Unauthenticated SQL injection in SourceCodester Simple Online Food Ordering System 1.0 allows remote attackers to manipulate backend database queries via the unsanitized `Name` parameter in `/fos/admin/ajax.php?action=save_settings`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier remote exploitation with no authentication or special conditions required. A public proof-of-concept exploit has been disclosed on GitHub, lowering the operational bar for opportunistic attackers targeting exposed instances.
Unauthenticated SQL injection in itsourcecode Online Clinic Management System 1.0 exposes the Admin Login endpoint (success/login.php) to remote exploitation via the Username parameter. Any network-reachable attacker can manipulate SQL queries without credentials or user interaction, enabling authentication bypass and arbitrary database read/write. A public exploit POC has been disclosed on GitHub (microwaveabi/vul issue #63), substantially lowering the barrier to exploitation; no CISA KEV listing has been confirmed at time of analysis.
Sensitive credential disclosure in RansomLook (versions 0 through 2.0.0) exposes full API keys in the rendered HTML of the authenticated /admin/apikeys page: although the UI only shows a truncated key, each token is embedded verbatim in hidden form fields backing the enable/disable, private-access, and delete actions. Anyone able to view the admin page source or DOM, or any intermediary that retains HTTP response bodies (debugging proxies, browser caches, monitoring systems), can recover the complete tokens and then authenticate with those keys' privileges, including access to private data. There is no public exploit identified at time of analysis; the issue is fixed upstream by replacing rendered tokens with SHA-256-derived opaque handles.
Broken authorization in RansomLook's web-based configuration editor (the /admin/config endpoint) lets any authenticated low-privileged user modify the application's config/generic.json, tampering with notification, LDAP, SMTP, and general settings. Because the endpoint enforces only that a session exists - with no administrator/privilege check (CWE-862) - a compromised or intentionally low-tier account can redirect integrations, alter authentication-related settings, or knock the installation offline. No public exploit has been identified at time of analysis, and the flaw is not in CISA KEV; the vendor CVSS 4.0 base score is 9.4.
Unauthenticated code execution in Combodo iTop before 3.2.3 arises because remote users can delete the setup-generated .readonly lockfile, which is the guard that blocks write operations and, once removed, re-opens privileged setup/configuration paths that lead to arbitrary code execution (CWE-94). Any internet-reachable iTop instance below 3.2.3 is affected, and the flaw carries a CVSS 4.0 score of 9.4 with full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial precondition (a single unauthenticated file-deletion request) makes weaponization realistic.
Prototype pollution in exceljs-hardened before 5.0.0 lets a remote attacker corrupt Object.prototype by feeding parsed JSON containing a malicious __proto__ property into a cell note, because the deepMerge helper in the note-serialization path fails to reject __proto__, constructor, or prototype keys. Any application that uses this library to process untrusted spreadsheet or note data is affected, and polluting the global prototype can cascade into denial of service, logic tampering, or code execution via downstream gadgets. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Unauthenticated administrator account registration in rConfig 8.0.0 through the affected releases lets any remote attacker create a fully privileged Admin user by hitting a POST /register route that was supposed to be disabled. A duplicate bare Auth::routes() call in routes/web.php re-enables self-registration, and because the registration controller never assigns a role while the users.role column defaults to Admin, the new account is instantly authenticated with full administrative rights. Reported by VulnCheck; no public exploit identified at time of analysis, but the flaw is trivially reachable and grants access to stored device credentials, user data, and API token issuance.
Persistent storage exhaustion and file overwrite in DJI consumer/prosumer drone firmware allows an attacker with local or adjacent access to disable flight logging and block firmware updates. The onboard FTP service ships hardcoded credentials shared across affected models (CWE-798), and any party who reaches the drone's internal network or USB RNDIS interface can authenticate and write unlimited files to /blackbox/upgrade/, overwriting existing files. Uploaded data survives reboot and factory reset, making the condition durable. No public exploit identified at time of analysis; CIRCL-reported with CVSS 4.0 base 9.3.
Cross-tenant authorization bypass (IDOR/BOLA) in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 lets an authenticated user of one company read, modify, and even hijack supplier records belonging to other companies by sending a PUT to /api/supplier/{id} and supplying an arbitrary company_id in the body. The supplier lookup was not scoped to the caller's tenant and mass-assignment allowed re-parenting a record to the attacker's own company, breaking multi-tenant isolation. A vendor patch exists (5.3.2) and the fix is visible in a public GitHub commit; there is no public exploit identified and it is not on CISA KEV, but the flaw is trivially reproducible from the diff.
