PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous password pushes by exploiting a nil-equality logic flaw in the ownership authorization check. Any party who possesses a push's secret URL can permanently destroy that push - bypassing the creator's explicit `deletable_by_viewer=false` setting and any passphrase protection - because Ruby evaluates `nil == nil` as true, causing the ownership gate to pass spuriously for anonymously created pushes. No public exploit code has been identified at time of analysis, and the issue is fixed in v2.9.6.
Password-protected gallery categories in JoomGallery versions prior to 4.3.1 are fully accessible to unauthenticated remote attackers by switching the request format to JSON via the `format=json` URL parameter. The HTML view correctly enforces the password gate, but the JSON view controller lacks any equivalent access control check, exposing protected image metadata and content without requiring credentials. No public exploit has been identified at time of analysis, though the bypass is trivially replicable directly from the vulnerability description.
Secret exfiltration via URL parameter interpolation in SiYuan's http_request MCP tool affects all versions before v3.8.0. An MCP client with elevated access can embed secret placeholder references directly in the destination URL of an http_request tool call, causing SiYuan to resolve and transmit stored plaintext secrets to any attacker-controlled host without user confirmation. No public exploit has been identified at time of analysis, but the exploitation mechanism is straightforward for any party holding MCP client access.
Unauthenticated row disclosure in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows any remote, unauthenticated user to read arbitrary form row data by invoking the form.inlineedit controller, which performs no access checks before returning database rows. The flaw is purely an authorization omission (CWE-284) rather than a logic or cryptographic weakness, making it trivial to exploit against any Joomla installation with Fabrik active. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated network-accessible nature (CVSS 4.0: AV:N/AC:L/PR:N) keeps real-world risk meaningful for sites that store sensitive user-submitted form data.
Unauthenticated comment deletion in Fabrik Extension for Joomla (versions 1.0.0 through 4.7.1) is possible because the DeleteComment endpoint performs no access control verification of any kind - a straightforward CWE-284 (Improper Access Control) failure. Any remote, unauthenticated party with network access to a Joomla installation running the affected extension can delete arbitrary comments by targeting their IDs. No active exploitation or public exploit code has been identified at time of analysis; the fix is available in version 4.7.2.
Unauthenticated comment tampering in the Fabrik extension for Joomla exposes all versions from 1.0.0 through 4.7.1 to arbitrary comment modification by any remote actor. The onUpdateComment endpoint performs no access control checks whatsoever - no session validation, no ownership verification - allowing any unauthenticated HTTP request to overwrite comment content in the database. No public exploit code has been identified at time of analysis, but the CVSS 4.0 vector (PR:N/AC:L/AT:N) confirms this is trivially exploitable with no prerequisites beyond network access to a Joomla site running the affected extension.
Unauthenticated email disclosure in Fabrik (Joomla extension, versions 1.0.0-4.7.1) exposes any commenter's email address to remote, unauthenticated requesters via the onGetEmail endpoint, which performed no access control checks. The flaw stems from a complete absence of authorization logic on a data-retrieval endpoint, allowing trivial mass enumeration of personal contact data. No public exploit code or CISA KEV listing has been identified at time of analysis, though zero-barrier network access makes opportunistic harvesting straightforward.
Unauthenticated row reordering in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows any network-accessible attacker to arbitrarily manipulate record ordering in Fabrik lists without credentials. The order plugin processed reorder requests with no access control checks whatsoever, a CWE-284 failure reported by the Joomla security team. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV.
Incomplete path blocklist in SiYuan's MCP file tool (versions before v3.8.0) allows authenticated administrators to read workspace files that the HTTP API is designed to protect, including plaintext publish-mode passwords from data/.siyuan/publishAccess.json. The flaw stems from a mismatch between the HTTP API's access restrictions and the MCP tool's narrower blocklist, classified as CWE-863 (Incorrect Authorization). No public exploit is identified at time of analysis; exploitation is bounded by the requirement for pre-existing administrator credentials.
Email enumeration in AVideo's RSS feed endpoint (feed/index.php) allows unauthenticated remote attackers to harvest channel owner email addresses across all versions through commit 9c39d8c8. By iterating through public channel names, attackers can systematically extract creator PII from the itunes:email and itunes:author elements of the platform's podcast-compatible RSS output. No public exploit has been identified at time of analysis, but the trivial exploitation path - a standard HTTP GET request requiring no credentials - substantially elevates downstream risk of phishing campaigns and credential-stuffing attacks targeting identified creators.
