Remote code execution in Crocoblock JetEngine (WordPress plugin) versions 3.8.14 and earlier allows unauthenticated attackers to run arbitrary code on the host, tagged by Patchstack as a server-side template injection (SSTI) issue. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting network-reachable, no-privilege, no-interaction exploitation with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.6) lets unauthenticated remote attackers hijack any account, including administrators. The admin_user_create_cus AJAX action performs no authentication or capability check and feeds the attacker-controlled truebooker_wp_user_id parameter straight into wp_update_user, allowing an attacker to overwrite a target user's email and then seize the account via the standard WordPress lost-password reset. Reported by Wordfence and rated CVSS 9.8; no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
SQL injection in FAYDAM Datalogger (versions 2.7.1 up to but not including 2.8.0) lets remote attackers inject arbitrary SQL commands through improperly neutralized input, per a TR-CERT advisory. With a CVSS vector of PR:N/UI:N, exploitation requires no authentication or user interaction, exposing the backing database to full read, modification, and destruction. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was supplied.
Unauthenticated PHP Object Injection in the WordPress 'Kalles Addons' plugin (by the4) through version 1.0.6 lets remote attackers inject arbitrary serialized PHP objects, potentially escalating to code execution, data theft, or site takeover if a suitable gadget chain is present. The CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflects network-reachable, no-authentication, low-complexity exploitation with full confidentiality, integrity, and availability impact. Disclosed via Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Remote unauthenticated memory corruption in RDK-B WebUI (build rdkb-2025q4-kirkstone.04.10.26) arises from a heap-based buffer overflow in the multipart/form-data parser in jst_post.c, letting an attacker send a single crafted POST request to corrupt heap memory. Confirmed impact is denial of service via crashing the WebUI service, with potential remote code execution on the broadband gateway if the overflow is weaponized. No public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS is low (0.29%, 21st percentile) despite the 9.8 CVSS.
Privilege escalation in the Total Donations WordPress plugin (versions 2.0.5 and earlier) lets a remote, unauthenticated attacker improperly assign or elevate account privileges, reported by Patchstack under CVE-2026-73390. Because the flaw needs no authentication and carries full confidentiality/integrity/availability impact (CVSS 9.8), a successful exploit can hand an attacker administrative control over the WordPress site. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in Wireshark's C12.22 protocol dissector affects versions 4.6.0-4.6.7 and 4.4.0-4.4.17, where a malformed C12.22 packet triggers a heap buffer overflow (CWE-122) that crashes the application. An attacker who can get crafted traffic in front of a capturing or file-loading analyst can reliably terminate the dissection session. A proof-of-concept is reported via SSVC, but there is no evidence of active exploitation, and the EPSS probability is low (0.27%).
Unauthenticated privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin versions 1.2.6 and earlier allows a remote attacker with no credentials to elevate their privileges within the WordPress site, per a Patchstack report. The CVSS 9.8 rating (AV:N/AC:L/PR:N/UI:N) reflects fully remote, low-complexity abuse with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Stack buffer overflow in the FreeBSD iconv(3) ISO-2022 encoding modules allows a 4-byte out-of-bounds write when converting untrusted text to or from certain ISO-2022 variants. The affected code sizes an intermediate output buffer to MB_LEN_MAX (6 bytes), but some ISO-2022 variants emit up to 10 bytes per character, overflowing the stack. It affects FreeBSD 14.3, 14.4, 15.0, and 15.1 release branches before the fixed patch levels; there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%).
Heap buffer overflows in FreeBSD's iconv(3) character-conversion library allow attackers who control input processed through the HZ, UTF-7, VIQR, or ZW encoding modules to corrupt heap memory, potentially leading to remote code execution. Applications on FreeBSD 14.3/14.4/15.0/15.1 that pass untrusted data through iconv using any of these encodings are exposed. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.21%, 12th percentile) despite the 9.8 CVSS.
Authentication bypass in the RDK-B WebUI (broadband gateway management interface), build rdkb-2025q4-kirkstone.04.10.26, lets a remote unauthenticated attacker gain full administrative access by presenting a forged JWT whose RSA signature is invalid. The flaw lives in the signature-verification logic of jst_functions.c, which accepts tokens without properly validating the RSA signature. No public exploit is identified at time of analysis and EPSS is low (0.19%), but the CVSS 9.8 rating and trivial exploitation path make it a high-priority patch for exposed devices.
