Insufficient authorization on GutenKit REST API endpoints allows any WordPress user with Contributor-level access or above to read mailing-list audience metadata from marketing accounts connected to the site. Affected installations running GutenKit versions prior to 2.5.0 with an integrated email marketing platform (e.g., Mailchimp) are exposed to unauthorized data disclosure. A public proof-of-concept is available via WPScan, though SSVC confirms no active exploitation at time of analysis.
Command injection in Tenda CH22 firmware 1.0.0.1 allows low-privileged remote attackers to execute arbitrary OS commands by manipulating the fileNameMit parameter of the formcreateFileName function at the /goform/formcreateFileName endpoint. A public exploit proof-of-concept has been disclosed, making this actively weaponizable against unpatched devices. No patch has been confirmed by the vendor at time of analysis.
Command injection in the Comfast CF-N1-S firmware 2.6.0.1 CGI management interface allows remote low-privileged attackers to execute arbitrary OS commands by manipulating the 'sn' parameter in the /cgi-bin/mbox-config endpoint. The root cause is unsafe use of sprintf in the CGI handler that incorporates attacker-controlled input directly into a shell command without sanitization or escaping. A public proof-of-concept has been published on GitHub as a PDF document; this is not currently listed in the CISA KEV catalog.
Improper authorization in elunez eladmin versions 2.0 through 2.7 allows low-privileged remote attackers to invoke restricted controller functions - EmailController, AliPayController, GeneratorController, and GenConfigController - without adequate permission enforcement. A publicly available proof-of-concept exploit (GitHub issue #903) lowers the barrier to abuse, and no vendor patch has been issued; the project maintainer has not responded to the disclosure filed via VulDB. No public exploit identified as confirmed actively exploited (not in CISA KEV at time of analysis).
Unrestricted file upload in DeDeCMS 3 exposes the `/include/dialog/select_media_post.php` endpoint to abuse via the `uploadfile` parameter, enabling low-privileged authenticated users to upload arbitrary file types - including executable PHP scripts - to the server. Successful exploitation can culminate in remote code execution via a server-side webshell if the upload directory is web-accessible and script execution is permitted. No public KEV listing exists, but a proof-of-concept exploit is publicly available, materially lowering the skill threshold for exploitation.
SQL injection in SourceCodester Simple Online Food Ordering System 1.0 exposes the admin panel's category management endpoint to database manipulation by authenticated remote attackers via the unsanitized `ID` parameter in `/admin/ajax.php?action=save_category`. The vulnerability is a classic CWE-89 flaw in a PHP application with no vendor patch available. A public proof-of-concept exploit exists on GitHub, though no CISA KEV listing confirms active widespread exploitation at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 allows authenticated remote attackers to manipulate the `delid` parameter in `/viewappointmentapproved.php` to execute arbitrary SQL commands against the backend database. A publicly available proof-of-concept exploit exists on GitHub, elevating the practical risk beyond the moderate CVSS score. No active CISA KEV listing has been confirmed, but the low attack complexity and network-accessible vector make opportunistic exploitation feasible against any exposed instance with valid credentials.
SQL injection in amirsanni Mini-Inventory-and-Sales-Management-System 0.1 allows authenticated remote attackers to manipulate the orderBy and orderFormat parameters of the Transaction::getAll function to inject arbitrary SQL and read or modify database contents. The project maintainer has not responded to responsible disclosure, leaving the vulnerability unpatched. A public exploit exists via GitHub issue #101; no confirmed active exploitation (not in CISA KEV), but the low bar for exploitation given POC availability elevates near-term risk for any deployed instances.
Unrestricted file upload in SourceCodester Simple Online Food Ordering System 1.0 allows authenticated administrators to upload arbitrary file types through the menu management endpoint, creating a pathway to remote code execution on the server. The vulnerability resides in `/admin/ajax.php?action=save_menu` where the `img` parameter performs no validation on uploaded file types - a classic CWE-434 failure in a PHP application where server-side script execution of uploaded content is the likely consequence. A public proof-of-concept exploit is available (referenced via GitHub), though no active exploitation has been confirmed in CISA KEV. The provided CVSS 4.0 score of 2.0 is materially understated given that unrestricted PHP file upload almost universally enables webshell deployment and full host compromise.
