Information disclosure and denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 stem from an out-of-bounds read (CWE-125) reachable over the network, letting a remote attacker read sensitive memory contents or crash the affected service. The vulnerability carries a CVSS 9.1 rating driven by high confidentiality and availability impact, though EPSS places exploitation probability very low (0.19%, 10th percentile) and CISA's SSVC framework records no known exploitation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file upload in the Media Library Assistant WordPress plugin (versions 3.39 and earlier) lets an authenticated user with Author-level access upload files of dangerous types, typically leading to remote code execution and full site compromise. The flaw was reported by Patchstack and is tracked as CWE-434; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV. The CVSS 9.1 rating reflects the high impact and scope change, though the practical barrier is that an attacker must already hold an Author account.
Sandbox escape in asteval allows any attacker who can supply expressions to `Interpreter.eval()` to raise `SystemExit`, `KeyboardInterrupt`, `GeneratorExit`, or `BaseException`, bypassing both `run()` and `eval()` exception handlers - which catch only `Exception` - and terminating or disrupting the calling process. All asteval versions through 1.0.6 are affected; version 1.0.9 resolves the issue. No active exploitation has been confirmed (not in CISA KEV), but a working proof-of-concept covering all four variants is included in the public advisory GHSA-89v8-rhwq-hf77, and this is a third distinct sandbox-escape class in asteval following CVE-2025-24359 and GHSA-vp47-9734-prjw.
Man-in-the-middle impersonation of onion services in Tor before 0.4.9.11 exploits a race condition in rendezvous point circuit negotiation, allowing a malicious relay operator acting as the rendezvous point to substitute itself for the intended onion service before the legitimate service completes authentication. The flaw affects all Tor application versions prior to 0.4.9.11 across all platforms. No public exploit code or active exploitation has been identified at time of analysis, but successful exploitation yields total interception and modification of traffic the client believes is reaching a private onion service.
Remote code execution in Sony XAV-9500ES car media receivers is achievable via a classic buffer overflow in the device's RTSP server, exploitable by unauthenticated network-adjacent attackers without user interaction. Sending a crafted RTSP SETUP packet with an oversized field overflows a fixed-length buffer, corrupting memory and enabling arbitrary code execution in the device's context. Discovered and reported by Zero Day Initiative (ZDI-CAN-29042 / ZDI-26-472), a Sony vendor advisory and firmware update are available for affected firmware version 3.02.00; no public exploit code and no CISA KEV listing have been identified at time of analysis.
OS command injection in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables remote attackers holding low-privilege credentials to execute arbitrary OS commands on affected systems. The CWE-78 root cause - improper neutralization of shell-special characters before they reach an OS command - means a valid but unprivileged account is sufficient to achieve full confidentiality, integrity, and availability compromise. No public exploit code or active exploitation has been identified at time of analysis, though the SSVC framework rates the technical impact as total.
Privilege escalation in Microsoft Fabric exploits a relative path traversal flaw (CWE-23) to allow a low-privileged authenticated attacker to gain elevated permissions over the network. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack requires only a valid low-privilege account and no user interaction, making it accessible to any tenant user or compromised credential. Microsoft has released a patch via MSRC; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution is possible in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 via a stack-based buffer overflow exploitable by a remote attacker holding low-privilege credentials. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with a network attack vector and no user interaction required beyond authentication. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS of 0.56% (44th percentile) indicates limited current exploitation activity despite high potential impact.
Remote code execution in OpenSearch Dashboards 3.0.0-3.7.x allows an authenticated low-privileged user to fully compromise the server via a prototype pollution flaw in the Time Series Visual Builder (TSVB) plugin. By sending a crafted JSON payload to the metrics visualization API endpoint, an attacker can corrupt the Node.js object prototype chain and achieve arbitrary server-side code execution. Vendor-released patch is available at version 3.8.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution outside Chrome's sandbox via a heap-based buffer overflow in the Network component affects Google Chrome prior to 151.0.7922.173. An unauthenticated remote attacker can trigger the flaw by directing a target user to a crafted HTML page, achieving arbitrary code execution that escapes Chrome's sandbox boundary with full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit has been identified at time of analysis, and EPSS signals low current exploitation probability (0.39%, 32nd percentile); however, the sandbox-escape characteristic elevates the strategic patching priority beyond what the EPSS alone would suggest.