Account takeover in the TrueBooker WordPress plugin (all versions before 1.2.7) lets remote unauthenticated attackers change the email address of any registered user - including administrators - through AJAX actions that lack authorisation checks, then hijack the account via WordPress's standard password-reset flow. The flaw carries a CVSS 9.8 and is fixed in 1.2.7; there is no public exploit identified at time of analysis, and EPSS remains low (0.15%, 4th percentile), reflecting limited observed weaponisation despite the critical rating.
Authentication bypass in the TabaPay Gateway WordPress plugin (versions through 1.4.0) lets unauthenticated remote attackers log in as any registered user - including administrators - by abusing the payment callback handler. Because the plugin establishes a session for the account tied to a referenced order without validating the payment callback's authenticity, an attacker who can reach the callback endpoint can impersonate arbitrary accounts. No public exploit identified at time of analysis, and EPSS is low (0.15%, 4th percentile), but the flaw is trivially exploitable and CISA's SSVC framework rates it fully automatable with total technical impact.
Signature-verification bypass in the Net::OAuth Perl module before 0.33 lets a remote attacker forge valid OAuth requests for any consumer key and token by dictating which algorithm the Service Provider uses to check their signature. Because verify() resolves the signature-method class from the attacker-supplied signature_method parameter and offers no way to pin an expected method, a provider deployed on RSA-SHA1 (which holds only the consumer's public key) can be tricked into validating an HMAC-SHA1 signature against a placeholder/guessable consumer_secret. No public exploit has been identified at time of analysis and EPSS is low (0.11%), but the flaw is unauthenticated and network-reachable (CVSS 9.8).
Unauthenticated PHP object injection in the WP Desk Flexible Subscriptions WordPress plugin (versions <= 1.8.1) lets remote attackers submit crafted serialized data that the plugin deserializes, enabling exploitation of PHP object magic methods. Reported by Patchstack and rated CVSS 9.8, the flaw can escalate to remote code execution, data theft, or site takeover when a suitable POP gadget chain is present in the plugin, WordPress core, or another installed extension. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds write in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 lets an unauthenticated adjacent-network attacker corrupt memory to achieve arbitrary code execution or crash the affected service (denial of service). The CVSS 3.1 base score is 9.6 (Critical) with a changed scope, reflecting potential impact beyond the vulnerable component on IBM Power hardware. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Cross-user SSH credential disclosure in Termix, a self-hosted web server-management platform, allows an authenticated low-privileged user to steal another user's stored SSH password or private key. The terminal WebSocket trusts a user-supplied hostConfig.id, and the host resolver falls back to the host owner's credentials without an ownership or access check, then pairs that credential with the attacker's own ip/port/username so Termix authenticates to an attacker-controlled SSH server and leaks the secret. Fixed in 2.3.2; no public exploit identified at time of analysis, though a detailed advisory and patch commit make the flaw well understood.
Stored cross-site scripting in Etherpad before 3.3.1 lets any user with write access to a pad execute arbitrary JavaScript in the browser of anyone - including an administrator - who later opens the pad or its /timeslider view. The root cause is the numbered-list rendering path interpolating an attacker-controlled ordered-list 'start' value, sourced from a crafted .etherpad import, directly into unquoted markup assigned to innerHTML. A vendor patch exists in 3.3.1; no public exploit identified at time of analysis, though the vendor's regression test embeds a working payload.
Broken authorization in Termix (self-hosted web-based SSH/server management platform) before 2.6.1 lets any authenticated user retrieve other users' stored SSH and sudo passwords in plaintext. The GET /host/db/host/:id/password endpoint resolves credentials without enforcing host ownership, so an attacker with a valid JWT can enumerate sequential numeric host IDs and harvest credentials belonging to other tenants. Rated CVSS 9.6 (scope-changed) because the leaked credentials grant control of the external systems Termix manages; no public exploit identified at time of analysis, and it is not in CISA KEV.
Integrity and availability compromise in Cisco Secure Workload allows an authenticated, remote attacker to abuse improper input validation (CWE-20) across multiple internally discovered flaws fixed in a single hardening release. Because the CVSS scope is Changed, successful exploitation can impact components beyond the initially vulnerable one. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; it was discovered and reported internally by Cisco.
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker positioned on the Flexible Service Processor (FSP) management network assume full administrative control of the managed system. An attacker can manipulate partition power state, alter configuration, and access partition consoles across every hosted LPAR, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not on CISA KEV, but the 9.6 CVSS and scope-changing impact make it a high-priority patch for datacenters running IBM Power hardware.
Remote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker with adjacent-network access to the ASMI web interface send a malformed request that overflows a stack buffer on the Flexible Service Processor (FSP), yielding arbitrary code execution and full control of the managed system. Because the FSP is the service processor beneath the OS, compromise crosses a scope boundary (CVSS S:C) and breaks confidentiality, integrity, and availability of the whole platform. No public exploit identified at time of analysis; IBM has released a fix and reported the issue itself.
