Username denylist bypass in Limit Login Attempts Security (Limit Login Attempts Reloaded) before version 3.3.5 allows a WordPress user who has been explicitly blocked by an administrator to successfully authenticate by varying the case of their username or by supplying the account's associated email address instead. This is a logic flaw in the plugin's denylist enforcement, entirely defeating the access control that a site administrator intended to impose on specific accounts. A publicly available proof-of-concept is documented in the WPScan advisory; the low CVSS score of 3.7 with AC:H reflects that successful exploitation requires the attacker to already hold valid credentials for the denylisted account.
Stored XSS in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) allows administrator-level users to inject arbitrary JavaScript via an unsanitized plugin setting used as an HTML tag name in front-end output. Any visitor loading a page that renders the upload field will execute the injected script in their browser context. A publicly available exploit exists; the vulnerability is rated CVSS 3.5 due to the high-privilege requirement, though post-authentication stored XSS can still enable session hijacking or malicious redirects against site visitors.
Blind server-side request forgery in the Eventin WordPress plugin prior to version 4.1.21 allows contributor-level authenticated users to direct the WordPress server to issue arbitrary outbound HTTP requests by supplying unvalidated webhook URLs on events they do not own. Two distinct control failures compound the issue: webhook URL input is accepted without sanitization, and the plugin performs no event ownership check, meaning any contributor can abuse another user's event configuration. A publicly available proof-of-concept exists; no CISA KEV listing confirms active exploitation at time of analysis.
Unauthorized post data disclosure in the Duplicate Post WordPress plugin before 1.5.6 allows authenticated users holding a delegated role to read content, metadata, and passwords for posts they should not have access to - including other users' private and draft posts. The CVSS vector (PR:H/C:L) reflects a constrained impact limited to information disclosure within authenticated contexts, making this a meaningful risk in multi-user editorial WordPress environments but not in single-author deployments. A publicly available proof-of-concept exists per WPScan's advisory; no active exploitation has been confirmed via CISA KEV.
Duplicate Post WordPress plugin before 1.5.6 exposes password-protected post content to authenticated users who lack read authorization on those posts. The plugin's duplication feature fails to verify whether the requesting user has permission to read the source post, allowing any user with a delegated duplication role to republish another author's password-protected content as publicly readable. A publicly available proof-of-concept exists; no active exploitation has been confirmed (not in CISA KEV). A vendor patch is available at version 1.5.6.
Financial ledger manipulation in the Dokan WooCommerce Multivendor Marketplace WordPress plugin (before 5.0.14) allows authenticated vendors to fraudulently clear commission debts by submitting arbitrary client-supplied payment amounts to the reverse-withdrawal endpoint without server-side balance validation. Any registered vendor on an affected marketplace can exploit this to zero out real outstanding commissions owed to the marketplace operator, constituting financial fraud against the site owner. A publicly available proof-of-concept exists; no active exploitation has been confirmed by CISA KEV, though the low attack complexity and accessible vendor registration on most marketplaces make this a meaningful business risk.
Unrestricted file upload in CodeAstro Online Job Portal 1.0 allows authenticated remote attackers to upload arbitrary files via the Name argument in /users/update-profile.php. Exploitation requires a valid user account, after which an attacker can bypass file type restrictions on profile update functionality. A publicly available proof-of-concept exists per the GitHub reference, though no active exploitation has been confirmed by CISA KEV. The unusually low official CVSS 4.0 score of 2.1 (VC:L/VI:L/VA:L) appears inconsistent with CWE-434 in a PHP application, where unrestricted upload frequently enables server-side code execution - security teams should independently verify the actual upload destination and execution context.
SQL injection in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 exposes the saveUser function at /public/submit.php to database manipulation through the unsanitized Researcher parameter. The CVSS 4.0 score of 5.3 with PR:L indicates low-privileged authentication is required, limiting but not eliminating risk. A public proof-of-concept exploit is available via a referenced GitHub gist, and no vendor-released patch has been identified at time of analysis.