Unauthenticated SQL injection in the PixelYourSite "Boost" WordPress plugin (versions up to and including 2.0.4) lets remote attackers inject arbitrary SQL through an unauthenticated request, exposing the WordPress database on any internet-facing site running the plugin. The CVSS 3.1 base score is 9.3 (critical) with a changed-scope, confidentiality-focused vector. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical, but the barrier to abuse is low.
Unauthenticated SQL injection in WooBeWoo Product Filter Pro (a WooCommerce catalog-filtering plugin) affects all versions up to and including 3.1.8, allowing remote attackers with no authentication to inject arbitrary SQL into backend queries and read sensitive database contents such as WordPress user records, password hashes, and session tokens. Reported by Patchstack and carrying a CVSS 9.3 (CWE-89), the flaw is network-exploitable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but SQLi in WordPress plugins is historically a high-value, easily-weaponized target.
SQL injection in Page Builder CK, a Joomla site-building extension by joomlack.fr, affects all versions prior to 3.6.5 and allows remote attackers to inject arbitrary SQL through the loadStyles method of the frontend page model. Because it is a second-order flaw, malicious input is stored first and executed during a later database operation, ultimately exposing the full Joomla database. The vendor-supplied CVSS 4.0 vector rates it 9.3 (Critical) with high confidentiality, integrity, and availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in OAuth2 Proxy (versions 7.5.0 up to but excluding 7.15.2) lets an unauthenticated remote attacker reach protected upstream routes by spoofing the X-Forwarded-Uri header. Because the trusted-proxy IP set defaults to 0.0.0.0/0 (and ::/0) whenever --reverse-proxy is enabled without --trusted-proxy-ip, every client is treated as a trusted proxy, so the skip-auth allow list is matched against the attacker-controlled header value while the real protected path is passed to the upstream. Reported by VulnCheck with a coordinated GitHub Security Advisory (GHSA-7x63-xv5r-3p2x); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in phpIPAM's REST API before 1.8.2 lets unauthenticated remote attackers obtain full API access by abusing an object-cache key collision, then wielding a numeric database row ID as a valid API token to read, write, and delete all IP address management records. VulnCheck reported the flaw and the vendor shipped a fix in 1.8.2; a patch commit is public, so publicly available exploit code exists in the sense of a documented, reproducible technique, though no active exploitation is confirmed. With a CVSS 4.0 base of 9.3 and no authentication or user interaction required, this is a high-priority issue for internet- or network-exposed phpIPAM instances.
SQL injection in the Woo Essential WordPress plugin (versions up to and including 4.3.0) lets remote unauthenticated attackers inject arbitrary SQL through an unsanitized parameter, enabling extraction of sensitive database contents such as credentials and customer records. Rated CVSS 9.3 (critical) with a scope-changed vector, the flaw was reported by Patchstack; no public exploit was identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated private-data disclosure in RansomLook, an open-source ransomware-leak-site tracking platform, allows any remote user who can reach the web application to pull records marked private. The legacy /export/<database> route exports selected internal databases without authentication and does not consistently apply the app's private-entity access restrictions, so private groups, markets, and posts can leak. Rated CVSS 4.0 9.2 (Critical); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Missing authorization in RansomLook, an open-source ransomware-intelligence tracking platform, lets unauthenticated remote attackers read data explicitly marked private. Several web views and API endpoints (notably /compare, ransom-note views, and search) failed to filter entities flagged as private, exposing private group and market names, ransom-note content, and metadata such as post counts, mirror totals, and uptime. Rated CVSS 4.0 9.2 (critical); a vendor patch exists (commit dc92d6d) and no public exploit has been identified at time of analysis.
SQL injection in CakePHP's database layer allows attackers to inject arbitrary SQL when an application uses FunctionsBuilder::jsonValue() with the PostgreSQL driver and passes user-controlled data into the jsonPath parameter. Affected release lines are 5.1.x before 5.1.10, 5.2.x before 5.2.15, and 5.3.x before 5.3.7; the root cause is the jsonPath value being interpolated into the generated ::jsonpath expression rather than bound as a parameter. No public exploit identified at time of analysis (not listed in CISA KEV), though the fix commit includes a regression test containing a working injection string.