SSRF protection bypass in NLTK affects all versions before 3.10.0, where a fail-open logic error in validate_network_url() allows attackers to reach restricted network resources including cloud metadata endpoints such as 169.254.169.254. The flaw resides in _resolve_hostname(), which silently swallows OSError and ValueError from socket.getaddrinfo() and returns an empty list; the subsequent IP validation loop then iterates zero times, allowing urlopen() to execute the request with no filtering applied. No public exploit code or CISA KEV listing has been identified at time of analysis, but the real-world impact is meaningfully elevated for cloud-deployed applications where metadata API access can expose IAM credentials.
Heap buffer overflow in hashcat through version 7.1.2 allows an attacker who controls a hash file to crash the process and corrupt heap memory when an operator runs hashcat with the --username --show flags. The outfile_write() function in src/outfile.c sequentially appends username, separator, hash, and plaintext into a fixed ~16 MB heap buffer (HCBUFSIZ_LARGE) via memcpy without tracking accumulated length against buffer capacity, enabling an out-of-bounds write. No active exploitation has been confirmed (not in CISA KEV), and a vendor patch has been released via upstream commit.
Out-of-bounds heap write in hashcat's fgetl() function affects all versions through 7.1.2, triggered by supplying any input file - hash file, potfile, or wordlist - containing a line of exactly HCBUFSIZ_LARGE bytes, causing a one-byte null write past the caller's buffer. The resulting heap corruption can crash hashcat or, in a worst case, create memory exploitation primitives; confidentiality is unaffected (VC:N per the CVSS 4.0 vector) while availability impact is rated high. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch commit is available.
Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows an authenticated attacker to silently transfer video ownership to an attacker-controlled account by planting a malicious img tag in a video description. The vulnerable endpoint, objects/videoEditLight.php, accepts GET requests without any authenticity token validation, making it trivially exploitable via passive browser-side request forgery when an administrator views the crafted video page. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 6.9 reflects meaningful integrity impact constrained by the requirement for low-privilege account access and administrator interaction.
Heap-based buffer overflow in luci-lib-px5g's native ASN.1 encoding routine allows a locally authenticated attacker to write one byte beyond a heap-allocated buffer during certificate signing, with a high availability impact and limited confidentiality and integrity exposure. The flaw is triggered specifically when signing with a 2040-bit RSA key via the exported Lua interface create_selfsigned(), where a DER length encoding miscalculation causes an allocation of 259 bytes for a payload requiring 260. Remote exploitability is not confirmed - it depends entirely on whether the embedding application exposes this interface externally. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Symlink-based arbitrary file read in NLTK's IPIPANCorpusReader exposes files accessible to the running process on systems where untrusted local users can write to corpus root directories. Affected NLTK versions before 3.10.2 fail to follow symlinks through the nltk.pathsec validation layer when IPIPANCorpusReader methods - channels(), domains(), categories(), or fileids() - resolve filenames, allowing the symlink target to be read instead of the intended corpus file. No public exploit or CISA KEV listing has been identified at time of analysis; real-world risk is bounded by the local attack vector and the requirement for write access to the corpus directory.
Arbitrary file read in the Tutor LMS WordPress plugin (all versions before 4.0.6) allows authenticated instructors to retrieve any file on the server — including files outside the web root — by exploiting a missing path validation check in the plugin's media streaming functionality. Critically, readable targets include wp-config.php, which exposes database credentials and WordPress authentication keys and salts; possession of these constants enables an attacker to forge valid session cookies for any account, including site administrators. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation activity, but the cascading impact path from instructor account to full site compromise makes patching urgent for any site with open instructor registration.
Stored cross-site scripting in the Post Grid, Slider & Carousel Ultimate WordPress plugin (all versions before 1.8.1) allows any authenticated Contributor-level user to inject persistent JavaScript into a custom post type setting that executes in an administrator's browser session when the admin opens the poisoned item's edit screen. The attack effectively escalates a Contributor's limited privileges to full administrative control over the WordPress instance without any interaction from the attacker beyond the initial payload submission. No public exploit code has been identified and EPSS places exploitation probability at 0.16%, though the low technical barrier and the prevalence of multi-contributor WordPress sites make this a meaningful insider-threat and account-compromise vector.
