Stored Cross-Site Scripting in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (≤4.3.9) is exploitable by any authenticated subscriber-level WordPress user, allowing injection of persistent JavaScript that executes when a higher-privileged user such as an administrator views the affected content. The scope-changed CVSS metric (S:C) reflects the real danger: a successful payload can hijack an admin session, modify site content, or silently escalate attacker privileges. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Stored Cross-Site Scripting in WP Tab Widget (WordPress plugin by MyThemeShop) allows authenticated contributors to inject persistent malicious scripts into tab widget content that execute in the browsers of other site users, including administrators. All versions up to and including 1.2.11 are confirmed affected per Patchstack and ENISA EUVD-2026-60930. The CVSS scope change metric (S:C) elevates the practical impact beyond the contributor's own session, enabling privilege escalation paths such as admin cookie theft. No public exploit identified at time of analysis.
Stored Cross-Site Scripting in the WordPress Table Of Contents Block plugin (versions up to and including 1.5.0) allows authenticated users with at least Contributor-level access to inject arbitrary JavaScript into post content via the block editor. Because the CVSS vector carries a changed scope (S:C), the injected payload executes in the browser context of any user - including administrators - who views the affected page, enabling session hijacking or privilege escalation. No public exploit code or CISA KEV listing is present in the available data, but the low attack complexity and broad administrator victim surface make this a meaningful risk for multi-author WordPress deployments.
Stored Cross-Site Scripting in the Wufoo Shortcode WordPress plugin (versions 1.55 and earlier) allows authenticated Contributor-level users to inject persistent malicious JavaScript through the plugin's shortcode functionality. When a higher-privileged user - typically an administrator or editor - views the affected post or page, the script executes in their browser session, crossing the security boundary established by WordPress role separation. No public exploit code or active exploitation has been identified at time of analysis; however, the CVSS Scope:Changed metric confirms the impact extends beyond the contributor's own session.
Stored Cross-Site Scripting in the Login With Ajax WordPress plugin version 4.5.1 and earlier allows authenticated contributors to inject malicious scripts that execute in the browsers of higher-privileged users who view the affected content. The vulnerability carries a CVSS 3.1 score of 6.5 with scope change, meaning successful exploitation crosses the plugin's security boundary into the victim's browser session, enabling session token theft or unauthorized action execution. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and broad availability of the WordPress ecosystem make this a credible threat for sites with open contributor registration.
Stored Cross-Site Scripting in WPZOOM Forms - Contact Form Plugin for Gutenberg versions up to and including 2.0.4 allows authenticated Contributors to inject malicious JavaScript that executes in the browsers of higher-privileged users such as site administrators. The vulnerability stems from insufficient sanitization or escaping of user-supplied input before it is rendered in WordPress pages, a CWE-79 root cause confirmed by Patchstack and the ENISA EUVD entry EUVD-2026-60924. No public exploit identified at time of analysis and the flaw is absent from the CISA KEV catalog, but the Contributor-to-Administrator privilege escalation path makes this a meaningful risk on any multi-author WordPress deployment.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) enables contributor-level authenticated users to inject persistent malicious scripts through frontend-rendered forms. When a higher-privileged user such as an administrator subsequently views the affected content, the payload executes in their browser session, potentially enabling session hijacking, unauthorized administrative actions, or credential theft. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis, though the low-privilege entry point makes this a realistic and practical threat in multi-author WordPress environments.
Stored Cross-Site Scripting in the Wise Chat WordPress plugin (versions <= 3.4) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browser context of other site users, including administrators. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) confirms this is network-exploitable at low complexity, requiring only contributor-level WordPress access and a victim loading the poisoned chat interface. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated authentication bypass in the Contact Form by Supsystic WordPress plugin (versions before 1.10.0) exposes restricted plugin functionality to any remote attacker without credentials. CWE-288 indicates the plugin fails to enforce authentication through an alternate path or channel, allowing unauthorized access to operations that should require valid user context. No active exploitation confirmed by CISA KEV; patch is available as of version 1.10.0 per Patchstack and EUVD reporting.
Unauthorized data access and modification is possible in Oracle Helidon 4.5.1 via a flaw in its Imperative Web Server component, classified under the Authentication Bypass tag. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that unauthenticated remote attackers can exploit this over HTTP with no user interaction and low attack complexity. Successful exploitation results in partial confidentiality and integrity compromise of Helidon-accessible data; no patch version has been independently confirmed beyond the Oracle August 2026 CPU advisory.