Injection in PentestGPT's Web-Page Crawling component (versions up to 1.0.0) allows remote attackers to manipulate the Traceback argument during crawling operations, producing limited confidentiality, integrity, and availability impact against the vulnerable instance. The CVSS 4.0 score of 2.3 reflects a genuinely low-severity finding - high attack complexity and required passive user interaction constrain real-world exploitation to difficult, targeted scenarios. A public proof-of-concept exists, but the upstream maintainer closed the associated GitHub issue as 'not planned', leaving the flaw unpatched with no remediation in sight.
Arbitrary code execution is possible on Sony XAV-9500ES car AV receiver devices through a buffer overflow in the gpsd daemon's NMEA data processing, requiring the attacker to be physically present with the device. The flaw (CWE-120) stems from the absence of length validation before copying externally supplied NMEA input into a fixed-size stack or heap buffer within gpsd. Exploitation requires chaining with at least one additional vulnerability to achieve meaningful code execution, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Improper access control in Lighthouse - the cross-cluster service-discovery component of Submariner shipped with Red Hat Advanced Cluster Management for Kubernetes 2 - lets an attacker who has compromised a spoke cluster inject unauthorized EndpointSlices and ServiceImports into arbitrary namespaces on peer clusters. Because the destination namespace is taken from an attacker-controlled label/annotation on the broker object, resources can be planted into privileged namespaces such as kube-system and openshift-*, enabling privilege escalation and lateral cluster compromise. Rated CVSS 9.9 with a scope change; no public exploit identified at time of analysis.
Cross-origin redirect bypass in SecureDrop Client prior to 1.3.1 allows a malicious SecureDrop Server to route the securedrop-proxy component's HTTP requests to arbitrary external origins, circumventing the proxy's intended origin restriction. The Rust-based proxy followed HTTP 3xx redirects without validation, so a server-side redirect response could silently exfiltrate request data to a cross-origin destination. No public exploit code exists and the fix - disabling redirect following entirely via reqwest's RedirectPolicy::none() - is confirmed in version 1.3.1.
Out-of-bounds read in the prh_l2_decode_packet function of Sony XAV-9500ES car head unit firmware 3.02.0.0 exposes device memory contents to network-adjacent attackers over Bluetooth. Exploitation requires a malicious Bluetooth device to be paired with the target unit, after which crafted L2CAP packets trigger a read past the end of an allocated buffer, leaking sensitive memory. While the standalone impact is information disclosure, ZDI notes this vulnerability can be chained with additional flaws to achieve arbitrary code execution on the device; no public exploit identified at time of analysis.
Sandbox escape in Nix versions before 2.35.0 allows a malicious build derivation - executed under the experimental `recursive-nix` feature - to create or truncate empty files outside the build sandbox using the nix-daemon's permissions by exploiting a TOCTOU race in the LocalStore path-restore logic. The race window exists between path resolution and the `open()` call with `O_TRUNC` in `writeFile`, which previously lacked `O_NOFOLLOW` enforcement, letting an attacker substitute a symlink mid-flight to redirect the write. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the official fix is confirmed in Nix 2.35.0.
Cross-cluster traffic redirection in Submariner (as shipped with Red Hat Advanced Cluster Management for Kubernetes 2) allows a malicious or compromised member cluster to hijack traffic from peer clusters by advertising a specially crafted network endpoint. Because Submariner does not validate the subnets a spoke cluster declares, an attacker-controlled cluster can claim arbitrary CIDR ranges and cause peer clusters to route all matching traffic through the attacker's tunnel, enabling information disclosure and denial of connectivity. Rated CVSS 9.9 with a changed scope, this affects the multicluster networking layer, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in the Sony XAV-9500ES in-car media receiver allows a physically present attacker to connect a crafted USB device that triggers instantiation of otherwise restricted USB device types, circumventing the unit's udev-based authorization controls. Firmware version 3.02.00 of the XAV-9500ES is confirmed affected per EUVD-2026-63430. The CVSS 3.0 score of 2.4 reflects the strict physical access requirement and low integrity-only impact; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Terminal escape sequence injection in broot, the interactive Rust-based file tree navigator by Canop, allows any local user with filesystem write access to plant control characters in a filename and have them written verbatim to the terminal of any other user who browses that directory with broot. The vulnerable code path - to_string_lossy() in src/tree/tree_line.rs and src/tree_build/builder.rs - applies no control-character filtering despite an existing doc comment implying sanitization occurs. A proof of concept embedding an OSC 52 clipboard-write sequence confirmed that raw escape bytes reach the terminal unstripped; the terminal emulator then determines the actual impact, ranging from cosmetic disruption to clipboard hijacking. No public exploit identified at time of analysis beyond the reported proof of concept; the vulnerability is not listed in CISA KEV.
