Multipart body parsing in Cesanta Mongoose before 7.22 can be manipulated by a remote unauthenticated attacker to truncate headers, filenames, or boundary values through injection of a lone carriage return or line feed. The logic error in mg_http_next_multipart() causes CRLF-scanning loops to terminate prematurely on any single CR or LF character rather than requiring the full two-byte CRLF sequence, enabling content-type spoofing that can cause downstream application logic to accept dangerous or disallowed content. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; the fix is confirmed in release 7.22.
Unauthorized page-content disclosure in django CMS prior to 5.0.8 allows any staff account to retrieve the plugin structure of view-restricted pages by requesting the render_object_structure endpoint, which omits the user_can_view_page() authorization check enforced by the edit and preview endpoints. Exposed data includes plugin short descriptions - link names, target URLs, and text snippets - constituting genuine content disclosure, not merely structural metadata. No public exploit has been identified at time of analysis; exploitation is constrained to authenticated staff users on sites with per-page view restrictions explicitly configured.
Unauthorized content disclosure in django CMS prior to 5.0.8 allows authenticated staff users to exfiltrate plugin content - including secret text, link names, and URLs - from restricted pages and placeholders they are not authorized to access. The vulnerability resides in the copy_plugins admin endpoint (cms/admin/placeholderadmin.py), where the clipboard copy paths validate only the destination (the user's own clipboard) while accepting attacker-controlled source_placeholder_id and source_plugin_id parameters without any source-side authorization check. No active exploitation is confirmed by CISA KEV, but the technical advisory, patch diff, and regression tests are publicly available via GitHub security advisory GHSA-4xfr-4p46-gc6p.
Resource exhaustion in FreeIPA's OTP key processing path allows any low-privilege authenticated domain user to degrade the IPA authentication service. By submitting an oversized One-Time Password key, the user triggers an unbounded decode/re-encode cycle (CWE-770) that consumes excessive CPU and memory, degrading availability for all dependent systems and users. No public exploit code exists at time of analysis, and this CVE is not listed in CISA KEV; however, the AV:N/PR:L CVSS vector means any valid domain account on a network-accessible FreeIPA instance is sufficient to trigger the condition.
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables a local, low-privileged attacker to crash the affected system, resulting in a denial of service. The CVSS scope-change metric (S:C) is particularly significant in the PowerVM context: a crash of the VIOS host can simultaneously disrupt I/O services for all co-hosted guest logical partitions (LPARs) sharing that VIOS, amplifying the blast radius well beyond the directly exploited node. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Cross-site WebSocket hijacking in Mailpit 1.29.0-1.30.5 exposes live email metadata to any website the developer visits, due to a percent-encoding bypass in the origin-check middleware. The origin guard inspects the raw `RequestURI` for an `/api/` prefix, but Go's `ServeMux` routes on the percent-decoded path - so a request to `/%61pi/events` skips the guard and reaches the `/api/events` WebSocket handler, whose upgrader unconditionally accepts every origin. An attacker-controlled page can receive a live stream of message IDs, headers, subjects, and body snippets from a default, unauthenticated Mailpit instance; a working proof of concept is documented in GHSA-8r62-w5wh-fc5m, though no CISA KEV listing exists at time of analysis.
Unauthorized cross-tenant record reassignment in Laravel Backpack CRUD's HasMany and MorphMany relationship-saving logic allows authenticated low-privileged admin users to corrupt data across ownership or tenancy boundaries. The `attachManyRelation` flow processes submitted primary keys and applies attach, detach, null, or delete operations on related records without verifying that those records belong to the current parent model or fall within developer-defined relation scopes, a classic IDOR pattern classified as CWE-862. Affected versions are composer/backpack/crud 6.0.0-6.8.14 and 7.0.0-7.0.46; no public exploit code exists and CISA KEV listing has not been established, but the issue is confirmed by internal PHPUnit testing against Backpack's fixture suite.
