Stored cross-site scripting in pfSense Plus (before 26.07) and pfSense CE (through 2.8.1) allows an external attacker who controls a DNS PTR record to execute arbitrary JavaScript in an administrator's browser by engineering top-talker visibility in the Traffic Graphs feature, ultimately enabling account creation and OS command execution on the firewall. The attack chain bridges an unauthenticated DNS-layer injection through an unsanitized DOM sink in AJAX responses to full authenticated control of the management interface. No public exploit has been identified at time of analysis, but successful exploitation yields complete administrative compromise of a network perimeter device - making this a high-impact target despite its moderate CVSS 4.0 score of 5.3.
Out-of-bounds read in FreeRDP's planar RLE bitmap decoder allows a malicious RDP server to crash connecting clients and potentially disclose adjacent heap or stack memory. The flaw exists in planar_decompress_plane_rle and planar_decompress_plane_rle_only within libfreerdp/codec/planar.c across all FreeRDP releases prior to 3.29.0. An attacker operating or controlling an RDP server can exploit this by sending a specially truncated planar bitmap or surface update whose RLE control byte claims more raw bytes than the buffer contains, triggering the decoder to read beyond the allocated source buffer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the Cisco Industrial Ethernet 1000 Series Switch web-based management interface allows an authenticated remote attacker to inject persistent malicious scripts into interface pages, which then execute in the browser context of other authenticated users. Affected firmware spans versions 1.1 through 1.9.5 across the IE 1000 product line, as confirmed by EUVD-2026-62562 and the Cisco security advisory. No public exploit code or active exploitation has been identified at time of analysis, and Cisco has published advisory cisco-sa-ie1k-NgXUFF52 with remediation guidance.
Username enumeration via observable timing discrepancy in Wazuh's authentication layer exposes valid account names to unauthenticated remote attackers across all 4.x deployments from 4.0.0 and the 5.0.0-beta1 pre-release. The root cause is an asymmetric code path in AuthenticationManager.check_user() - nonexistent usernames return immediately while valid usernames trigger an expensive bcrypt hash computation, creating a reliably measurable latency gap of roughly 100-300 ms versus sub-millisecond response. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the primitive reliably enables targeted credential-stuffing or brute-force follow-on attacks.
Kernel memory disclosure in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exposes internal kernel memory to remote unauthenticated attackers via an out-of-bounds read (CWE-125). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms network-accessible, zero-prerequisite exploitation, though impact is bounded to partial confidentiality loss with no integrity or availability consequences. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283858.
Management plane flood protection deficiency in Cisco Industrial Ethernet 1000 Series Switches enables unauthenticated remote attackers to exhaust CPU resources, rendering the device manager web GUI, SSH, and API inaccessible. All firmware branches from 1.1 through 1.9.5 are confirmed affected per EUVD-2026-62559. Critically, data-plane forwarding through the switch is explicitly unaffected - only management access is disrupted - though in OT/ICS environments this distinction matters less during incidents requiring remote intervention. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Open redirect in the Grav Login plugin (prior to version 3.8.5) allows unauthenticated attackers to weaponize any public Grav installation as a trusted-domain launchpad for phishing. The `twofa_cancel` task accepted a client-controlled `_redirect` POST parameter without nonce validation; `Controller::execute()` forwarded this value through `Grav::getRedirectResponse()` and `Uri::isExternal()`, which confirmed the URL was external but did not block it - enabling seamless transparent redirect to attacker-controlled http, https, or protocol-relative targets. The vendor released a patch in Login plugin 3.8.5 that both adds nonce verification to the `twofa_cancel` task and blocks external client-supplied redirects across all login tasks. No public exploit has been identified and the vulnerability is not in the CISA KEV catalog.
Unauthenticated path traversal in Ground Station before v0.4.13 allows remote attackers to read arbitrary JSON-parseable files outside the intended recordings directory via the Socket.IO configure-sdr command. The sigmf-playback SDR type accepts an unsanitized recordingPath parameter that is stored verbatim and later opened by the sigmfprobe backend, enabling absolute-path or directory-traversal payloads to escape backend/data/recordings and return file contents to the caller. No public exploit has been identified at time of analysis; a vendor-released patch exists as of version 0.4.13.