Path traversal in ATutor 2.2.4 enables an authenticated low-privilege user to read files belonging to other course directories when the AT_FORCE_GET_FILE configuration option is active, leaking file contents and exposing filesystem structure. The product is end-of-life with no vendor-released patch, making remediation dependent entirely on compensating controls or decommissioning. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
SSRF protection bypass in n8n's OAuth2 credential token-exchange flow allows authenticated users holding credential-creation permissions to direct n8n's backend to issue HTTP POST requests to arbitrary internal network addresses. Affected deployments span all n8n releases prior to 1.123.69 (v1 branch), 2.33.4 (v2.33 branch), and 2.34.1 (v2.34 branch). While n8n applies SSRF guards to OAuth2 discovery and dynamic-client-registration requests, the access-token exchange step uses a separate, unguarded HTTP client, meaning a malicious credential configuration bypasses those controls entirely and reflects internal service responses back to the attacker. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 2.3 reflects the constrained impact and privilege requirement.
Incorrect authorization in Checkmk's frozen BI (Business Intelligence) aggregation feature exposes host and service names to authenticated users whose visibility should be restricted. Specifically, users with intentionally scoped permissions can infer the existence and names of hosts and services outside their authorized scope by querying frozen BI aggregations. Affects all 2.2.0 versions and versions prior to 2.3.0p47, 2.4.0p29, and 2.5.0p2. No public exploit code exists and no active exploitation is confirmed; CVSS 4.0 score of 2.3 reflects the constrained, low-impact nature of this information disclosure.
Server-side request forgery in OpenStack Glance through 32.0.0 allows an authenticated administrator to bypass import_filtering_opts by submitting type=import tasks to the deprecated /v2/tasks API with an internal http:// or https:// URL, causing the Glance service to fetch internal network resources on the admin's behalf. The attack surface is substantially constrained by the PR:H requirement - valid OpenStack admin credentials must already be held - and the affected API has been deprecated for several releases. No public exploit code and no CISA KEV listing have been identified at time of analysis.
SQL injection in itsourcecode Hospital Management System 1.0 permits authenticated low-privilege users to manipulate database queries through the `delid` parameter of `/viewappointmentpending.php`, potentially exposing or corrupting patient appointment records. The CVSS 4.0 vector (PR:L) confirms exploitation requires a valid application account, narrowing the realistic attack surface despite network reachability. Publicly available exploit code (confirmed by E:P in the CVSS 4.0 vector) exists, modestly elevating practical risk; however, no CISA KEV listing indicates no confirmed in-the-wild exploitation at time of analysis.
Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI redress attacks against authenticated collaborators when the Journey add-on is enabled. An authenticated trip owner embeds raw HTML in a trip title; the backend endpoint GET /api/journeys/suggestions returns it unsanitized, and the frontend renders it directly via React's dangerouslySetInnerHTML, bypassing output encoding. The default Content Security Policy blocks inline handlers and script execution, constraining impact to visual manipulation rather than full cross-site scripting; no public exploit or active exploitation has been identified at time of analysis.
Heap buffer over-read in libvips prior to 8.18.3 allows disclosure of adjacent heap memory or process crash when processing JPEG images through the UltraHDR save pipeline. The flaw in `vips_foreign_save_uhdr_set_raw_hdr` stems from using raw pixel dimension arithmetic instead of the library's safe `VIPS_IMAGE_N_PELS` macro to size an output buffer, producing an undersized allocation when a pipeline enlarges an incoming JPEG before gain-map encoding. No active exploitation is confirmed (not in CISA KEV), no public exploit code exists, and a vendor-released patch is available in v8.18.3.