Sandbox escape in Google Chrome's Linux Toolkit Theming component (prior to 151.0.7922.173) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. This is a two-stage attack: the renderer must be compromised first, then this CWE-913 flaw in the theming subsystem is leveraged to break out of the sandbox entirely, achieving host-level code execution. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS sits at 0.38% (32nd percentile), consistent with an absence of observed mass exploitation.
Remote code execution in Microsoft Azure Data Manager for Energy arises from an integer overflow or wraparound condition (CWE-190) reachable over the network by any authenticated low-privilege user. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only standard credentials, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though CISA SSVC rates the technical impact as total; Microsoft has released a patch via MSRC.
Use-after-free in Google Chrome's DOM implementation prior to 151.0.7922.173 enables remote unauthenticated attackers to execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page. The CVSS score of 8.8 reflects high confidentiality, integrity, and availability impact, though execution is constrained within the Chromium sandbox, limiting the blast radius without a secondary escape primitive. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.38%, suggesting active exploitation is not currently widespread despite the high severity rating.
Remote code execution outside the browser sandbox is possible in Google Chrome's Chromoting component (Chrome Remote Desktop protocol) prior to version 151.0.7922.173, exploitable by a remote attacker via crafted network traffic with user interaction. The root cause is a use-after-free (CWE-416) in Chromoting, enabling full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA SSVC reports exploitation as 'none', though the CVSS base score of 8.8 and sandbox-escape impact class the severity as Critical per Chromium's own rating.
Privilege elevation in Google Chrome's Import feature before version 151.0.7922.173 enables sandbox escape and arbitrary code execution at the OS level, exploitable by a remote attacker who can deliver a crafted file and socially engineer a user into opening it. The vulnerability stems from CWE-250 (Execution with Unnecessary Privileges) within the Import component, yielding full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. No public exploit code has been identified at time of analysis, and SSVC confirms exploitation status as none, though the total technical impact rating and sandbox-escape primitive warrant prompt patching across all Chrome deployments.
OS command injection in OTRS Community Edition's PGP encryption module allows authenticated administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options, which are concatenated unsanitized into a shell command invoked during normal ticket operations. Exploitation requires pre-existing administrator-level access to the OTRS admin panel and is triggered automatically once a malicious configuration is saved and a PGP-involving ticket operation occurs. No public exploit has been independently confirmed beyond a researcher disclosure blog, and the vulnerability is not listed in CISA KEV at time of analysis.
Arbitrary OS command execution via ODMDIR environment variable manipulation affects IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, enabling local authenticated users to escalate privileges beyond their initial access boundary. The CVSS scope change (S:C) indicates that successful exploitation can compromise components outside the immediate process context - a critical concern for AIX systems hosting sensitive workloads. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but a vendor patch is available through IBM's support portal.
Local privilege escalation via buffer overflow in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 allows an attacker with low-privileged local access to execute arbitrary code with a changed scope, meaning impact can extend beyond the vulnerable component - particularly significant in VIOS hypervisor environments where guest-to-host or cross-partition compromise may be achievable. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) reflects low-friction exploitation once local access is established, with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis and EPSS is very low at 0.18% (8th percentile), but SSVC rates technical impact as total, warranting prioritization in Power Systems environments.