Remote information disclosure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stems from an integer underflow in the kernel's IPv4 IP-options parser (CWE-125 out-of-bounds read), letting a remote attacker leak sensitive memory contents by sending crafted IP packets. IBM (the reporting vendor) rates it CVSS 9.4, and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated remote code execution in InternLM LMDeploy (versions 0.9.2 through 0.15.x) allows a remote attacker to execute arbitrary code inside an inference engine process when disaggregated (P2P) serving is enabled. The disaggregation peer-connector deserializes attacker-influenced ZMQ messages with Python pickle before any type validation, and the /distserve/p2p_initialize and /distserve/p2p_connect endpoints require no authentication in the default configuration (api_keys=None). Reported by VulnCheck with a vendor advisory and a public patch; no public exploit or CISA KEV listing identified at time of analysis, though the code path and fix are publicly documented on GitHub.
Improper access control in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) allows a party holding only an embedded report token to download the dispatch archive of an embedded report's search job, exposing session material that grants access to sensitive data and the ability to affect platform integrity. The embedded-report authorization flow fails to block dispatch-archive download requests before the archive begins streaming, so the check is effectively bypassed (CWE-284). No public exploit has been identified at time of analysis, but the 9.4 CVSS score and unauthenticated network vector make this a high-priority patch.
Improper access control in Splunk Enterprise (versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14) lets anyone holding an embedded report token download the underlying search job's dispatch archive over the REST API, recover session material, and impersonate the report owner. Because embedded reports are designed to be shared with unauthenticated viewers, an attacker can read all data the owner can access and, if the owner holds the admin role, perform administrative actions. No public exploit is identified at time of analysis, but the CVSS 9.4 rating and unauthenticated network vector make this high priority.
Authenticated remote code execution affects Talebook (MyBooks/PoxenStudio) ebook management server versions 3.41.2 and earlier, where an administrator can inject arbitrary Python into the auto-generated auto.py settings module via a crafted SOCIAL_AUTH key name. Because the server imports auto.py as a live module and can auto-restart to reload it, injected statements execute with the service account's privileges, enabling data disclosure, file modification, persistence, or service disruption. No public exploit is identified at time of analysis; the fix is version 3.42.0, and chained authorization/registration weaknesses noted by the vendor could lower the effective privilege barrier.
Session material exposure in Splunk Enterprise (versions below 10.4.1, 10.2.6, 10.0.9, and 9.4.14) allows an unauthenticated attacker who can view the HTML source of any page that embeds a Splunk report to harvest session credentials and reach the underlying search data with high confidentiality and integrity impact. The flaw stems from the dispatch archive download path failing to enforce the embedded-report authorization boundary, so archived search-job data carries sensitive session material. Rated CVSS 9.4 and reported by Cisco; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Server-Side Request Forgery in the Grav API plugin (grav-plugin-api) for Grav CMS before 1.0.6 lets a caller holding the api.webhooks.write permission register webhook URLs that the server dereferences with no protocol allow-listing. Because WebhookController.php validates the URL only with FILTER_VALIDATE_URL and WebhookDispatcher.php builds cURL without CURLOPT_PROTOCOLS/CURLOPT_REDIR_PROTOCOLS, an attacker can force the server to fetch file://, gopher://, dict://, and private/link-local targets, exfiltrating local files and internal HTTP responses including cloud metadata credentials. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the root cause and fix are confirmed in the vendor advisory and commit.
Heap buffer overflow in FFmpeg's RIST protocol reader (libavformat/librist.c) lets a remote RIST sender corrupt heap memory in any FFmpeg instance ingesting an async:rist:// stream, enabling potential remote code execution or crash. The librist_read() function ignores the caller's buffer size and copies the entire received RIST payload into a destination buffer that the async wrapper sizes smaller than the packet, so an oversized payload writes past the buffer end. Reported by VulnCheck and fixed upstream in commit 1c10bcc; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in the Cudy WR3000 2.0 router (firmware before 2.5.24) lets unauthenticated remote attackers forge valid JWT tokens by reusing a hard-coded HMAC signing secret embedded in the firmware image, granting illegitimate access to the device's Mosquitto MQTT broker and mesh-networking control interface. Because the secret is static across all units of this model, any attacker who obtains one firmware image can authenticate against every deployed device. There is no public exploit identified at time of analysis, but the flaw is trivially exploitable once the secret is extracted, and the network-reachable, no-privilege CVSS 4.0 score of 9.3 (VC:H/VI:H) reflects full read/write access to mesh control.
