Sensitive deployment variables in Octopus Server can be exposed in clear-text within the deployment variable snapshot under certain unspecified circumstances, allowing authenticated users to read secrets that should remain masked. The vulnerability affects all versions of Octopus Server per CPE wildcard and carries a CVSS 4.0 score of 7.1 with high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis, and the conditional nature of the exposure suggests the blast radius is context-dependent rather than universal across all deployments.
Broken access control in the EPROLO Dropshipping WordPress plugin (versions <= 2.4.2) allows network-based attackers to bypass authorization checks and access restricted functionality without proper permission validation. The CWE-862 (Missing Authorization) root cause means the plugin fails to verify whether a requestor has rights to perform certain actions, enabling high-impact confidentiality exposure (C:H) and limited integrity impact (I:L). No public exploit code or active KEV listing is identified at time of analysis, though the unauthenticated nature of the bypass - per the CVE title - makes this accessible to a wide attacker pool.
Session hijacking in BigBlueButton prior to version 3.0.23 enables authenticated meeting participants to impersonate other active attendees by supplying a target's existingUserID to the inadvertently exposed /bigbluebutton/api/handleJoinExistingUser HTTP endpoint. The root cause is a Grails framework visibility error: the handleJoinExistingUser method was declared with def (public, routable) instead of private, making it directly callable over the network without authorization validation - allowing full session reuse without the target's credentials. No CISA KEV listing or public exploit code has been identified, but the low attack complexity and authenticated-participant attack surface make this a credible threat in active BigBlueButton deployments, particularly in education environments where meeting roles carry meaningful trust.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Advance Product Search WordPress plugin (by ThemeHunk) through version 1.4.8 allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session without any authentication. The CVSS scope-change indicator (S:C) confirms the vulnerability crosses the plugin's security boundary to affect the authenticated user's browser context, enabling session hijacking, credential theft, or malicious redirect. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit once a victim is socially engineered.
Out-of-bounds read in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables local low-privileged attackers to either extract sensitive memory contents or crash the system, producing a denial of service. The flaw (CWE-125) requires only a standard local user account with no additional configuration, making it relevant to any multi-tenant AIX or VIOS deployment where untrusted users share system access. No public exploit code exists and EPSS sits at 0.15% (5th percentile), and SSVC confirms no known active exploitation at time of analysis.
Uncontrolled recursion in django CMS prior to 5.0.8 allows an authenticated staff user to corrupt the plugin tree and deny service by exploiting a missing cycle guard in the move_plugin endpoint. By supplying the plugin's own primary key or a descendant's ID as the plugin_parent value in a crafted POST request, the attacker creates a parent-child cycle that causes the _get_descendants_cte and _get_ancestors_cte recursive CTE queries to loop indefinitely, exhausting database recursion limits and consuming web request workers. The same 5.0.8 release also patches a related information disclosure path where clipboard copy operations lacked source-side permission checks, allowing a staff user to exfiltrate plugin content from placeholders they have no access to - consistent with the 'Information Disclosure' tag on this advisory. No public exploit identified at time of analysis.
Heap out-of-bounds read in NanaZip's SquashFS LZ4 decompression handler exposes adjacent heap memory contents when a user opens a crafted archive, affecting all stable releases from 1.0.88.0 through 6.0.1697.x and all preview releases through 6.5.1741.x on Windows. The flaw stems from a sign-conversion bug that causes the decompressor to trust an attacker-inflated block size, allowing a controlled memcpy to read beyond the allocated heap buffer and place internal heap data into the extracted file output, or crash the process entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the memory disclosure primitive is meaningful for targeted attacks.
Unauthenticated cross-site scripting in the NotificationX Pro WordPress plugin (all versions through 3.1.4) allows a remote, unauthenticated attacker to inject malicious script into pages served to authenticated users, including administrators. The scope change (S:C) in the CVSS vector indicates the injected script executes in a browser context outside the plugin's own trust boundary, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though Patchstack has published a database entry for this vulnerability.
Reflected Cross-Site Scripting in the Flatastic WordPress theme (all versions through 2.0) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS Scope:Changed metric confirms the injected script crosses trust boundaries, executing in the victim's browser context with access to session tokens and the ability to perform actions on behalf of authenticated users. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated reflected or stored cross-site scripting in Form Maker by 10Web WordPress plugin (versions <= 1.15.46) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation requiring only victim interaction, with scope change affecting the browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has reported and documented the vulnerability.
Unauthenticated reflected cross-site scripting in Podlove Podcast Publisher for WordPress (versions 4.5.4 and below) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of any authenticated user who can be tricked into clicking a crafted URL. The scope-changed CVSS vector (S:C) confirms the vulnerability crosses the trust boundary from the plugin's context into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions against the WordPress installation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-authentication prerequisite makes social-engineering-based delivery straightforward.
Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers without any credentials to inject and execute arbitrary JavaScript in the context of authenticated users who interact with crafted content. The vulnerability carries a CVSS 3.1 score of 7.1 (High) with a scope change flag, meaning successful exploitation crosses the trust boundary from the plugin into the victim's browser session. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.
Unauthenticated cross-site scripting in the Paymob for WooCommerce WordPress plugin (versions 4.1.10 and earlier) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS scope-change flag (S:C) indicates the injected script can operate across origins, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis; the primary risk vector is opportunistic phishing or malicious link delivery targeting WooCommerce store customers or administrators.