Path traversal in Dockge's stack name handling allows authenticated users to exfiltrate secrets from .env and Compose files belonging to any directory the server process can reach, and to recursively delete those directories. The flaw exists because validate() - which enforces a strict name allowlist - is only called from the save() code path; the socket handlers that service read and delete operations pass the raw user-supplied name directly to Stack.getStack without sanitization. Because Dockge routinely runs as root with access to the Docker socket, the reachable set encompasses the full host filesystem, not just managed stacks. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the bypass is mechanically trivial for any authenticated user.
Untrusted pointer dereference (CWE-822) in IBM AIX's Virtual SCSI (vSCSI) initiator driver allows a low-privileged local user within a client LPAR to trigger kernel memory corruption, with outcomes spanning denial of service, privilege escalation, or full compromise of the client LPAR kernel. Affecting IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, the CVSS 3.1 score of 8.8 with scope change (S:C) reflects the cross-LPAR isolation risk inherent in PowerVM virtualization environments where VIOS mediates I/O for multiple tenants. No public exploit code or active exploitation has been identified at time of analysis; however, CISA's SSVC framework rates the technical impact as total, meaning successful exploitation fully undermines the security of the affected system.
Arbitrary code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is enabled by an integer underflow that triggers an out-of-bounds memory write, allowing a local low-privileged attacker to execute code with elevated or host-level impact. The CVSS Scope:Changed metric indicates exploitation may allow breakout beyond the initially compromised component - particularly significant in PowerVM VIOS, where a VIOS partition compromise could affect the underlying hypervisor or other hosted LPARs. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Local code execution via buffer overflow affects IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1, allowing a low-privileged local attacker to execute arbitrary code with a scope change that can compromise components beyond the initially vulnerable boundary. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C) indicates exploitation requires only a local shell with standard user privileges and no interaction, yet the scope change elevates the impact to full CIA triad compromise. No public exploit identified at time of analysis, and a vendor-released patch is available from IBM.
Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 allows an unprivileged local user to execute arbitrary payloads as root via the cmdnim utility. The CVSS vector (AV:L/AC:L/PR:L/S:C/C:H/I:H/A:H) confirms that any standard authenticated user account is sufficient to achieve full root-level code execution with no user interaction and no special configuration required. No public exploit has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Privilege escalation via heap-based buffer overflow affects IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, enabling a local attacker with standard user-level access to gain elevated - potentially root-level - privileges on the affected system. The CVSS scope-changed (S:C) rating confirms that successful exploitation extends control beyond the attacker's initial security context, threatening the entire host including virtual machine management infrastructure on PowerVM. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory node 7283858.
Remote code execution in ATutor 2.2.4 is achievable by any authenticated instructor through a path traversal flaw in the ZIP extraction functionality. An attacker uploads a crafted ZIP archive containing a malicious .phtml file at a directory-traversing path, causing the file to be written into the web root and executed with web server process privileges. No patch exists and none is forthcoming - ATutor is end-of-life - meaning affected deployments face a permanent, unmitigated RCE exposure; no public exploit code has been identified at time of analysis.
Denial-of-service in Bandit (Elixir HTTP server) versions 0.3.4 through 1.12.4 allows unauthenticated remote attackers to pin an unbounded number of HTTP/2 stream processes indefinitely by exploiting the absence of any timeout on the connection-level HTTP/2 send window queue. When a response body exceeds the default 65,535-byte connection window, the stream process blocks forever inside a synchronous GenServer call, and neither RST_STREAM frames nor periodic PING keepalives free the stalled resources in vulnerable versions - the attacker can keep the connection alive with PINGs specifically to defeat the transport read timeout. No public exploit code has been identified at time of analysis, but the attack primitive requires no authentication and is repeatable across streams and connections at the cost of one idle socket each.
Unauthenticated file disclosure in the Frauscher FDS 102 Field Detection System web interface exposes sensitive railway operational data - including full backup archives and configuration files - to any network-reachable attacker via direct HTTP GET requests. The affected endpoints at /FdsBackup.zip and the /downloads/* directory serve files without session validation, a violation of CWE-306 (Missing Authentication for Critical Function). No CISA KEV listing or public exploit has been identified at time of analysis, but the trivial exploitability - no credentials, no complexity, no user interaction - makes this a high-priority exposure for any railway operator with network-accessible FDS 102 deployments.