Unauthorized data access in Oracle Helidon 4.5.0's Imperative Web Server component allows unauthenticated network attackers to read a subset of application-accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability, tagged as an Authentication Bypass by Oracle, is remotely exploitable without credentials or user interaction against the affected version. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and absence of authentication requirements make this straightforward to exploit once a target instance is identified.
Information disclosure in Firefox's Graphics: Text rendering component allows a remote unauthenticated attacker to leak sensitive memory contents when a user visits or interacts with crafted content. All Firefox release channels are affected, spanning the main release (pre-154) and three ESR branches (pre-115.39, pre-140.14, pre-153.1). No public exploit code exists and EPSS exploitation probability sits at just 0.20% (10th percentile), suggesting low real-world exploitation activity despite the high confidentiality impact scored by CVSS.
Broken access control in GiveWP versions prior to 4.16.6 exposes unauthenticated network attackers to partial read and write access over donation-related functionality, bypassing authorization entirely due to missing capability checks (CWE-862). Reported by Patchstack and tracked under EUVD-2026-60776, the flaw affects all installs of the Nexcess GiveWP WordPress plugin below the patched release. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 4.16.6.
Broken access control in the MultiVendorX WordPress plugin (versions ≤ 5.0.14) allows unauthenticated remote attackers to bypass authorization checks and perform actions or access data restricted to authorized users. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction, making it trivially reachable from the network against any WordPress/WooCommerce site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-site request forgery in MobSF prior to 4.5.1 enables a remote attacker to perform destructive authenticated actions - including scan deletion, password changes, user creation/deletion, and file upload/download - against a logged-in victim's instance. The root cause is a Django migration regression: CsrfViewMiddleware was left in the deprecated MIDDLEWARE_CLASSES setting (ignored since Django 2.0) and never added to the active MIDDLEWARE tuple, leaving all POST endpoints unprotected. A working proof-of-concept is confirmed by the GHSA advisory reporter, who demonstrated complete scan deletion via a plain curl command using only a session cookie - no CSRF token required.
Unauthenticated confidentiality exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 permits any attacker with access to the same physical network segment to obtain complete read access to all data the application can access, including sensitive financial planning and business rule data. The authentication bypass (tagged explicitly by Oracle) requires no credentials and no user interaction, making it trivially exploitable by any host co-resident on the adjacent LAN or VLAN. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthenticated sensitive information disclosure in SJRC F11 SJ-GPS-PRO GPS drone firmware (build 2019-09-17) exposes device data to any adjacent-network attacker via an inetd service that performs no credential validation. The root cause is CWE-306 (Missing Authentication for Critical Function): the inetd service accepts connections and returns sensitive information without requiring any authentication, matching the Authentication Bypass tag. No public exploit code has been confirmed absent, as a researcher-published GitHub advisory with a dedicated CVE advisory document exists, indicating public documentation of the attack method. No active exploitation has been confirmed by CISA KEV at the time of this analysis.
Clickjacking in Firefox for Android before version 154 allows remote unauthenticated attackers to overlay transparent or opaque UI frames over legitimate browser content, capturing user interactions intended for other elements. The CVSS vector (PR:N, UI:R, I:H) indicates no privileges are needed but a victim must interact with an attacker-controlled page, resulting in high-integrity impact through unintended user actions such as inadvertent permission grants or form submissions. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
JIT miscompilation in Firefox's SpiderMonkey JavaScript engine exposes sensitive memory to remote attackers via crafted web content. The CWE-843 (type confusion) root cause means the JIT compiler generates native code that accesses a JavaScript value as the wrong type, resulting in a high-confidentiality information disclosure. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the Media Library Assistant WordPress plugin (versions through 3.39) allows authenticated low-privileged users to inject persistent malicious scripts that execute in the browsers of other users - including administrators - who subsequently view affected media library pages. The Changed scope (S:C) in the CVSS vector confirms the payload escapes the plugin context and can affect the broader WordPress admin interface. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and low privilege requirement make it straightforward to exploit once authenticated. Reported by Patchstack (ENISA EUVD-2026-62210).