Laravel Backpack CRUD versions prior to 6.8.14 (6.x branch) and 7.0.38 (7.x branch) allow any authenticated user to change the account's login email address without supplying their current password, enabling persistent account takeover that survives session termination. The asymmetry is stark: the password-change endpoint in the same controller enforces a Hash::check against the stored password, but the account-info update path passes the request directly to mass-assignment without an ownership challenge. No public exploit or CISA KEV listing has been identified, but the attack chain is low-complexity for anyone who can obtain a transient authenticated session.
Unscoped GitHub App installation token exposure in Tekton Pipelines-as-Code (openshift-pipelines/pipelines-as-code) allows any authenticated user with push access to one repository in a multi-repo GitHub App installation to read the Tekton task definitions from other private repositories in the same installation. By crafting a PipelineRun with a remote task annotation pointing at a private repository URL, the attacker causes Pipelines-as-Code to fetch and inline that repository's task YAML using the over-privileged installation token during webhook processing, producing a read-only confidentiality breach. No public exploit or CISA KEV listing exists at time of analysis; the EPSS signal is absent from provided data, but the low-complexity attack path and confirmed fix make this a prioritization candidate for any organization running multi-repository PAC installations.
Stored Cross-Site Scripting in the WP BASE Booking WordPress plugin (versions <= 6.3.2) allows subscriber-level authenticated users to inject malicious JavaScript into booking-related pages rendered for other users. The CVSS vector (PR:L, S:C) confirms that only a low-privilege subscriber account is needed to plant the payload, and a scope change occurs when the script executes in a victim's browser - typically an administrator. No public exploit code or active exploitation has been identified at time of analysis.
Broken Access Control in the Homlisti WordPress real estate theme (versions ≤ 3.1.2) allows authenticated subscribers to perform unauthorized write operations that should be restricted to higher-privileged roles. The CVSS vector (PR:L, I:H, AC:L) confirms low-privileged network-accessible exploitation with high integrity impact and no complexity barrier once a subscriber account is held. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.39) allows a subscriber-level authenticated user to inject malicious scripts into the media library that execute in the browser session of a higher-privileged user, such as an administrator, who subsequently views the affected content. The scope change indicated by the CVSS vector (S:C) means successful exploitation crosses from the plugin context into the victim's browser, enabling session hijacking or privilege escalation within the WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Altair WordPress theme (ThemeGoods) through version 5.2.2 permits unauthenticated remote attackers to invoke restricted functionality without authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position - any internet-reachable WordPress installation running the affected theme is exposed. Impact is bounded to partial integrity and availability degradation (C:N/I:L/A:L); no public exploit code and no CISA KEV listing have been identified at time of analysis.
Denial of service in FreeIPA's ipa-enrollment SLAPI plugin allows any authenticated LDAP client to crash the 389 Directory Server by sending a malformed extended operation. The flaw (CWE-476, null pointer dereference) is triggered by omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, causing the server to dereference a null pointer and crash. No public exploit or active exploitation has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this a credible threat against any RHEL Identity Management deployment.
HTTP chunked trailer smuggling in libevent before 2.1.13 and 2.2.2-alpha allows unauthenticated remote attackers to inject security-sensitive header fields - such as Authorization or X-Forwarded-For - via chunked transfer encoding trailers that libevent merges directly into its request header store. In deployments fronted by a reverse proxy, the proxy evaluates the original headers while libevent processes the attacker-supplied trailers as authoritative input headers, enabling authorization bypass, proxy-header spoofing, and cache poisoning. No public exploit has been identified at time of analysis; vendor-released patches exist in both stable and alpha release branches.
Authentication bypass in ATutor 2.2.4 allows unauthenticated remote attackers to impersonate any user, including administrators, by forging auto-login tokens without knowing the target account's password. The auto-login code path contains a token validation check whose required inputs remain uninitialized in certain execution branches, meaning an attacker who can determine a user's identifier and registration timestamp can generate a token the application accepts as legitimate. ATutor is end-of-life with no patch forthcoming; no public exploit has been identified at time of analysis, but the open-source codebase makes the token construction logic fully inspectable.