Remote code execution in n8n workflow automation platform (versions before 2.33.4 and 2.34.x before 2.34.1) arises from a path traversal flaw in the @n8n/workflow-sdk MCP node-schema loader. An authenticated user holding global:member privileges can supply a crafted node type string containing path-traversal sequences, causing the loader to resolve and execute an arbitrary file on the server filesystem as a Node.js module within the n8n main process. No public exploit has been identified at time of analysis and the vulnerability is not in the CISA KEV catalog, but the low privilege requirement and straightforward exploitability make this a high-priority patch for all self-hosted n8n deployments.
Zip-slip path traversal in Frauscher FDS 102 enables a high-privileged remote attacker to overwrite arbitrary files on the server and achieve full system compromise. By uploading a specially crafted ZIP archive containing entries with directory traversal sequences (e.g., ../../etc/cron.d/backdoor), an authenticated attacker can escape the intended extraction directory and plant executable content in sensitive filesystem locations. No public exploit code or active exploitation has been identified at time of analysis, but the direct path from file write to code execution makes this a critical post-authentication escalation risk in industrial environments.
Unrestricted file upload in the ATutor Gameme module allows any authenticated user to achieve remote code execution on the web server. The module stores uploaded files in a web-accessible directory before validating their content or type, meaning a malicious server-executable script (e.g., PHP webshell) can be uploaded and immediately retrieved via HTTP to trigger execution as the web server process user. ATutor 2.2.4 is confirmed vulnerable; the product is end-of-life with no patch available or planned.
Session hijacking in Frauscher Sensortechnik FDS 102 versions 2.13.0 through 2.13.3 allows a remote attacker with a low-privileged account to fully compromise active administrator sessions without knowing the administrator's password. The device writes live plaintext session identifiers for authenticated users into downloadable error log archives (CWE-532), enabling any authenticated low-privileged user to extract and replay admin tokens. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack requires no specialized tooling and only minimal network access.
SQL injection and authentication bypass in Genians Genian NAC (V4.0, V5.0) and ZTNA (V6.0) expose sensitive backend data to remote unauthenticated attackers via crafted data queries. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special attack prerequisites, consistent with the authentication bypass tag. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the unauthenticated, low-complexity nature warrants prompt patching across all three product lines.
Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of service without authentication. The flaw arises in evtag_unmarshal_header, where a uint32 payload length decoded from attacker-controlled input is implicitly cast to a signed int; values exceeding INT_MAX produce negative or truncated results that flow into allocation sizing in evtag_unmarshal_string, causing a wrapped allocation request and crash. No active exploitation has been confirmed (not in CISA KEV), but the network-accessible, unauthenticated attack surface and a publicly available upstream fix make this a straightforward patching priority for any consumer of the libevent evtag interface.
Out-of-bounds read in libevent's tagged RPC decoder crashes any application that decodes attacker-controlled tag data using the evbuffer API, affecting all 2.1.x releases prior to 2.1.13 and all 2.2.x alpha releases prior to 2.2.2-alpha. The flaw in decode_tag_internal causes the byte-iteration loop to walk the full logical buffer length while only a smaller pullup window is physically contiguous, allowing a crafted 6-byte fragmented tag to drive reads past valid memory and abort the process. No active exploitation is confirmed and no public proof-of-concept exists; fixed releases are available on GitHub and should be applied promptly given libevent's broad embedding across network-facing software.