Seccomp and AppArmor protections in BuildKit build containers can be silently disabled by a custom frontend submitting an invalid SecurityMode integer value in a crafted build request. Affected versions are BuildKit <= 0.31.0 on Linux. Because the vulnerable code in executor/oci/spec_linux.go treated any unrecognized SecurityMode value as non-sandbox mode without requiring the security.insecure entitlement, a malicious or compromised frontend bypasses kernel-level syscall filtering and MAC enforcement. No public exploit identified at time of analysis, though the fix commit includes test code demonstrating the exact bypass technique using SecurityMode(2).
Private message block enforcement in Lemmy is bypassed by the edit path, allowing a blocked sender to keep modifying old messages visible to the recipient. All Lemmy instances running versions prior to 0.19.19 (stable) and 1.0.0-alpha.18 (alpha) are affected. An authenticated attacker who has been blocked by a recipient can repeatedly call the edit endpoint on any previously sent message, delivering new content and providing a post-block harassment channel - defeating the intent of Lemmy's block feature. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stack out-of-bounds write in Wazuh's root-level remoted daemon allows an authenticated agent to crash manager message processing by sending a specially crafted compressed payload over TCP port 1514. Versions 1.0.0 through 4.14.5 (stable) and 5.0.0-beta1 are affected; the decompression function writes a null terminator one byte beyond the stack buffer boundary when the message expands to exactly OS_MAXSTR bytes, corrupting the daemon stack and disrupting all agent communications. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; fixed versions 4.14.6 and 5.0.0-beta2 are available.
TCP/TLS stream parser desynchronization in Coturn TURN/STUN server prior to 4.15.0 allows any unauthenticated remote client to crash their own connection by sending a STUN message with a crafted body-length field value between 65520 and 65532. The integer overflow in stun_get_message_len_str() causes the framing layer to misinterpret the stream, consuming only 4-16 bytes and treating remaining data as a new message, ultimately dropping the attacking client's connection. No other clients or the server process are impacted; vendor-released patch version 4.15.0 is available and no active exploitation is confirmed.
Path traversal in Splunk Enterprise exposes JavaScript files outside the Splunk Web static directory to unauthenticated remote attackers across four active release branches. Splunk Web fails to enforce boundaries on static file requests, allowing directory traversal reads without any credentials. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the trivially low attack complexity (AC:L, PR:N, UI:N) means exploitation requires no special tooling.
Unauthenticated exposure of the OpenAPI specification in Cisco Talos Intelligence for Enterprise Security Cloud (versions below 1.0.3) allows any network-accessible user to retrieve the add-on's full REST API documentation via Splunk Web static file paths. The disclosed specification reveals API endpoint structure and the authentication model, enabling reconnaissance that could facilitate targeted follow-on attacks. No active exploitation or public exploit code has been identified at time of analysis.
Log injection in Wazuh's REST API (versions 4.4.0 through pre-4.14.6 and 5.0.0-beta1 through pre-5.0.0-beta2) allows an unauthenticated remote attacker to corrupt plain-text audit log integrity by embedding carriage return or line feed characters in the Basic authentication username field. Because the API middleware decodes the username before credential validation and passes the raw value to the access logger without control-character neutralization, the attacker can forge log entries, suppress evidence of prior activity, or poison upstream log aggregation pipelines. No public exploit has been identified at time of analysis, and the JSON log format is unaffected; the vendor-released patch is available in 4.14.6 and 5.0.0-beta2.
Path traversal in OpenEMR's EDI archive restore function before version 8.3.0 enables authenticated users with EOB Data Entry permissions to enumerate arbitrary filesystem paths on the server via a differential response oracle. The unsanitized `archrestore_sel` POST parameter is passed directly to the archive restore handler, which checks the resolved path against the filesystem and returns distinct messages depending on whether the path exists - leaking file existence without disclosing file contents. No public exploit has been identified at time of analysis, and a vendor-released patch is available in OpenEMR 8.3.0.