Unauthenticated cross-site scripting in the SmartSMTP WordPress plugin (versions 1.2.0 and below) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any authenticated user who views the malicious content. The scope change confirmed by the CVSS vector (S:C) means impact extends beyond the injecting session to other users, including administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Swatchly - WooCommerce Variation Swatches for Products (versions ≤ 1.4.13) permits remote unauthenticated attackers to inject arbitrary JavaScript that executes in the browser context of site visitors or administrators who interact with a crafted URL or page. The scope-changed CVSS vector (S:C, UI:R, PR:N) indicates the injected script escapes the plugin's security context and runs under the victim's session, enabling session hijacking, credential theft, or malicious redirects against WooCommerce storefronts. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept code has been identified at time of analysis.
Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers to inject arbitrary JavaScript payloads that execute in the browsers of users who visit affected pages, including authenticated administrators. The CVSS:3.1 scope-changed vector (S:C) confirms that the attacker's script runs in a different security context than the vulnerable plugin itself, meaning a successful attack can affect the victim's authenticated WordPress session rather than just the plugin's isolated output. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity historically make WordPress XSS vulnerabilities attractive targets for rapid weaponization.
Unauthenticated cross-site scripting in B2BKing Premium (WordPress/WooCommerce plugin) versions 5.6.07 and earlier allows network-based attackers to inject arbitrary JavaScript into victim browsers without any authentication. The CVSS scope change (S:C) confirms that exploit payloads escape the plugin's context and execute within the victim's browser session, enabling session hijacking, credential theft, or malicious redirects targeting WooCommerce store visitors or administrators. No public exploit code or CISA KEV listing appears in the available intelligence, though the unauthenticated, low-complexity attack surface makes payload crafting straightforward once a reflective input vector is identified.
Unauthenticated Cross-Site Scripting in the wpDataTables WordPress plugin (versions 6.5.1.4 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in victims' browsers upon page interaction. The CVSS scope change (S:C) indicates the injected script escapes the plugin's context and can access session cookies, perform authenticated actions, or redirect users within the broader WordPress site. No public exploit or CISA KEV listing is confirmed at time of analysis, though Patchstack has published the vulnerability details.
Unauthenticated XSS in the Tagembed WordPress plugin (versions 7.4 and earlier) enables a remote, unauthenticated attacker to inject malicious JavaScript into pages rendered to other users, including administrators. The CVSS 3.1 vector records a scope change (S:C), meaning injected scripts execute in the victim's browser context outside the plugin's own boundary, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated XSS in the TranslatePress WordPress plugin versions 3.3.2 and earlier allows remote, unauthenticated attackers to inject malicious JavaScript that executes in the browsers of visiting users. The CVSS 7.1 High rating reflects a scope change (S:C), meaning the injected script crosses the plugin's security boundary into the victim's authenticated WordPress session, enabling session hijacking or unauthorized actions on behalf of the victim. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in JetEngine (WordPress plugin by Crocoblock/JetImpex Inc.) versions 3.8.14.1 and earlier allows a remote, unauthenticated attacker to inject and execute malicious JavaScript in a victim's browser session when the victim interacts with crafted content or a malicious URL. The scope change (S:C) in the CVSS vector confirms the payload crosses the plugin's security boundary into the victim's browsing context, enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic targeting of WordPress sites running JetEngine.
Off-by-one stack buffer overflow in Libevent's evdns component (versions prior to 2.1.13-stable and 2.2.2-alpha) enables remote attackers to crash or corrupt processes that use the library's DNS handling functions. The dnsname_to_labels() function in evdns.c mishandles the boundary check when writing DNS labels into a 64KB stack buffer - the terminating null byte is written one position past the allocated buffer to buf[buf_len] whenever a name-bearing record aligns precisely at the boundary. Any application embedding libevent's evdns module and querying an attacker-influenced DNS server is in scope; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Local privilege escalation in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 allows a low-privileged local attacker to gain elevated - potentially root-level - privileges by winning a time-of-check to time-of-use (TOCTOU) race condition. The vulnerability carries a CVSS 7.0 score reflecting high attack complexity due to the inherent timing constraints of race condition exploitation, though successful exploitation yields total CIA impact (full system compromise). No public exploit code has been identified and CISA SSVC classifies exploitation status as none, consistent with the extremely low EPSS score of 0.12%.
Local privilege escalation in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 enables a low-privileged local attacker to gain root access by winning a time-of-check to time-of-use (TOCTOU) race condition. The attack requires local access and precise timing, reflected in the AC:H CVSS metric, which meaningfully constrains practical exploitability. No public exploit or active exploitation is identified; EPSS sits at 0.12% (2nd percentile), consistent with the SSVC 'Exploitation: none' classification, though SSVC also rates technical impact as total given that successful exploitation yields full root control.
Local arbitrary code execution is possible in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 through a TOCTOU race condition (CWE-367), where a low-privileged local attacker can manipulate a resource between its check and its use by a privileged process. The CVSS 7.0 score reflects high confidentiality, integrity, and availability impact, though the high attack complexity (AC:H) indicates the timing window must be won reliably. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; IBM has released a patch via its support advisory.
Unbounded memory consumption in Netty's Binary HTTP (BHTTP) codec allows any remote peer to trigger out-of-memory (OOM) conditions by sending crafted encoded variable-length field values. The BinaryHttpParser in netty-incubator-codec-bhttp versions up to and including 0.0.22.Final applies no upper-bound enforcement on variable-length integers used for field sizes, meaning a malicious or misbehaving peer can instruct the parser to buffer arbitrarily large amounts of data until the JVM heap is exhausted. No public exploit has been identified at time of analysis, and no KEV listing exists, but the straightforward nature of the trigger makes exploitation trivial for any party with network access to a service using this codec.