Privilege escalation in FreeIPA allows an attacker with high LDAP write privileges to create a rogue service principal that impersonates a privileged existing one, bypassing the uniqueness constraint enforced by the 389-ds directory server. The flaw arises because 389-ds fails to recognize equivalent representations of the same Kerberos principal name (CWE-706), enabling the creation of a shadow principal that Kerberos treats as legitimate. If exploited, an attacker can acquire valid Kerberos service tickets for sensitive services, with full domain compromise as the realistic worst-case outcome. No public exploit exists and CISA KEV does not list this CVE, though SSVC rates the technical impact as total.
OS command injection in vsDesk's Task Scheduler component enables authenticated administrators to execute arbitrary operating system commands on the underlying server due to insufficient input filtering. Affecting at least vsDesk 11.06.02, the flaw - discovered and reported by Kaspersky - can be leveraged to disrupt web server operations, exfiltrate sensitive data, or achieve full server compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation requires high-privilege authenticated access, which meaningfully constrains opportunistic attack scenarios.
Arbitrary file read and write in n8n's Snowflake node allows an authenticated low-privileged user to exfiltrate or overwrite files on the n8n host by injecting Snowflake client-side commands (PUT/GET) into the Execute Query input field, bypassing n8n's own file-access restrictions. Affected versions span n8n before 1.123.69, all 2.x builds before 2.33.4, and 2.34.x before 2.34.1, as confirmed by vendor advisory GHSA-r4j2-j3wm-q689. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.7 and the low barrier to exploitation - requiring only n8n credentials plus access to a Snowflake connection - make this a high-priority remediation.
Azure Stack HCI exposes sensitive information to unauthenticated remote attackers via observable response discrepancy (CWE-204), where the system returns distinguishably different responses to distinct inputs, enabling enumeration or inference of confidential data without credentials. The CVSS 3.1 vector's Changed scope (S:C/C:H) signals that the disclosed information extends beyond the vulnerable component - significant in a hyperconverged platform managing compute, storage, and networking workloads with Azure integration. No public exploit code has been identified at time of analysis, but a vendor patch is available through the Microsoft Security Response Center.
Microsoft Partner Center exposes cross-tenant information to unauthenticated network attackers via an authorization bypass rooted in user-controlled key manipulation (CWE-639). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H) indicates low-complexity, scopechanging exploitation that can reach confidential partner or customer data beyond the attacker's own organizational boundary. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Remote code execution is achievable on the Frauscher FDS 102 field data server when a high-privileged attacker uploads a PHP webshell and retrieves it directly via /uploads/<filename>.php, bypassing file type validation entirely (CWE-434). All versions appear affected per the wildcard CPE string reported by CERTVDE in advisory VDE-2026-078. Full system compromise - including loss of confidentiality, integrity, and availability - is the confirmed worst-case impact, with particular significance in railway operational technology environments where the FDS 102 manages sensor and axle-counting infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Catastrophic regex backtracking in NLTK's TweetTokenizer (all versions before 3.10.1) allows unauthenticated remote attackers to stall Python service processes by submitting a few kilobytes of crafted text containing alternating domain label separators. Because TweetTokenizer is explicitly designed to process untrusted social-media input, every public-facing API or pipeline that passes user text through TweetTokenizer.tokenize() or casual_tokenize() is directly exposed to per-request denial of service with no authentication required. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV; the fix is confirmed available in NLTK 3.10.1.
Native off-heap memory exhaustion in netty-incubator-codec-ohttp (versions before 0.0.23.Final) allows unauthenticated remote attackers to cause a gateway denial-of-service by repeatedly sending OHTTP requests with invalid ciphertext. Each request that fails AEAD tag verification causes the pre-allocated pooled direct ByteBuf to leak permanently, because the decryption path lacks a try/finally guard around the buffer release. Sustained malformed-request flooding will exhaust JVM native direct memory, crashing or severely degrading the OHTTP gateway process. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds read in libexpat through 2.8.3 allows remote unauthenticated attackers to crash any application that parses attacker-controlled XML with external entity resolution enabled. The flaw - introduced as a regression by the CVE-2026-66046 fix - causes dtdCopy() to allocate hash entries with the smaller sizeof(NAMED) instead of sizeof(NAME_AND_DEFAULT_ATTRIBUTE), so storeAtts() subsequently reads the attIndex member past the end of the allocated block when handling external entity parsers created via XML_ExternalEntityParserCreate. No public exploit code or CISA KEV listing is identified at time of analysis; an upstream patch commit is available but a tagged release version has not been confirmed.