Unauthenticated token-signing key reload in Splunk Enterprise 10.4.x (below 10.4.2) exposes a REST API endpoint that lacks the required `change_authentication` capability check, permitting any network-reachable caller to force a key reload cycle without credentials. The flaw is classified under CWE-862 (Missing Authorization) and was reported by Cisco; a vendor patch is available at 10.4.2. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low-complexity, unauthenticated network vector makes opportunistic probing straightforward once the endpoint is known.
Blind Server-Side Request Forgery in Stigmem before 0.9.0a11 allows authenticated users to redirect the application server's HTTP client toward loopback and RFC 1918 private-network destinations by supplying arbitrary values in the webhook subscription delivery_address parameter. When a matching fact-change event fires, Stigmem's backend issues an unsolicited HTTP POST to the attacker-specified internal address, enabling interaction with co-located internal services the attacker could not otherwise reach. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation probability is currently unquantified.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker through a NULL pointer dereference in a network-handling code path. Exploitation requires no authentication but demands high attack complexity, substantially limiting opportunistic or internet-scale attacks. IBM has released a patch via its official support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Registration restriction bypass in phpMyFAQ before v4.1.6 enables network attackers to create user accounts even when administrators have explicitly disabled self-registration via the security.enableRegistration configuration flag. The REST API endpoints POST /api/register and POST /api/v3.1/register lack the server-side authorization check present in the HTML registration page, creating a security control gap (CWE-862). No public exploit has been identified and the vulnerability is not listed in CISA KEV; however, the mechanically trivial nature of the bypass - a standard HTTP POST - makes it low-effort to abuse once an attacker identifies an exposed phpMyFAQ instance.
Broken access control in phpMyFAQ before 4.1.7 exposes sensitive infrastructure configuration to any authenticated user, regardless of permission level. Admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration fail to enforce the CONFIGURATION_EDIT permission check, meaning a low-privileged account holder can retrieve LDAP server topology, bind account names, search bases, index statistics, and site analytics. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity and broad exposure to all authenticated users make this a meaningful reconnaissance risk in environments with LDAP or Elastic integrations.
SQL injection in Wazuh's File Integrity Monitoring subsystem allows a local low-privileged user on non-Windows systems to manipulate the FIM SQLite database by creating a specially crafted filename in any monitored directory. The `wazuh-syscheckd` daemon in versions 4.6.0 through 4.14.5 concatenates unsanitized file paths directly into SQLite row filter predicates in `DB::getFile()` and `DB::searchFile()`, enabling UNION SELECT injection when the path is processed. No public exploit or KEV listing exists; however, the vendor-merged PR test suite contains a working injection payload, and the impact - falsification or suppression of FIM integrity alerts - directly undermines the product's core security monitoring function.
Unauthenticated access to REST API routes in the Membership For WooCommerce WordPress plugin (all versions before 3.1.2) exposes any user's membership plan details due to a broken authentication pre-check. The plugin compares a supplied consumer secret against one that was never generated, meaning the authentication gate collapses entirely on sites where the API is enabled but no consumer key pairs have been created. No public exploit identified at time of analysis; EPSS at the 6th percentile confirms exploitation remains theoretical, though the attack path is trivially simple once the prerequisite configuration is confirmed.
TrueBooker WordPress plugin versions before 1.2.7 exposes appointment booking customer records to unauthenticated remote attackers due to missing authorization checks on AJAX action handlers. Any remote attacker can retrieve personally identifiable information - including names, email addresses, phone numbers, and postal addresses - belonging to customers who booked appointments. No active exploitation is confirmed (absent from CISA KEV), but the attack is fully automatable per SSVC, making scripted mass-harvesting of customer PII across vulnerable WordPress installations a realistic concern.
WP Directory Kit WordPress plugin before version 1.5.7 exposes user data through a public AJAX endpoint that performs no authorization checks and returns raw, unfiltered database rows. Unauthenticated remote attackers can call this endpoint to enumerate usernames and email addresses of users assigned the plugin's own custom roles, enabling follow-on attacks such as phishing or targeted credential stuffing. No public exploit code or CISA KEV listing exists, and the EPSS score of 0.16% (5th percentile) reflects negligible automated exploitation probability, though the trivially low attack complexity makes manual exploitation straightforward against any exposed installation.