Unauthenticated administrative account takeover in vsDesk (a Russian-market IT service-desk/help-desk platform) lets a remote attacker abuse insecure deserialization of application configuration data to point the login flow at an attacker-controlled LDAP server and provision a new admin account. Rated CVSS 4.0 9.3 (critical) with an unauthenticated network vector, it was researched and disclosed by Kaspersky (klsecservices); a detailed public write-up exists (KLSA-00296), though no CISA KEV listing or confirmed weaponized exploit is present in the data, so this is best characterized as no public exploit code identified at time of analysis despite a thorough advisory.
Authentication and authorization bypass in the cluster-proxy-addon component of Red Hat's Multicluster Engine for Kubernetes (MCE) lets an unauthenticated attacker who can reach the user-facing proxy route manipulate URL path segments to proxy requests to arbitrary services on any managed cluster. Because the flaw is a server-side request forgery (CWE-918) with a changed CVSS scope, a request to the hub's exposed route pivots into internal services on downstream clusters that were never meant to be externally reachable, enabling information disclosure and potential further compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (critical).
SQL injection in the J-BusinessDirectory extension for Joomla (by cmsjunkie.com) before version 6.2.3 lets remote attackers inject arbitrary SQL through the trips search feature, where user-supplied search keywords and the ORDER BY sort clause are concatenated directly into a query. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, score 9.3) indicates unauthenticated, low-complexity network exploitation with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but SQL injection in a public search endpoint is trivially weaponizable.
SQL injection in the YOOtheme Zoo content-construction extension for Joomla allows unauthenticated remote attackers to inject arbitrary SQL through the filter_type and type_filter request parameters, which are concatenated directly into a.type comparison clauses in ItemController::element() without quoting or escaping. All Zoo versions before 4.1.64 are affected, and because no authentication or user interaction is required, an attacker can read or manipulate the Joomla database over the network. No public exploit has been identified at time of analysis, but the trivial exploitation profile (CVSS 9.3) makes weaponization straightforward.
TNC policy server impersonation in IBM AIX 7.2/7.3 and IBM PowerVM VIOS 4.1 lets a network-positioned attacker forge the Trusted Network Connect policy server and tamper with the traffic between it and the endpoint, because the client fails to properly validate the server's certificate (CWE-295). An attacker who can intercept the session can present a fraudulent certificate, read limited data and alter integrity-critical policy exchanges. IBM has released a fix; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the NGG Smart Image Search WordPress plugin (all versions before 4.0.0) lets remote attackers inject arbitrary SQL through the plugin's search functionality without authentication. Because the CVSS vector marks privileges as none and user interaction as none, any visitor can reach the vulnerable query, and the scope-changed high-confidentiality rating (9.3) reflects potential exposure of the entire WordPress database, including credentials and secrets. No public exploit was identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported by Patchstack.
Stored cross-site-scripting-to-RCE in SiYuan (the open-source personal knowledge-management/note app) before v3.7.4 lets an attacker-crafted document execute arbitrary OS commands on a victim's machine. Document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated unescaped into the aria-label attribute of the file-tree 'move/link to' path-picker tooltip; a double quote breaks out of the attribute and injects an inline event handler. Because every SiYuan Electron window runs with nodeIntegration:true, contextIsolation:false and no CSP, the handler reaches require('child_process') and achieves command execution the moment the victim hovers the malicious entry. There is no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting escalating to arbitrary OS command execution affects the SiYuan personal knowledge-management application through version 3.7.3. Because the '((' block-reference autocomplete popup renders a candidate block's name, alias, and memo fields into HTML without escaping, an attacker who controls those metadata fields can plant a self-firing payload that runs the moment a victim types '((' and surfaces the crafted block; SiYuan's Electron shell runs with nodeIntegration enabled, contextIsolation disabled, and no CSP, so the injected script reaches require('child_process') and executes host commands. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the XSS-to-RCE chain is fully described by the VulnCheck advisory and vendor GHSA.
Unauthenticated SQL injection in the Total Donations WordPress plugin (versions <= 2.0.5) lets remote attackers inject arbitrary SQL via unsanitized input without any authentication, exposing the WordPress database to disclosure. The CVSS 9.3 rating with a changed scope reflects that a successful attacker can read sensitive data (user credentials, PII, donation records) beyond the plugin's own boundary. No public exploit has been identified at time of analysis, and EPSS/KEV data were not provided.