Stored cross-site scripting in the Draft List WordPress plugin (versions through 2.6.4) allows authenticated users with low privileges to inject persistent malicious JavaScript into draft-related fields rendered by the plugin. When a higher-privileged WordPress user such as an administrator or editor views the draft list output, the stored payload executes in their browser, enabling session hijacking or unauthorized administrative actions. Reported by Patchstack (EUVD-2026-62208); no public exploit code or active exploitation confirmed at time of analysis.
Stored Cross-Site Scripting in the GeoDirectory WordPress plugin (versions <= 2.8.172) enables authenticated contributors to inject persistent malicious JavaScript into directory listings or plugin-managed content fields. When a higher-privileged user - such as an administrator - views the affected content, the injected script executes in their browser session under the application's origin, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though the low-complexity, network-reachable attack surface makes this a realistic threat on multi-contributor WordPress directory sites.
Stored Cross-Site Scripting in the Typing Effect WordPress plugin (versions ≤ 1.3.7) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browsers of other users, including administrators, who visit affected pages. The CVSS vector (PR:L/UI:R/S:C) confirms the flaw is exploitable by low-privilege authenticated accounts and that the scope change elevates impact beyond the contributor's own session - enabling session hijacking or administrative action forgery. No public exploit code identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored Cross-Site Scripting in the Video Conferencing with Zoom WordPress plugin (≤ 4.6.8) allows authenticated contributors to inject malicious scripts that execute in the browsers of higher-privileged users such as editors or administrators. The CVSS scope-changed metric (S:C) confirms the injected payload crosses security boundaries, enabling session hijacking or unauthorized administrative actions against victim accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this as a medium-severity, authenticated attack vector requiring targeted abuse of contributor-level access.
Stored Cross-Site Scripting in the Featured Video Plus WordPress plugin (versions ≤ 2.3.3) allows contributor-role users to inject persistent malicious scripts into featured video fields. When a higher-privileged user such as an editor or administrator views the affected post, the script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.
Information disclosure in Firefox's Graphics component exposes sensitive data to remote attackers who can lure users to a malicious webpage. All Firefox release channels prior to version 154 and multiple ESR branches are affected, with fixes shipping in Firefox 154, ESR 115.39, ESR 140.14, and ESR 153.1. No public exploit code has been identified and exploitation probability is very low (EPSS 0.16%), though the high confidentiality impact and zero-privilege-required attack path make patching a straightforward priority.
Local authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged attacker with logon access to the hosting infrastructure to read critical or all DRM-accessible data, with scope change indicating spillover exposure to additional integrated Oracle Hyperion components. The CVSS 3.1 score of 6.5 reflects the local attack vector with high confidentiality impact (C:H) and a notable scope change (S:C), meaning data exposure is not confined to the DRM application alone. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Oracle Hyperion Financial Management 11.2.25.0.000 exposes a local privilege escalation via its Security component, enabling a low-privileged infrastructure user to bypass access controls and obtain complete unauthorized access to all financial data the application can reach. The CVSS scope change (S:C) confirms that successful exploitation extends impact beyond HFM itself to additional Oracle ecosystem products sharing the same infrastructure. No public exploit has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Confidentiality compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged local attacker to gain unauthorized access to critical or complete Hyperion-accessible data, with a confirmed scope change that can cascade impact to additional co-hosted Oracle Hyperion products. The vulnerable component is Installation and Configuration, and the 'Authentication Bypass' tag in the intelligence source suggests access controls within this subsystem can be circumvented despite requiring an initial local OS-level logon. No public exploit code and no CISA KEV listing have been identified at time of analysis, positioning this as an insider-threat or post-compromise lateral escalation risk rather than a remote opportunistic attack.
Unprivileged user-mode threads in Zephyr RTOS (versions 2.3.0 through 4.4.1) can escape the userspace sandbox by exploiting an inverted boolean check in the syscall access-control handler, yielding two compiler-dependent outcomes: on Clang-compiled builds, a deterministic kernel crash via illegal-instruction trap reachable from any unprivileged thread; on GCC builds, undefined behavior that may suppress the return-value check and allow unauthorized abortion or joining of threads the caller was never granted access to. The CVSS vector (AV:L/PR:L/S:C/A:H) reflects the scope change from user-mode into supervisor context, and no public exploit has been identified at time of analysis - a vendor patch is available as of Zephyr 4.4.2.