Unauthenticated deletion of arbitrary appointment, booking, and payment records is possible in the TrueBooker WordPress plugin before version 1.2.7 due to a missing authorization check in an AJAX action handler. Any remote visitor - with no account or credentials - can target and permanently destroy booking data across the entire installation. No public exploit has been identified at time of analysis, and EPSS sits at 0.15% (4th percentile), consistent with the niche deployment footprint of this plugin; however, SSVC flags the attack as automatable, meaning mass-deletion of records across vulnerable sites via scripted requests is technically feasible.
TrueBooker WordPress plugin versions before 1.2.7 allows fully unauthenticated remote users to manipulate arbitrary appointment statuses and trigger notification emails to affected customers through an unprotected AJAX action. The CVSS vector (PR:N/AC:L/AV:N) confirms zero authentication or configuration prerequisites, making every active installation of the plugin a viable target. No public exploit has been identified at time of analysis, and the EPSS score of 0.15% at the 4th percentile indicates very low observed exploitation activity, consistent with the niche footprint of this specific booking plugin.
Unauthenticated financial data exposure in the YayCurrency WordPress plugin (all versions before 3.3.5) allows any remote attacker to enumerate store order totals, vendor earnings, balance ledgers, and withdrawal histories without credentials. The vulnerability stems from missing capability and ownership checks on multiple multi-vendor integration REST or AJAX handlers, which are fully reachable by unauthenticated users. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the automatable nature of the attack - iterating numeric identifiers - makes mass enumeration trivially scriptable.
Cross-site request forgery in OpenEMR's DICOM viewer (versions before 8.3.0) allows an unauthenticated attacker to force an authenticated user holding 'Patients - Documents' permissions to issue arbitrary state-changing requests to OpenEMR endpoints, including forced logout. The unsanitized reflection of the `web_path` GET parameter in `library/dicom_frame.php` is the root mechanism: a crafted URL delivers the malicious payload via the victim's own authenticated session. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stack out-of-bounds write in Zephyr RTOS's NVS settings backend affects all tracked versions via three sites in settings_nvs.c that use nvs_read()'s unclamped return value as a NUL-terminator index into a fixed 74-byte stack buffer. An actor with write access to the raw flash partition backing the settings subsystem can plant an oversized name entry that causes a single-byte stack write at an attacker-controlled offset whenever settings_load() or settings_save() processes it, reliably crashing the device. No public exploit identified at time of analysis; upstream fix is available at commit e79a0db but the exact first patched release is not independently confirmed.
Elevation of privilege in Dell PowerPath for Windows (versions 7.2 through 8.0 SP1) allows a low-privileged local attacker to gain elevated system privileges through improper privilege management (CWE-269). Dell has published security advisory DSA-2026-167 confirming the flaw and releasing a fix; the CVSS 3.1 base score is 5.3 (Medium), reflecting the local-only attack vector and limited scope. No public exploit code or active exploitation has been identified at time of analysis.
Cross-community post featuring abuse in Lemmy allows authenticated community moderators to manipulate post visibility across unrelated communities via crafted federated ActivityPub activities. Affected versions span 0.19.0 through 0.19.18 (stable) and all alpha builds prior to 1.0.0-alpha.20. A moderator legitimate in one community can send crafted CollectionAdd or CollectionRemove activities targeting posts in communities they have no authority over, injecting content into or removing it from featured feeds without authorization. No public exploit has been identified and the issue is absent from CISA KEV; vendor-released patches are available in 0.19.19 and 1.0.0-alpha.20.
OS command injection in nnn file manager version 5.2 allows arbitrary shell command execution when a victim navigates to a directory containing a crafted filename and the preview-tabbed feature is triggered. The unsanitized filename variable is interpolated directly into a generated shell command, enabling any attacker capable of placing a maliciously named file on a shared filesystem, removable media, or inside a delivered archive to execute code with the privileges of the victim's nnn process. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, but the realistic social-engineering delivery path against developer and power-user workstations - populations that routinely extract archives and browse shared mounts - makes it operationally relevant despite the moderate CVSS score.
