's peer cleanup routine to recursively remove the contents of directories outside the intended cluster queue path, writable by the wazuh user. No public exploit has been identified at time of analysis, and a vendor patch is available in 4.14.6.
Path traversal in Wazuh Manager 4.0.0 through 4.14.5 allows unauthenticated remote attackers to destroy the manager's queue directory structure and halt all Wazuh services by registering an agent whose name begins with a dot (e.g., ".."). Two compounding weaknesses drive the impact: OS_IsValidName() failed to reject dot-prefixed agent names, and delete_diff() performs unsafe path concatenation that resolves the traversal sequence to the parent queue directory, wiping its subdirectories. Recovery requires manual intervention, creating a complete and sustained loss of SIEM and XDR visibility. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized data modification, partial denial of service, and limited data exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 are achievable by unauthenticated remote attackers over HTTP targeting the Security component. The CVSS 3.1 score of 7.0 reflects high integrity impact - attackers can create, delete, or modify critical EPM data - tempered by high attack complexity (AC:H) that prevents trivial automated exploitation. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local-access vulnerability in its Security component that allows an unauthenticated local attacker to achieve full system takeover - compromising confidentiality, integrity, and availability - when combined with required interaction from a separate legitimate user. The attack is constrained to actors with logon access to the infrastructure hosting HFM and requires high complexity to execute, limiting the realistic threat population to insiders or those who have already established a foothold on the target server. No public exploit code has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Full takeover of Oracle Work in Process (WIP), a manufacturing execution module in Oracle E-Business Suite, is achievable by a low-privileged local attacker exploiting a flaw in the Internal Operations component across versions 12.2.3 through 12.2.15. The CVSS vector (AV:L/AC:H/PR:L) constrains exploitation to authenticated infrastructure-level access with high attack complexity, significantly limiting opportunistic or remote attack paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete compromise of confidentiality, integrity, and availability of the WIP instance.
Local privilege escalation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 enables a low-privileged attacker with infrastructure logon access to achieve full system takeover via the Tuxedo middleware component. The CVSS vector (AV:L/AC:H/PR:L) confirms this requires physical or session-level access to the host and involves high attack complexity, materially limiting opportunistic exploitation despite the complete CIA impact. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via its August 2026 Critical Security Patch Update.
Local privilege escalation in Oracle Agile PLM 9.3.6 via the Gantt Chart component allows a low-privileged attacker with existing logon access to the host infrastructure to fully compromise the application. Successful exploitation results in complete confidentiality, integrity, and availability impact - effectively a full system takeover of the PLM instance. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation is constrained by both a local attack vector and high attack complexity (CVSS AV:L/AC:H/PR:L).
Full system takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a low-privileged local attacker through the Content Acquisition System component. Exploitation requires physical or logical access to the host infrastructure combined with high attack complexity, constraining the realistic threat to insider actors or adversaries who have already established a foothold on the target server. No public exploit code has been identified and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 allows a low-privileged attacker with local logon access to the host infrastructure to fully compromise the application, achieving confidentiality, integrity, and availability takeover. The attack complexity is rated high, indicating non-trivial exploitation conditions must be met. No public exploit or active exploitation has been identified at time of analysis, but full system takeover is the confirmed impact per Oracle's advisory.
Local privilege escalation in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the system via the Engineering Communication Interface component. Exploitation requires high-complexity conditions and local access, but successful attacks result in complete takeover - full loss of confidentiality, integrity, and availability. Disclosed through Oracle's Critical Security Patch Update for August 2026; no public exploit identified at time of analysis.
Path traversal via unsanitized plugin identifier in MineAdmin's app-store service enables any authenticated user to read directory existence outside the plugin root, trigger Plugin::install() and Plugin::uninstall() on arbitrary filesystem paths, and potentially execute arbitrary Composer commands. Affected versions are all releases of composer/mineadmin/mineadmin prior to v3.2.0-alpha.2. Compounded by a missing PermissionMiddleware on the plugin store controller (GM-4340), any bearer-token holder - not just administrators - can reach the vulnerable endpoints. A proof-of-concept is publicly available and the vulnerability has been reproduced in a Docker environment.