Cross-Site Request Forgery in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 allows remote attackers to perform unauthorized state-changing actions on behalf of authenticated users without their knowledge. The attack requires passive victim interaction (UI:P per CVSS 4.0) - a logged-in user must be lured to a malicious page that silently submits forged requests to the application. A public proof-of-concept exploit is available on GitHub, lowering the technical barrier for abuse; however, no CISA KEV listing exists and impact is constrained to low integrity degradation with no confidentiality or availability consequence.
Sensitive information disclosure in Combodo iTop prior to version 3.2.3 leaks raw exception messages to authenticated users through the application's AJAX rendering layer. In ajax.render.php, caught exceptions were echoed back to the browser via $e->GetMessage() (HTML-escaped to prevent XSS, but not content-filtered), potentially exposing internal file paths, database schema details, stack context, or configuration fragments. No public exploit has been identified at time of analysis, and the low CVSS score of 3.5 reflects limited practical impact; however, the disclosed internals can meaningfully assist further reconnaissance.
Missing authorization in Apache CloudStack's listHostTags API allows domain administrators to enumerate host tags across all domains in a multi-tenant deployment, violating tenant isolation boundaries established by the domain hierarchy. Affected versions span 4.12.0.0 through 4.22.1.0 across two release trains, with vendor-released patches in 4.20.3.1 and 4.22.1.1 confirmed by the Apache security advisory. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is meaningful in shared, multi-tenant CloudStack environments where cross-domain host tag visibility undermines infrastructure confidentiality guarantees between tenants.
Improper access control in Apple watchOS prior to 26.4 allows a person with physical possession of a locked Apple Watch to view the device owner's contacts without authentication. The flaw, classified as CWE-284 (Improper Access Control), stems from insufficient permissions checking on a code path accessible from the lock screen. Apple has confirmed the fix in watchOS 26.4; no active exploitation has been identified per CISA SSVC assessment.
Improper authorization in Dolibarr's user account management component (htdocs/user/card.php) through version 23.0.4 permits authenticated non-admin users to delete administrator accounts by supplying an arbitrary user ID to the Account Handler. The commit diff confirms the root cause: the deletion code path executed without verifying whether the target account held admin privileges or whether the requesting user was an administrator. A public exploit exists (CVSS 4.0 supplemental E:P); no active exploitation has been confirmed via CISA KEV.
XML injection in joshnuss xml_builder (Elixir) allows an attacker who can influence element names, attribute names, or doctype identifiers to inject arbitrary XML markup - including extra elements, comments, and event-handler attributes - into the serialized document output. All library releases from 0.0.1 through 2.4.0 are affected; the vulnerability resides in the core XmlBuilder.element and XmlBuilder.generate API surface. No active exploitation has been confirmed (CVE is not in CISA KEV), and no standalone public exploit code has been identified, though the GitHub security advisory includes demonstrative test cases.
XML injection in joshnuss xml_builder (versions 0.0.7 through before 2.4.1) enables content spoofing and XML structure manipulation when attacker-controlled data reaches CDATA sections generated by the library. The escape/1 function concatenates CDATA content verbatim without splitting on the ]]> delimiter sequence, allowing premature closure of the CDATA section and injection of arbitrary XML markup into the output document. A vendor patch is available in version 2.4.1; no public exploit code and no CISA KEV listing have been identified.
Incorrect entity-passthrough logic in joshnuss xml_builder (Elixir) versions 0.0.6 through 2.4.0 allows attacker-supplied text containing pre-encoded entity sequences such as <script> to be emitted verbatim into serialized XML, rather than being double-encoded to &lt;script&gt;. When a downstream parser decodes the output and renders it in a markup-sensitive context - HTML, SVG, or RSS/Atom feeds - the entity sequences resolve into live markup, enabling content spoofing and cross-site scripting while bypassing upstream filters that block raw angle-bracket characters. No public exploit is identified at time of analysis, and no CISA KEV listing exists.