Local data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a low-privileged attacker with OS-level logon access to the hosting infrastructure to compromise the Content Acquisition System (CAS) component and read critical or complete data. The scope change (S:C) in the CVSS vector confirms the attack can propagate beyond the directly vulnerable component to impact other Oracle Commerce products sharing the same environment. No public exploit code and no CISA KEV listing are identified at time of analysis; this issue was disclosed by Oracle via the August 2026 Critical Patch Update.
Clickjacking in Firefox for Android's Downloads component enables remote attackers to trick users into performing unintended download-related actions through UI redress. All Firefox for Android versions prior to 154 are affected, with the fix confirmed in Mozilla Security Advisory mfsa2026-74. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) reflects very low observed exploitation probability.
Unauthenticated full database disclosure in devpi-server affects instances configured in primary or master replication mode, allowing any network-reachable attacker to retrieve the complete database via a trivially modified GET request to the +changelog endpoint. Exposed data includes argon2 password hashes and devpi-tokens metadata (IDs and salts), enabling offline dictionary attacks against credentials and potential server-secret derivation if tokens are public. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; vendor-confirmed patches are available in devpi-server 6.20.2 and 7.0.0b3.
Path traversal in Confidential Containers guest-components (image-rs) versions 0.16.0 through 0.19.x allows a workload owner to create hardlinks outside the OCI layer destination directory and into arbitrary absolute paths within the pod virtual machine. The root cause is Rust's standard library behavior where `Path::join()` silently discards the base path when the right-hand operand is absolute, allowing a crafted tar entry to bypass directory confinement in `try_hardlink_fallback()`. While this does not cross the image trust boundary - the workload owner already controls trusted image content - it enables escape into pod VM capabilities and potential attestation abuse; no public exploit code has been identified at time of analysis.
Prompt injection in Context7 through version 2.1.2 allows an attacker with low-level write access to the Custom AI Instructions configuration to plant malicious directives that hijack connected AI coding agents when those agents make routine library documentation requests via the MCP server. The poisoned instructions cause the agent to exfiltrate credentials from environment files (such as .env files containing API keys and tokens) to an attacker-controlled endpoint, and to perform destructive file deletion on the victim developer's machine. No active exploitation has been confirmed in CISA KEV, but no public patch version has been independently verified at time of analysis.
Hyperion Financial Management version 11.2.25.0.000 exposes authenticated low-privileged network attackers to a tri-impact vulnerability in its Security component: complete, repeatable denial of service via application hang or crash, limited unauthorized data modification, and partial unauthorized data disclosure. Exploitation requires a valid low-privileged account, HTTP network access, and conditions of high attack complexity - factors that collectively reduce the likelihood of opportunistic or automated attack. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Stack buffer overflow and off-by-one NUL-write vulnerabilities in the Sierra Wireless HL7800 cellular modem driver within Zephyr RTOS (versions 2.4.0 through 4.4.1) allow an attacker controlling a rogue LTE base station or a compromised modem baseband to crash or potentially execute arbitrary code in kernel context. Roughly twenty AT response handlers incorrectly size the destination argument to net_buf_linearize(), placing the null terminator one byte past a 128-byte stack buffer; the +KCELLMEAS handler is the most critical, passing the raw wire length as the destination size and enabling a full, attacker-content-driven stack overflow that runs in the driver's RX kernel thread. No public exploit has been identified at time of analysis, and this CVE does not appear in CISA KEV.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with local logon access to the host infrastructure, exploiting a flaw in the Security component under conditions of high attack complexity. Despite a moderate CVSS base score of 6.4 - dampened by strict access prerequisites - successful exploitation yields complete confidentiality, integrity, and availability compromise of the application. No public exploit code or active exploitation has been identified at time of analysis.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable by a highly privileged local attacker through a difficult-to-exploit flaw in the Install component. The CVSS vector (AV:L/AC:H/PR:H) confirms that while the impact is severe - achieving complete confidentiality, integrity, and availability compromise - the attack prerequisites are restrictive, limiting realistic exposure. No public exploit code has been identified at time of analysis, and exploitation has not been confirmed by CISA KEV.
Link header directive smuggling in ninenines cowlib (2.9.0+) enables attacker-controlled browsers to initiate out-of-band connections to arbitrary origins. The cow_link:do_link/1 function emits target URI, rel values, and attribute keys verbatim into serialized Link headers - a '>' byte in the target prematurely terminates the URI angle-bracket slot, while '"' or '\' in rel breaks out of the quoted-string context, allowing injection of additional synthetic link directives. No public exploit has been identified at time of analysis, but the CVSS 4.0 AT:P metric confirms that exploitation depends on a specific application-level precondition.