Remote code execution in Konami's Metal Gear Online 3 (build 1.1.2.8) arises from an unbounded heap write when parsing the lobby's kicked-player list: the game trusts the attacker-supplied "kick_num" count without checking it against the 16-player buffer limit. A malicious lobby participant can overflow the kicked-ID buffer into adjacent Steam callback handler structures, corrupting function pointers to hijack control flow and potentially execute arbitrary code inside the game process. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the network-reachable, unauthenticated nature and RCE potential make it high-severity.
Command injection in DrayTek VigorSwitch's setDevNet function allows authenticated remote attackers to execute arbitrary OS commands with root privileges by supplying crafted username or password values. At least ten VigorSwitch models are confirmed affected via CPE data, with the full tag list extending coverage to approximately 28 model variants. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability class (CWE-78) and the root-level impact make it high priority for any DrayTek VigorSwitch deployment where administrative credentials may be compromised or shared.
Command injection in DrayTek VigorSwitch's setTime function enables authenticated administrators to execute arbitrary OS commands with root privileges across at least ten confirmed models, with tags suggesting up to 28 additional affected variants. The flaw stems from insufficient input sanitization of username and password fields before shell execution, a classic CWE-78 pattern. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is gated behind valid administrative credentials, per the CVSS PR:H rating and vendor description.
Command injection in multiple DrayTek VigorSwitch models enables authenticated administrators to execute arbitrary OS commands with root privileges through the setDevProto function's unsanitized username and password fields. At least 10 CPE-confirmed models are affected, with vendor tags suggesting a broader footprint of approximately 28 VigorSwitch variants. No public exploit code or CISA KEV listing has been identified at time of analysis; however, DrayTek published a security advisory in August 2026 acknowledging the vulnerability and the authentication prerequisite of valid admin credentials is the primary constraint on real-world exploitation.
Command injection in multiple DrayTek VigorSwitch models' getDetail function enables authenticated remote attackers holding valid administrative credentials to execute arbitrary OS commands with root privileges. The flaw (CWE-78) arises from the web management interface failing to sanitize username and password fields before incorporating them into system command execution. DrayTek published a security advisory in August 2026 covering a broad range of VigorSwitch models; no public exploit code or CISA KEV listing has been identified at time of analysis.
Command injection in DrayTek VigorSwitch's getVid function allows an authenticated remote administrator to execute arbitrary OS commands with root privileges by supplying crafted values in the username or password fields of the web management interface. At least 28 VigorSwitch models across the G, P, Q, PQ, and FX series are confirmed affected by the DrayTek August 2026 security advisory and VulnCheck reporting. No public exploit code has been identified at time of analysis, but the breadth of affected models and full root-level impact make this a patch-priority item for any organization operating DrayTek managed switching infrastructure.
Command injection in multiple DrayTek VigorSwitch managed switch models allows an authenticated remote administrator to execute arbitrary OS commands with root privileges via the web management interface. The flaw resides in the sysreboot function, which fails to sanitize the config, act, pathN, and valueN parameters before passing them to OS command execution, per CWE-78. No public exploit or CISA KEV listing exists at time of analysis, but the VulnCheck and DrayTek advisories confirm the vulnerability across at least 28 VigorSwitch SKUs.
Command injection in the DrayTek VigorSwitch `webBackupAction` function allows authenticated remote attackers to execute arbitrary OS commands with root privileges across more than 25 managed switch models. Insufficient input sanitization of the `option`, `key`, `pw_encode`, `pathN`, and `valueN` parameters enables shell metacharacter injection, resulting in full device compromise. No public exploit has been identified at time of analysis; the administrative credential prerequisite is the primary barrier against opportunistic exploitation.
Command injection in the DrayTek VigorSwitch series' pingtrace diagnostic function allows an authenticated administrator to execute arbitrary OS commands with root privileges by submitting a crafted host field value. Twenty-eight distinct VigorSwitch models across the G, P, Q, PQ, FX, and PX series are affected, with patched firmware releases varying by model family (2.9.10, 2.10.6, 2.10.7, and 3.10.6). No public exploit has been identified at time of analysis and CISA has not listed this in KEV; exploitation is constrained by the mandatory administrative credential requirement confirmed by the CVSS PR:H metric.