Privilege escalation in Forminator Forms WordPress plugin (versions before 1.57.0.7) allows any user with form-builder permissions to create a registration form that grants the WordPress administrator role to every visitor who self-registers through it. The role-restriction enforcement applied to registration forms is inconsistently applied, meaning the control exists in the codebase but can be bypassed at the configuration layer by a sufficiently privileged form author. No public exploit code has been identified at time of analysis, and EPSS sits at 0.14% (4th percentile), indicating low observed exploitation activity; however, a successful exploitation chain yields full WordPress site compromise.
Stored Cross-Site Scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (versions through 3.6.12) allows authenticated contributors to inject persistent malicious scripts via the 'delay' shortcode attribute. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit has been identified at time of analysis, and a code-level fix has been committed to the WordPress.org plugin repository (changeset 3490676).
Stored XSS in the MC4WP: Mailchimp for WordPress plugin allows authenticated WordPress users with Author-level access or above to inject persistent malicious scripts into form response message post meta fields (`text_subscribed`, `text_error`), affecting all versions through 4.12.0. Injected payloads execute in the browsers of any site visitor who loads a page rendering the compromised form response, enabling session hijacking, credential theft, or malicious redirects against other users including Administrators. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, though the low privilege barrier of the Author role makes this a credible internal threat on multi-contributor WordPress installations.
Null byte and CRLF injection in Netty's SOCKS4 and SOCKS5 client encoders (Socks4ClientEncoder, Socks5ClientEncoder) allows an attacker who controls domain address or authentication fields to truncate or alter proxy connection parameters, enabling domain spoofing, userid truncation, authentication data injection, and protocol confusion. Affected are all Netty releases in the 4.1.x branch through 4.1.136.Final and the 4.2.x branch through 4.2.16.Final - both branches have been patched. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the integrity impact on downstream SOCKS proxy routing is concrete.
Plugin integrity bypass in SiYuan before v3.7.4 allows attackers with same-origin access to overwrite trusted, installed plugins by exploiting the bazaar install endpoint's failure to verify that the downloaded package content matches the caller-supplied packageName. By pairing a legitimate plugin's packageName with an attacker-controlled repoURL, an adversary substitutes malicious plugin code that persists across application restarts, achieving durable code execution within the SiYuan application context. No public exploit code or active exploitation has been identified at time of analysis, but the persistence mechanism elevates the practical impact beyond the moderate CVSS score.
Unauthenticated shortcode injection in the kk Star Ratings - Rate Post & Collect User Feedbacks WordPress plugin (all versions through 5.4.10.3) allows any remote, unauthenticated attacker to execute arbitrary WordPress shortcodes by supplying a crafted payload to the plugin's AJAX handler. The flaw exists because the wp_ajax_kk-star-ratings action passes a user-controlled 'payload' parameter directly to do_shortcode() without allowlisting or sanitizing which shortcode tags are permitted. No public exploit has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog; however, threat intelligence sources tag this as RCE, indicating that practical impact can escalate significantly depending on what shortcodes co-installed plugins register.
Unauthenticated styling data manipulation in the Themify Builder WordPress plugin (all versions through 7.8.0) allows any visitor to overwrite padding and margin properties on arbitrary posts, including private and draft content. The root cause is CWE-862 (missing authorization): the AJAX handler performing style writes relies solely on a WordPress nonce for access control, but that nonce is automatically broadcast to every frontend page via wp_localize_script, making it freely retrievable by any anonymous visitor. The CVSS score of 5.3 (AV:N/AC:L/PR:N/UI:N) is consistent with trivial unauthenticated network exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity makes opportunistic abuse realistic.
Permanent Wi-Fi denial-of-service in the Infineon AIROC driver shipped with Zephyr RTOS 3.6.0 through 4.4.1 allows a Wi-Fi-adjacent attacker to exhaust a fixed 20-buffer transmit/receive pool by inducing repeated synchronous WHD send failures, each of which leaks one buffer from airoc_pool without releasing it. Once the pool is fully exhausted, both transmit and WHD-driven receive paths fail, severing all Wi-Fi connectivity until the device is physically rebooted. No active exploitation is recorded in CISA KEV and no public exploit code has been identified, but the defect can also manifest organically over a device's operational lifetime through ordinary transient failures.