Unsalted MD5 password hashing in Ech0's `MD5Encrypt` function (`internal/util/crypto/crypto.go`) stores credentials in a format trivially crackable via rainbow tables or GPU-accelerated brute force. Versions 5.4.0 and 5.4.1 are confirmed affected; the migration comment in the fix explicitly labels the stored values as 'historical bare MD5' (历史裸 MD5), confirming no per-user salt was applied. Ech0 5.4.2 resolves this by backfilling existing hashes to a dedicated `user_local_auth` table and enabling lazy bcrypt upgrade on next login. No public exploit exists and no active exploitation has been confirmed.
Cleartext transmission of DDNS authentication credentials in TP-Link Omada business gateway routers exposes sensitive account information to network-positioned attackers. Nineteen distinct hardware models spanning the ER and DR product lines are affected, including the ER605, ER7206, ER8411, and multiple 4G outdoor variants. An attacker with visibility or control over the network path between the gateway and an external DDNS provider can intercept credentials and potentially hijack DDNS management - enabling unauthorized DNS record manipulation for the affected deployment. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Predictable account activation tokens in ATutor 2.2.4 allow unauthenticated remote attackers to activate unconfirmed user accounts without access to the victim's email inbox. The account confirmation workflow generates tokens from insufficiently random values tied to user registration data (CWE-340), making the token space enumerable or guessable by an attacker who can observe registration patterns. No vendor patch exists or will be released - the product has reached end-of-life - and no public exploit code or CISA KEV listing has been identified at time of analysis.
SSRF protection bypass in n8n's SearXNG Agent tool allows authenticated users to reach internal network hosts that the platform's own security controls are supposed to block. Affected versions are n8n before 2.34.1 and 2.33.x before 2.33.4 when deployed with N8N_SSRF_PROTECTION_ENABLED=true. An attacker with permission to create SearXNG credentials and configure a personal agent can point the API URL at internal infrastructure - cloud metadata endpoints, internal APIs, or intranet services - and receive responses directly through the agent chat interface. No public exploit or active exploitation (CISA KEV) identified at time of analysis.
Server-side request forgery in decolua 9router ≤ 0.5.55 allows session-authenticated users (or unauthenticated callers when requireLogin is disabled) to reach internal network resources via the POST /api/provider-nodes/validate endpoint. The SSRF guard's IPv4-mapped IPv6 branch is structurally unreachable: WHATWG URL canonicalization rewrites dotted-quad notation to hextet form before the string regex is evaluated, so addresses such as http://[::ffff:7f00:1] (loopback) and http://[::ffff:a9fe:a9fe] (cloud metadata) pass unchecked. No public exploit has been identified at time of analysis, though the root cause and bypass technique are fully documented in the public GitHub issue and fix PR.
Revoked root certificates embedded in multiple Seiko Epson printers and scanners expose device communications to interception via man-in-the-middle attacks. Affected products continue to trust certificates that have been revoked, violating the chain-of-trust model defined by CWE-296, and allowing a suitably positioned attacker to decrypt or read transmitted data. No active exploitation has been confirmed (no CISA KEV listing), and the high attack complexity required for network positioning limits real-world exposure, but confidentiality of printer/scanner communications - potentially including scanned document content - is at risk.
Open redirect bypass in WebOb prior to 1.8.11 enables network-accessible, unauthenticated attackers to redirect users to attacker-controlled hosts by exploiting a URL normalization gap between WebOb's validation checks and Python's urllib.parse.urljoin. The flaw exists in Response._make_location_absolute(), Request.relative_url(), and _HTTPMove subclasses including HTTPFound - a space-prefixed protocol-relative or absolute URL passes SCHEME_RE and startswith('//') guards unchanged, then urllib.parse.urljoin silently strips the leading space on Python 3.10+, resolving the remainder as a valid off-host URL. No public exploit is identified at time of analysis; vendor patch is confirmed in version 1.8.11 and the attack surface is phishing and OAuth/SSO token theft requiring the victim to follow the redirect.