Shell command injection in nnn file manager version 5.2 allows an attacker who controls a directory name on a shared filesystem, removable media, or inside an extracted archive to execute arbitrary shell commands with the privileges of the nnn process. The unsanitized path variable is embedded directly into shell commands generated by nnn's batch copy and move workflows, enabling a single-quote escape followed by shell metacharacters in a directory name to break out of the intended string context. No public exploit has been identified at time of analysis, but exploitation requires only that the victim navigate into the crafted directory and initiate a batch copy or move operation.
Reflected XSS and XML injection in the J-BusinessDirectory Joomla extension (cmsjunkie.com, versions prior to 6.2.3) exposes site users to client-side script execution via a crafted link. The companyName HTTP request parameter is written directly into an XML attribute without output encoding, allowing attacker-controlled markup to be reflected in server responses. No public exploit code has been identified and the flaw is not listed in CISA KEV, but the unauthenticated attack vector makes it a realistic phishing-leveraged threat against any publicly accessible site running the affected extension.
Open redirect in YOOtheme Zoo extension for Joomla (versions prior to 4.1.64) allows unauthenticated network attackers to redirect authenticated users to arbitrary external URLs. The vulnerability exists in CommentController::twitterAuthenticate(), where the referer request parameter is forwarded without validation directly to setRedirect(). No public exploit code has been identified at time of analysis, and no active exploitation is confirmed via CISA KEV.
CSS sanitizer bypass in maalfer Pentestify 1.2.0-2.3.2 allows an authenticated low-privilege user to inject CSS that victim users' browsers silently execute, leaking their real IP address and User-Agent string to an attacker-controlled endpoint. The root cause (CWE-180) is that the report theme sanitizer evaluates its blocklist against raw user input before decoding CSS hex escape sequences, so the literal substring 'url(' never appears in the checked text and the block is trivially evaded using sequences like '\75 rl('. No active exploitation is confirmed (not in CISA KEV) and no standalone public exploit code has been identified, though the Secur0 advisory and vendor commit together form a near-complete reproduction recipe.
HTML injection in M-Files Web before version 26.8.16330.2 enables authenticated attackers to inject malicious HTML into web UI elements that are subsequently rendered in the browsers of other authenticated users, constituting a stored cross-site scripting (XSS) primitive. The attack requires valid low-privileged credentials and passive victim interaction, constraining opportunistic mass exploitation, but the risk is meaningful in multi-user enterprise deployments where document management workflows create natural injection surfaces. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Reflected XSS in OpenEMR's patient portal template import handler allows a remote unauthenticated attacker to craft a malicious URL that executes arbitrary JavaScript in the browser of any authenticated Forms Administrator who visits it, enabling session hijacking with administrative privileges. The vulnerable parameter (`templateHtml` GET) was reflected directly into the page response in `portal/import_template.php` without sanitization, and the only prior protection - a naive `<script` tag blacklist - was trivially bypassable with event-handler payloads. A vendor-released patch is available in OpenEMR 8.3.0 and no public exploit is identified at time of analysis.
Stored cross-site scripting in OpenEMR's patient portal template import handler (all versions before 8.3.0) lets any authenticated Forms Administration user persist arbitrary HTML or JavaScript by uploading a crafted template file, because the prior defense was a trivially-bypassed blocklist rather than proper sanitization. The payload executes in the browser of every other Forms Administration peer who subsequently opens the template in the Summernote HTML editor, enabling session-token theft or privilege escalation within the EMR administrative context. No public exploit has been identified at time of analysis; vendor-released patch OpenEMR 8.3.0 is available.