Webhook signature bypass in the Conekta Payment Gateway WordPress plugin (all versions before 6.2.2) allows unauthenticated remote attackers to fraudulently mark arbitrary WooCommerce orders as paid without any actual payment. The plugin neither validates that incoming webhook notifications originate from Conekta nor verifies that the payment amount or order binding matches the targeted order. No public exploit code or CISA KEV listing exists at time of analysis, but the attack path requires no authentication, no user interaction, and no special configuration, making it trivially automatable against any exposed merchant site.
Unauthenticated information disclosure in the FiboSearch WordPress plugin before 1.34.1 exposes password-protected WooCommerce products and their metadata to any website visitor without requiring the product password. Two AJAX endpoints - the autocomplete handler (dgwt_wcas_ajax_search) and the Details Panel handler (dgwt_wcas_result_details) - fail to enforce WooCommerce's native password-protection access control, allowing enumeration of restricted product names, slugs, and taxonomy data. No public exploit code identified at time of analysis; EPSS is 0.16% (5th percentile), indicating low current exploitation interest and no CISA KEV listing.
Cross-site request forgery in AVideo through commit 9c39d8c8 enables unauthenticated remote attackers to modify site-wide Gallery plugin configuration by exploiting the absence of CSRF token validation in channelToGallery.json.php. Any administrator who visits a crafted page while holding an active session can be silently coerced into promoting arbitrary channels to the front page or deleting curated gallery sections. No public exploit code or CISA KEV listing has been identified at time of analysis, and the impact is confined to integrity and limited availability of gallery content.
Authorization bypass in the Post Duplicator WordPress plugin (all versions ≤3.0.11) allows authenticated Contributor-level users to create duplicate posts with `future` (scheduled, auto-publishing) or `private` status, circumventing editorial review workflows that site administrators rely upon. The REST API endpoint's permission callback checks only the plugin's custom `duplicate_posts` capability while ignoring WordPress core status-gating capabilities such as `publish_posts`, and also disregards administrator-configured post-type duplication restrictions. No public exploit code has been identified and no CISA KEV listing exists, but the low attack complexity and network-accessible REST endpoint make this trivially abusable by any established contributor on a target site.
Unauthorized global theme modification in the GreenShift - Animation and Page Builder Blocks WordPress plugin (versions up to and including 12.8.9) is possible for any authenticated contributor-level user due to an insufficiently gated AJAX handler. The `gspb_update_global_wp_settings` function checks only for the `edit_posts` capability - a default contributor privilege - rather than requiring administrative rights, enabling site-wide defacement by overwriting theme color settings. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication bar makes this a realistic threat on any multi-author or open-registration WordPress deployment running the affected plugin.
Post Duplicator plugin for WordPress through version 3.0.11 permits authenticated contributors to forge post authorship by exploiting a missing capability check on the `duplicate-post` REST endpoint. The `duplicate_post()` function in includes/api.php accepts a `selectedAuthorId` parameter without verifying the caller holds the `edit_others_posts` capability, allowing any Contributor-level account to attribute cloned posts to administrators or other privileged users. No public exploit code exists and the CVE is not listed in the CISA KEV catalog, but the low attack complexity and broad availability of Contributor roles on multi-author WordPress sites make this a realistic threat to site integrity.
Authorization bypass in AutomatorWP WordPress plugin (all versions through 5.8.4) exposes ConvertKit integration credentials to any subscriber-level authenticated user. The ConvertKit AJAX endpoints in the plugin's integration layer perform no capability verification, and the nonce required to invoke them is embedded in every admin page load, eliminating the nonce's protective value for any authenticated user who can reach /wp-admin. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the attack primitive is trivially reproducible from the referenced source code.
Authorization bypass in the AutomatorWP WordPress plugin (all versions ≤ 5.8.4) allows any authenticated subscriber to retrieve the site's Campaign Monitor mailing list catalog - list IDs and names - that should be restricted to users holding the plugin's manager capability. The flaw is compounded by unconditional nonce emission via wp_localize_script to every WordPress admin-area visitor, meaning the authentication token required to invoke the vulnerable AJAX endpoints is freely available to any registered user visiting /wp-admin/profile.php. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code was cited, though Wordfence identified and reported the issue with specific vulnerable code line references.