Sandbox escape in n8n's JavaScript Code node allows authenticated workflow authors to break out of the Node.js VM sandbox by polluting an unfrozen Function.prototype, ultimately recovering a reference to the host process's globalThis object. Affected are n8n deployments running versions prior to 1.123.69, 2.33.4, and 2.34.1 where users hold workflow creation and execution permissions. Full exploitation also requires that specific Node.js modules are present on the allowlist of the deployment's import configuration, raising practical complexity but making impact highly deployment-dependent. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery and MVG code injection in n8n's Edit Image node allows authenticated low-privilege users to issue blind outbound HTTP requests or read local files by injecting ImageMagick MVG primitives into the Draw Text operation. All n8n versions before 1.123.69 are affected, confirmed by vendor advisory GHSA-233r-fpgw-fx8x. No public exploit identified at time of analysis, but the High confidentiality impact in the CVSS 4.0 vector signals meaningful data exfiltration risk for instances co-located with sensitive internal services or cloud metadata endpoints.
Captive portal session management across multiple TP-Link Omada ER and DR series routers exposes unauthenticated session-termination functions to any attacker with adjacent network access, allowing forced logout of specific users or full session clearance without credentials. Nineteen hardware models running firmware prior to late June-July 2026 builds are confirmed affected per EUVD data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity combined with zero authentication requirements makes adjacent-network exploitation straightforward once an attacker is positioned on the same network segment as the captive portal service.
Path traversal during backup restore in Velero (vmware-tanzu/velero) allows an attacker who has compromised the object storage backend to overwrite arbitrary files on the Velero pod filesystem by uploading a malicious tarball containing filenames with directory traversal sequences. Targeted files include /etc/cron.d/ entries (enabling code execution within the pod), ~/.ssh/authorized_keys (enabling persistent SSH access), and ~/.kube/config (enabling full Kubernetes cluster credential theft). No patch had been released at the time of advisory publication, though fix version 1.18.1 is indicated in package metadata, suggesting the fix was released shortly after disclosure. No public exploit code or CISA KEV listing identified at time of analysis.
Path traversal in the Banks Python prompt-template library (all versions prior to 2.4.5) allows a low-privileged attacker to write arbitrary bytes to attacker-chosen filesystem paths accessible to the application process. DirectoryPromptRegistry.set() in directory.py constructs on-disk paths by directly interpolating unvalidated Prompt.name and Prompt.version values - enabling relative sequences like ../victim/foo or absolute paths to escape the configured registry root. The poisoned path persists in index.json and is reconstructed on subsequent registry loads, meaning exploitation survives application restarts. No public exploit or CISA KEV listing exists at time of analysis; a vendor-released patch is available as version 2.4.5.
Use-after-free and potential double-free in Tor's conflux subsystem before version 0.4.9.11 enables a malicious exit node to crash Tor clients by triggering memory corruption during circuit recovery. The defect activates when a recovery leg attempts to revive a conflux set whose last linked leg has already been deallocated, resulting in access to freed memory and a possible second free of the same object. No public exploit is identified at time of analysis, but exploitation requires only that an attacker control a malicious exit node within the Tor network, a non-trivial but achievable position for motivated threat actors.
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated attacker can exploit to modify shared resources, producing high integrity impact. The CVSS 3.1 score of 5.9 reflects the offsetting effect of high attack complexity (AC:H), which limits opportunistic exploitation to adversaries capable of precise timing control. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis.
Bypass of rDNS-based security controls in BunkerWeb prior to 1.6.13 allows unauthenticated remote attackers who control a PTR record to spoof trusted reverse DNS suffixes, circumventing the blacklist, greylist, and antibot modules. The root cause (CWE-350) is the failure to perform forward-confirmed reverse DNS (FCrDNS) validation - affected modules checked only that the PTR hostname suffix matched a trusted pattern without verifying the hostname resolves back to the client IP. No public exploit or CISA KEV listing has been identified; vendor-released patch version 1.6.13 is available.
STARTTLS response injection in aiosmtplib prior to version 5.1.2 allows an active network attacker to desynchronize SMTP command-response pairs by staging plaintext bytes that survive the TLS transport upgrade into the encrypted session. The root cause is that SMTPProtocol.start_tls in protocol.py fails to flush its internal _buffer before calling loop.start_tls, so any attacker-injected SMTP response lines appended after the legitimate 220 reply are subsequently parsed as if they arrived inside the TLS tunnel. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the CVSS AC:H rating confirms exploitation requires an active man-in-the-middle network position.