Cross-site scripting in acmailer CGI and acmailer DB (Extra Innovation Inc.) allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in victim browsers when users interact with attacker-crafted content. Both distribution variants - the CGI-based and the database-backed editions - are confirmed affected per CPE data and JPCERT coordination (JVN#47716829). No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
XML External Entity (XXE) injection in the XSLTransformer component of pkp-lib - the shared PHP library underlying Open Journal Systems, Open Monograph Press, and Open Preprint Systems - allows high-privileged authenticated users to force server-side external entity resolution during XSLT processing, enabling local file disclosure and potential server-side request forgery. Affected branches span all three actively maintained release lines (3.3.x, 3.4.x, 3.5.x) with vendor-released patches confirmed for each. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Credential exposure in the AD LDAP app for Splunk SOAR (versions below 2.3.8) allows any authenticated user holding an action-execution role to trigger a full connector process environment dump to a persistent plaintext debug log file, disclosing sensitive credentials such as LDAP bind secrets or service account tokens. The CVSS scope-changed vector (S:C) reflects that the exposed credentials extend impact beyond the SOAR platform itself to the underlying Active Directory environment. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis; however, patch version 2.3.8 is available and should be applied promptly given the potential for AD credential theft.
Server-side request forgery in Cisco Packaged Contact Center Enterprise and Unified Contact Center Enterprise enables authenticated remote attackers to coerce the affected device into issuing arbitrary outbound network requests on the attacker's behalf. Exploitation requires valid user credentials and targets specific HTTP request handling endpoints where input validation is improperly enforced, as described in Cisco Security Advisory cisco-sa-ucce-pcce-ssrf-TghHxD. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in a monitored but not immediately crisis-level category.
Memory exhaustion in Wazuh's cluster protocol allows an authenticated cluster node to crash the master by sending unbounded allocation requests via the new_str command or the divided-message reassembly path. Affected deployments span versions 3.9.0 through 4.14.4 and 5.0.0-beta1, with the primary operational impact being disruption of agent connectivity and alert processing across the monitored environment. No public exploit has been identified at time of analysis; however, the published patch diff fully exposes both vulnerable code paths, lowering the barrier for future exploit development.
Out-of-bounds read (CWE-125) in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 exposes a remotely reachable attack surface that allows unauthenticated network attackers to cause a denial of service under high-complexity conditions. The CVSS vector also records a limited integrity impact (I:L), which is inconsistent with the description's exclusive mention of denial of service and warrants verification against the vendor advisory. No public exploit code or active exploitation has been identified; a vendor patch is available from IBM.
CSS injection in M-Files Web before version 26.8.16330.2 permits an authenticated vault administrator to embed arbitrary CSS into the web interface, visually manipulating the UI rendered to all other vault users. The CVSS 4.0 vector (PR:H/UI:P) confirms exploitation is gated behind high-privilege admin credentials and requires passive victim interaction, substantially constraining the realistic threat surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in the 10Web Booster WordPress plugin (all versions before 2.33.5) enables unauthenticated attackers to persist malicious JavaScript in the HTML page head by exploiting a broken access token check on an otherwise-restricted request handler. Once injected, the payload fires automatically in the browser of every anonymous visitor to the affected page, without any further attacker interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection path and stored (persistent) nature of the payload make this more operationally impactful than the raw CVSS 4.7 score suggests.
Stored cross-site scripting in the Grav API Plugin (all versions prior to 1.0.2) allows an authenticated attacker holding api.media.write permission to upload a malicious SVG file whose embedded JavaScript executes in any victim's browser that opens the file. The upload pipeline in HandlesMediaUploads::processUploadedFile() checks the SVG filename extension but omits the Security::sanitizeSVG() call, so script content passes through unmodified and is later served as Content-Type: image/svg+xml, triggering browser-side execution. Successful exploitation enables session token theft and impersonation of the victim; no public exploit has been identified at time of analysis, and vendor-released patch version 1.0.2 is available.
Cross-site request forgery (CSRF) in the J-BusinessDirectory Joomla extension (versions prior to 6.2.3 by cmsjunkie.com) allows attackers to trick authenticated users into performing unauthorized state-changing actions across a broad set of unprotected endpoints. Missing CSRF tokens span both frontend operations - contact forms, cart, bookmarks, file uploads, messages, and AI text generation - and sensitive administrator actions including demo-data wipe, app install, cache archiving, and mobile push notification dispatch. No public exploit or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 4.6 reflects mandatory victim interaction and the requirement for an authenticated session.