Uncontrolled resource consumption in jsoup through version 1.23.2 allows remote unauthenticated attackers to crash JVM-based applications by submitting deeply nested XML with unique namespace declarations per element. The XmlTreeBuilder component copied the full inherited namespace HashMap at every XML start element, producing O(n²) time and memory growth that exhausts heap and triggers an OutOfMemoryError. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the CVSS 4.0 score of 8.7 reflects zero authentication or complexity barriers - any application that feeds user-supplied XML through jsoup is directly at risk.
SQL injection and chained code injection in baserCMS before 5.3.0 allow authenticated administrators to exfiltrate arbitrary data from a PostgreSQL backend via BcDatabaseService.php. The attack chains two flaws: a backup restore mechanism that unconditionally executes PHP code outside class definitions in schema files upon loading, enabling an admin to plant malicious table names, which are then passed unsanitized into SQL statements across sequence update, CSV export, and table management operations. Error-based SQL injection against the PostgreSQL backend can then retrieve database version, schema contents, and sensitive application data. No public exploit has been identified and this CVE is not in CISA KEV, but the VulnCheck advisory provides sufficient technical detail to guide exploitation by motivated actors.
Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacker to inject a persistent JavaScript payload via a crafted HTTP User-Agent header submitted during order creation. The payload is stored in the order database and executes in the Joomla administrator's browser when they open the Admin Order View, placing admin sessions at risk of hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in iCagenda Joomla extension versions 4.0.8 through 4.0.12 allows an authenticated event submitter to inject persistent JavaScript payloads via the `image` and `file` fields of the frontend 'Submit an Event' form. The injected script executes in any viewer's browser upon rendering the affected event page, with highest consequence when a Joomla administrator previews or approves the submission, enabling session hijacking and full backend compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of this XSS elevates risk above reflected variants due to its persistence and elevated-privilege victim profile.
CSRF in the Frauscher FDS 102 web interface (versions 2.0.0 through 2.13.3) allows a low-privileged remote attacker to coerce authenticated users into executing unintended actions by directing them to a crafted malicious web page. The CVSS 4.0 score of 8.6 reflects high confidentiality, integrity, and availability impact against the vulnerable system, driven by the absence of complexity requirements and the low privilege bar for the attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, though the industrial railway context of this product elevates operational risk if exploited.
Stored XSS in Shaarli versions prior to 0.16.3 enables administrator account takeover through a low-effort social engineering chain requiring only that an administrator bookmark an attacker-controlled URL. The permalink handler in BookmarkListController.php writes raw bookmark titles into the HTML <title> element without HTML escaping, and Shaarli's built-in metadata fetcher copies remote page titles verbatim - meaning an attacker who controls a webpage's title silently plants a persistent payload the moment any admin bookmarks that URL. The injected script then executes in the Shaarli origin for every subsequent visitor to the permalink, including the administrator on first save, creating a one-shot session-hijacking path; no public exploit has been identified at time of analysis.
Password change authorization bypass in WeGIA before 3.9.2 allows any authenticated user to permanently take over their own account - or one they hold temporary session access to - without supplying the existing password. The `alterarSenha` method is unconditionally excluded from permission checks in `controle/control.php`, and manipulating the `redir` parameter routes password-change requests through `verificarSenhaConfig()` rather than the credential-verifying `verificarSenha()`, stripping the old-password requirement entirely. No public exploit code has been identified at time of analysis, though the mechanically simple parameter manipulation lowers the practical bar significantly.