Broken access control in WP Data Access WordPress plugin versions 5.5.80 and earlier exposes protected data to unauthenticated remote attackers who can satisfy specific high-complexity exploitation conditions, allowing unauthorized read access to resources that should require authorization. Classified as CWE-862 (Missing Authorization) with a CVSS score of 5.9 (Medium), the flaw carries high confidentiality impact but no integrity or availability impact, consistent with unauthorized data read rather than modification. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Use-after-free memory corruption in libevent's evbuffer_add_buffer_reference (buffer.c) allows a caller that can drive a specific empty-buffer state to trigger process crashes or heap corruption in any application linking the library. Affected are libevent stable releases before 2.1.13 and development releases 2.2.0-alpha through 2.2.2-alpha; the root cause is that evbuffer_free_all_chains frees the initial empty chain without nullifying the three outbuf chain-tracking pointers, after which APPEND_CHAIN_MULTICAST dereferences the now-dangling pointer. No public exploit code and no active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for both stable and alpha branches.
Heap buffer overflow in msgpack-c through version 7.0.1 results from an integer overflow in msgpack_unpacker_expand_buffer, where unchecked size_t addition of the requested reservation size and current buffer usage wraps to near-zero on near-SIZE_MAX inputs, causing the allocator to receive a massively undersized target while the function falsely reports success to the caller. Integrations that pass attacker-controlled lengths to the msgpack_unpacker_reserve_buffer API - such as custom length-prefixed streaming transports - can trigger subsequent heap overwrites when the caller writes the full declared length into the undersized buffer. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires a specific non-default integration pattern not present in msgpack-c's own internal decode paths.
Heap buffer overflow in libvips prior to 8.18.3 allows up to 4032 bytes to be written beyond an allocated heap buffer during processing of untrusted uncompressed PPM images via custom source objects, potentially causing memory corruption or a process crash. The flaw exists specifically in vips_source_read_to_memory in libvips/iofuncs/source.c, where VIPS_MAX was used instead of VIPS_MIN when computing the remaining read size. No public exploit code exists and this is not listed in CISA KEV; the CVSS 4.0 score of 5.8 reflects meaningful constraints including local attack vector, high complexity, and a prerequisite of non-default custom source configuration.
Open redirect in Punk::OAuth2 before 0.03 for Perl allows an attacker to redirect authenticated users to an arbitrary external domain by exploiting a gap in the same_origin_path validation function. The return parameter in the OAuth2 login flow accepts backslash and tab characters that the WHATWG URL parser interprets as path/authority delimiters, enabling values like /\evil.example or tab-separated //evil.example to survive the check and become the post-login redirect target. No authorization code or access token is carried in the redirect, so the immediate impact is post-authentication phishing rather than token theft; no public exploit has been identified and EPSS sits at the 18th percentile.
Catalyst::Plugin::Static::Simple through 0.38 unconditionally marks all static file responses as publicly cacheable via Cache-Control: public, including responses to requests bearing an Authorization header. This means shared HTTP proxies may cache authenticated responses and serve them to subsequent unauthenticated requestors. The documented mitigation of setting expires to 0 is silently ignored, leaving operators with no effective means to restrict caching behavior until the patch is applied. No public exploit or CISA KEV entry exists; EPSS is 0.18% (8th percentile), indicating low opportunistic exploitation probability.
Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privileged caller to crash the hosting process by inducing a locking failure. When evhttp_start_ws_ succeeds but bufferevent_enable_locking_ subsequently fails, the cleanup function evws_connection_free calls TAILQ_REMOVE on a list the session was never inserted into, dereferencing an invalid pointer. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in 2.2.2-alpha.
Out-of-bounds read in liftoff-sr CIPster's TCP Encapsulation Receive Path allows remote unauthenticated attackers to crash or disrupt EtherNet/IP adapter availability. The vulnerability in `Encapsulation::ReceiveTcpMsg` (`encap.cc`) causes the function to return a success-indicating length value after silently discarding an oversized TCP payload, prompting the caller to parse an already-discarded buffer and triggering the out-of-bounds read. No public exploit identified at time of analysis per KEV, though publicly available exploit code exists per CVSS 4.0 E:P supplemental metric and VulDB disclosure.