Unauthenticated SQL injection in the Nikstore Core WordPress plugin (versions <= 1.5) lets remote attackers inject arbitrary SQL through unsanitized input reaching a database query, per a Patchstack report classified under CWE-89. Any exposed WordPress site running the plugin is reachable without credentials, and the changed CVSS scope reflects the database being a distinct security authority from the web application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated SQL injection in the Maps Marker Pro WordPress plugin (all versions up to and including 4.32) lets remote attackers inject arbitrary SQL against the site database without any credentials or user interaction. Reported by Patchstack and rated CVSS 9.3, the flaw exposes the backing WordPress database to unauthenticated extraction. No public exploit has been identified at the time of analysis and the CVE is not listed in CISA KEV.
Anonymous read/write/federation access to Stigmem nodes (versions before 0.9.0a2) is possible when operators disable authentication and bind the node to a non-loopback address, effectively bypassing authorization for the anonymous identity. Reported by VulnCheck and disclosed via GHSA-fp6w-8wpg-74g5, it affects the eidetic-labs stigmem-node package (pip). No public exploit identified at time of analysis, and no EPSS or CISA KEV signal is available; exploitation is gated on a deliberate operator misconfiguration rather than a default-config weakness.
Path-traversal-driven remote code execution in Wazuh 4.3.0 through 4.14.5 (and 5.0.0-beta1/beta2) lets a cluster peer that holds the shared Fernet key overwrite security-sensitive files on the master node. Because the non-merged branch of process_files_from_worker() in master.py trusts the peer-supplied file_path from files_metadata.json without confining it under the directory implied by cluster_item_key, an attacker can replace /var/ossec/etc/ossec.conf to configure root-executed commands and gain code execution on the next service reload. No public exploit identified at time of analysis, but a vendor fix and the fixing commit are public, making the root cause easy to study.
Sensitive-key exposure in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 Network Installation Management (NIM) leaks intermediate certificate authority (CA) private keys inside a publicly downloadable update file, letting remote attackers forge trusted certificates and bypass security restrictions. Rated CVSS 9.1, the flaw impacts confidentiality and integrity (C:H/I:H) but not availability, and IBM has released a fix. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the ease of obtaining a live CA key makes this a high-priority credential-hygiene issue.
Operating-system command execution in the Splunk MCP Server app (all versions below 1.2.1) lets a user already holding the Splunk 'admin' role run arbitrary commands on the underlying host by abusing unsafe deserialization in the credential-management component. Because the app trusts stored data and deserializes it without verifying the object type, a privileged Splunk user can escalate from application-level administration to full host compromise. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.
Privilege escalation in the search-v2-operator (Red Hat Advanced Cluster Management / OpenShift search component) allows a user with edit rights on the Search Custom Resource to abuse unvalidated CR fields (imageOverride, arguments, environment variables) to load an attacker-controlled container image or mount arbitrary secrets. Because the search ServiceAccount holds broad impersonation permissions, controlling that pod pivots into full cluster compromise. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the CVSS 9.1 rating reflects the scope change from a namespaced CR editor to the entire cluster.
Mutual-TLS authentication bypass in the Netty network framework (io.netty.handler.ssl.SslClientHelloHandler) lets an unauthenticated remote attacker reach routes protected only by per-SNI clientAuth=REQUIRE. A ClientHello whose 4-byte handshake header is split across TLS records trips a wrong-offset bounds check, throwing IndexOutOfBoundsException and calling select(ctx, null), which falls back to the default SslContext (clientAuth NONE/OPTIONAL) instead of the SNI-matched context. Fixed in 4.1.137.Final and 4.2.17.Final; no public exploit identified at time of analysis, but the CVSS 4.0 base score is 9.1 (Critical).
Authentication bypass via WebAuthn assertion replay in phpMyFAQ affects all versions up to and including 4.1.5, fixed in 4.1.7. Because prepareForLogin generates a login challenge but neither WebAuthn controller writes the mutated key object back to the database, the anti-replay check is short-circuited by its own null guard, so an attacker who captures one successful WebAuthn assertion can resubmit it indefinitely to log in as that user with no hardware key or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the root cause is well documented in the vendor advisory.
Two-factor authentication bypass in phpMyFAQ before 4.1.7 lets an attacker who already knows a valid password defeat the TOTP second factor through unbounded brute force. Because the five-attempt failure counter is stored per session and reset on every successful password re-authentication (CWE-307), an attacker can loop - grab a fresh session cookie, re-enter the known password, and get five more guesses - until the 6-digit TOTP is guessed, yielding full account takeover. Reported by VulnCheck with no public exploit identified at time of analysis and not listed in CISA KEV.