Command injection in DrayTek VigorSwitch's jsonstatus function allows authenticated remote administrators to execute arbitrary OS commands as root by submitting crafted values in the usescript, usefile, or option fields. At least 28 distinct VigorSwitch models across multiple firmware branches are confirmed affected per EUVD-2026-64974 and vendor advisory. Vendor-released patches are available; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Command injection in the apautotest function of multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative credentials to execute arbitrary OS commands with root privileges. Six CPE-confirmed models across the VigorAP 903, 906, 912C, 918R, 960C, and 1060C series are affected in all firmware versions below their respective patch thresholds. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available and should be applied promptly given the root-level impact.
Command injection in DrayTek VigorAP series access points (models 903, 906, 912C, 918R, 960C, and 1060C) allows an authenticated remote attacker to execute arbitrary OS commands with root privileges by submitting crafted input to the InquierTime function's time field via the web management interface. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command) - the time parameter is passed to a system shell without adequate filtering, enabling shell metacharacter injection. No public exploit identified at time of analysis; a vendor-released patch is available across all affected model lines.
Command injection in DrayTek VigorAP mesh networking firmware allows authenticated remote administrators to execute arbitrary OS commands with root privileges across six VigorAP models. The vulnerability exists in the mesh_start_speed_test function, where unsanitized meshdevice_index and meshdevice_ip input is passed directly to shell command execution, yielding complete device compromise including full confidentiality, integrity, and availability impact. Vendor-released patches are available for all affected models; no public exploit code or CISA KEV listing has been identified at time of analysis.
Command injection in DrayTek VigorAP series wireless access points allows authenticated remote administrators to execute arbitrary OS commands with root privileges by submitting crafted input to the setcamset function via the web management interface. Six distinct VigorAP models are confirmed affected across multiple firmware branches, each with a separate patch target version released in August 2026. No public exploit identified at time of analysis, but the network-accessible attack vector and root-level impact make this a high priority for organizations with internet-exposed VigorAP management interfaces.
Command injection in multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative credentials to execute arbitrary OS commands as root by submitting malicious input to the setLan function's lanIp or lanNetmask parameters. Six models spanning several firmware lines are confirmed affected, with vendor patches now available for all of them per the August 2026 DrayTek security advisory. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, but the root-level code execution outcome warrants prompt firmware upgrade wherever management interfaces are network-reachable.
Command injection in DrayTek VigorAP series access points allows an authenticated remote attacker with administrative credentials to execute arbitrary OS commands as root via the ExportSettings function. Insufficient input sanitization of the backupkey, backuptype, and realtime parameters permits shell metacharacter injection before those values are passed to a system command. No public exploit or CISA KEV listing exists at time of analysis, but SSVC rates technical impact as total given root-level code execution on network infrastructure devices.
Authentication bypass in the CakePHP Authentication plugin's CookieAuthenticator (versions before 2.11.2, 3.0.0-3.3.6, and 4.0.0-4.2.0) lets remote attackers forge unencrypted legacy 'remember me' cookie tokens to impersonate users, and to trigger CPU or memory exhaustion by embedding password hashes with an oversized work factor. Rated CVSS 4.0 9.1, with a vendor advisory (GHSA-h7xh-9h2x-2m37) and fixing PRs published; no public exploit identified at time of analysis and it is not on CISA KEV. Applications only exposed if they use CookieAuthenticator with the legacy token format (the default grace-period behavior).
Remote code execution in Zscaler Client Connector (ZCC) lets a remote, unauthenticated attacker run arbitrary code within the ZCC process context, per a vendor-reported (Zscaler) advisory carrying a CVSS 9.1 rating. The flaw stems from improper input validation (CWE-20) and requires no privileges or user interaction, though exact fixed versions are described only through Zscaler's release summary rather than a discrete CVE-pinned build. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated OS command injection in TP-Link Archer BE800 V1, BE3600 V1, and AX75 V1 routers allows any LAN-adjacent attacker to execute arbitrary commands with root privileges via the parental control subsystem. Exploitation requires no credentials and no user interaction, resulting in complete device compromise including full control over routing, firewall policy, and all traffic transiting the device. Vendor-released firmware patches are available for all three affected models; no public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in Zscaler Client Connector allows remote unauthenticated attackers to subvert the trust between the endpoint agent and the Zscaler Client Connector Portal, per the CVSS vector (AV:N/PR:N) yielding high confidentiality and integrity impact. The flaw (CWE-304) stems from a missing or incorrect step in the authentication logic governing agent-to-portal communications, affecting Windows, macOS, Linux, iOS, Android, and ChromeOS builds below the fixed versions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its 9.1 base score and network-facing, no-privilege profile make it high priority.