Windows Remote Help versions 5.0.0.0 through below 5.2.1040.0 exposes an uncontrolled search path element (CWE-427) that enables an authorized local attacker with standard user privileges to deny service against the Remote Help application. The flaw stems from the application resolving executable dependencies or resources through a controllable or insufficiently constrained search path, allowing a low-privilege local user to interfere with path resolution and crash the process. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released a remediation in version 5.2.1040.0.
Out-of-bounds read in CIPster (liftoff-sr, commit 1802525be27d) allows remote unauthenticated attackers to crash the EtherNet/IP stack by sending a crafted ForwardOpen request with a manipulated product_code_ argument to the CipConnMgrClass::forward_open handler in cipconnectionmanager.cc. The underlying defect is a missing class-type validation in ConnectionData::ResolveInstances, which permits crafted connection paths to reference instances of unexpected CIP object classes, triggering memory access beyond valid bounds. A public proof-of-concept exploit exists per the CVSS 4.0 E:P supplemental metric and VulDB disclosure; the vulnerability is not listed in the CISA KEV catalog at the time of analysis.
SQL injection in code-projects Assessment Management 1.0 exposes the `/welcome.php` endpoint to remote unauthenticated database manipulation via the `userid` parameter. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or special configuration is required, and a public exploit is documented (E:P, GitHub PoC at github.com/niaoniaollll/cve/issues/8). Impact is rated Low across confidentiality, integrity, and availability, but the zero-barrier exploitation path and available PoC make this immediately actionable for any operator running this software.
Kernel memory disclosure in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 allows a local attacker with standard user privileges to read sensitive out-of-bounds kernel memory via an unspecified vulnerability. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only a local shell account with no elevated rights, making it viable for any authenticated local user or a compromised service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via the vendor advisory.
Uncontrolled resource consumption in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local high-privileged attacker to cause a denial of service by supplying crafted directory records to the vulnerable parsing component. The CVSS vector (AV:L/PR:H) confirms that exploitation is constrained to authenticated local actors with elevated privileges, limiting the realistic threat pool considerably. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Uncontrolled resource consumption in IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1, enables a local low-privileged attacker to exhaust system resources and trigger a denial of service condition. The vulnerability is classified under CWE-400 and carries a CVSS 3.1 base score of 5.5 with a local attack vector requiring low privileges. IBM has released a patch via advisory 7283858; no active exploitation or public proof-of-concept code has been identified at time of analysis.
Symlink following vulnerability in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to cause a denial of service - and potentially file corruption - through improper symbolic link validation (CWE-59). The CVSS vector (AV:L/AC:H/PR:L/I:H/A:H) indicates exploitation requires local access, a race-condition timing window, and results in both high integrity and availability impact despite the DoS classification. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; IBM has released a patch.
NULL pointer dereference in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 allows a local low-privileged attacker to crash the system, causing a denial of service. Exploitation requires high attack complexity, suggesting a race condition or specific system state must be induced. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog; a vendor patch is available via IBM support.
Reflected cross-site scripting in Cesanta Mongoose (all versions prior to 7.22) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser by crafting a percent-encoded URL path targeting the directory listing handler. The `mg_http_serve_dir()` and `listdir()` functions in `src/http.c` insert the decoded request URI directly into `<title>` and `<h1>` HTML elements without HTML entity escaping, and the resulting script executes in the Mongoose origin. Exploitation requires both that the server was compiled with `MG_ENABLE_DIRLIST` enabled and that a victim user is persuaded to visit the malicious link; no public exploit or CISA KEV listing is identified at time of analysis.
Stored cross-site scripting in Cesanta Mongoose's directory listing feature allows an attacker with filesystem write access to a served directory to plant a file whose name contains HTML or JavaScript markup; when any user browses that directory, the raw filename is reflected into the HTML page without escaping, executing arbitrary script in the Mongoose origin. All Mongoose versions prior to 7.22 with MG_ENABLE_DIRLIST enabled are affected. No public exploit or CISA KEV listing is confirmed at time of analysis; the vendor-released fix is available in Mongoose 7.22.