Socket.IO namespace access control bypass in MagicMirror² prior to v2.37.0 allows unauthenticated adjacent-network clients to interact directly with module helpers, bypassing the configured ipWhitelist that protects only the Express HTTP layer. Affected deployments binding to non-loopback interfaces can be exploited for server-side request forgery via the default newsfeed and calendar helpers, and conditionally for command execution via child_process.exec through the updatenotification helper when a third-party module update is pending. No public exploit code has been identified at time of analysis and this vulnerability is not in CISA KEV.
Partial unauthorized data access and service disruption in Oracle Hyperion Financial Management 11.2.25.0.000 can be achieved by low-privileged, network-accessible attackers via HTTP targeting the Security component. Exploitation allows unauthorized read of a subset of application data, unauthorized update or insert of accessible data, and partial denial of service - all without user interaction. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Oracle Installed Base within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes its User Interface component to low-privileged authenticated attackers over HTTP, enabling unauthorized read access, data manipulation (insert, update, delete), and partial denial of service. Disclosed via Oracle's August 2026 Critical Patch Update, this vulnerability is easily exploitable with no attack complexity requirements once a valid low-privileged account is obtained. No public exploit code or CISA KEV listing is present at time of analysis, but the low access complexity and broad version range across 13 minor releases increases organizational exposure.
Oracle Hyperion Financial Reporting 11.2.25.0.000 exposes an authentication-related flaw in its Server component that allows a low-privileged, network-authenticated attacker to gain unauthorized read access to critical financial data and limited write access through crafted HTTP requests - provided a separate user interaction is triggered. Tagged by Oracle as an Authentication Bypass, the vulnerability yields High confidentiality impact and Low integrity impact against version 11.2.25.0.000. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Privilege escalation in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) enables authenticated subscriber-level users to exceed their intended permissions through incorrect privilege assignment (CWE-266). Discovered and disclosed by Patchstack and tracked as ENISA EUVD-2026-60936, the flaw affects deployments by Stylemix on the WordPress platform worldwide. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in Forem's admin abuse-report panel allows a remote unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser. The public FeedbackMessagesController previously accepted an attacker-supplied offender_id parameter, which caused the unsanitized message field to be rendered via Rails' raw() helper when an administrator views the flagged report - exposing CSRF tokens, session data, and enabling unauthorized administrative actions. No public exploit has been identified at time of analysis, but the attack path is technically straightforward and targets a routine administrative workflow that reliably delivers the payload.
Authorization bypass in Oracle Public Sector Financials (International) - a government-focused module of Oracle E-Business Suite versions 12.2.3 through 12.2.15 - permits low-privileged, network-authenticated attackers to read sensitive financial records, perform unauthorized data manipulation (insert, update, delete), and cause a partial denial of service against the affected module via standard HTTP. Oracle disclosed this in the August 2026 Critical Security Patch Update; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at the time of analysis. With a CVSS 3.1 score of 6.3 (Medium), this is a mid-tier priority that warrants timely patching particularly for public sector organizations where financial data integrity is a regulatory obligation.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Commerce Guided Search and Experience Manager version 11.4.0 exposes a local confidentiality vulnerability in its Content Acquisition System (CAS) component that allows an unauthenticated infrastructure-level attacker to bypass application-layer authentication and obtain complete read access to all Oracle Commerce accessible data, including critical confidential records. The scope change designation in the CVSS vector (S:C) indicates successful exploitation can cascade beyond the Commerce platform itself, impacting additional co-located or integrated products. No public exploit code has been identified at time of analysis, and EPSS data was not provided in the source intelligence.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a local attacker without Hyperion-level credentials to gain unauthorized read and write access to critical Hyperion data through a flaw in the Installation and Configuration component. Exploitation requires physical or logical presence on the infrastructure host and successful social engineering of a legitimate user to trigger the vulnerable condition, consistent with the CVSS 3.1 vector AV:L/AC:H/UI:R. No public exploit has been identified and the vulnerability is not listed in CISA KEV, though the high confidentiality and integrity impacts are significant for environments where Hyperion hosts sensitive financial or enterprise planning data.