Stored XSS in Horde IMP's AppleDouble MIME viewer (all versions before 7.2.0) allows any email sender to execute arbitrary JavaScript in a recipient's browser session when they view a crafted message. No account on the target system is required - only the ability to deliver mail - and because the payload persists in the mailbox it can re-execute on every subsequent view. A publicly available exploit exists, and the researcher documents a chained escalation path combining this flaw with CVE-2026-58451 that reaches application code execution when triggered in an IMP administrator's session.
Reflected XSS in Dolibarr's extra fields administration template (all versions before 24.0.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an authenticated administrator's browser session by delivering a crafted URL containing a malicious `type` parameter. The parameter is echoed without JavaScript-context encoding directly into an inline script block, and no Content-Security-Policy header is present to block the execution. Successful exploitation enables the attacker to create a persistent backdoor administrator account, constituting a full application takeover with no KEV listing but publicly available exploit code confirmed by VulnCheck.
Command injection in DrayTek VigorSwitch's tftp_upgrade function enables authenticated remote administrators to execute arbitrary OS commands with root privileges. At least 28 VigorSwitch models across DrayTek's managed switch lineup are affected, spanning both Gigabit and PoE/fiber variants. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability once administrative access is leveraged.
Command injection via the commandTable function affects 28 DrayTek VigorSwitch managed switch models across multiple firmware branches, allowing an authenticated administrator to execute arbitrary OS commands with root privileges on the device. The root cause is incomplete sanitization of shell metacharacters - specifically backticks, newline characters, and single quotes - in a parameter field processed by the web management interface. Exploitation requires valid administrative credentials; patch available per DrayTek's August 2026 security advisory. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Command injection in multiple DrayTek VigorAP access point models allows an authenticated remote attacker with administrative credentials to execute arbitrary OS commands as root via a crafted restorekey parameter in the upload_settings.cgi endpoint. Six VigorAP hardware models share the vulnerable codebase: 903, 906, 912C, 918R, 960C, and 1060C. Vendor firmware patches are available for all affected models; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Command injection in multiple DrayTek VigorAP firmware models allows authenticated remote attackers with administrative credentials to execute arbitrary OS commands as root via the tr069TestInform function. Six models are confirmed affected - VigorAP 903, 906, 912C, 918R, 960C, and 1060C - with vendor-patched firmware available at model-specific versions. No public exploit code has been identified at time of analysis, but the straightforward nature of CWE-78 OS command injection against a root-privileged process means exploitation is trivial for any attacker who has obtained valid admin credentials.
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role - to overwrite global artifacts without the elevated permissions normally required for such operations. The `verify()` VQL function, designed only for syntax validation, incorrectly writes submitted artifacts into the shared global repository rather than a temporary local scope, effectively bypassing authorization controls (CWE-862). No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege bar and network accessibility make this a meaningful internal threat in Velociraptor deployments.
Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated attacker to inject malicious scripts via the dashboard revert functionality, executing arbitrary JavaScript in a victim's browser session within the iTop context. The CVSS 8.9 score and Changed scope (S:C) reflect that successful exploitation extends impact beyond the iTop application itself - enabling session hijacking, credential theft, or privilege escalation on behalf of the victim user. No public exploit code or CISA KEV listing has been identified at time of analysis.
Command injection in DrayTek VigorSwitch firmware's fdftDevice function allows an authenticated remote administrator to execute arbitrary OS commands with root privileges by supplying crafted input in the username or password fields of the web management interface. Approximately 28 VigorSwitch models across the G, P, Q, and PQ series are affected, confirmed by both VulnCheck reporting and a DrayTek vendor advisory published August 2026. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Command injection in DrayTek VigorSwitch's rebDevice function allows authenticated remote attackers with valid administrative credentials to execute arbitrary OS commands with root privileges by submitting crafted username or password values through the web management interface. At least 10 VigorSwitch models are confirmed affected per CPE data, with tags suggesting coverage across roughly 28 distinct models spanning the G, P, Q, PQ, and FX product lines. No public exploit or CISA KEV listing has been identified at time of analysis, though the advisory originates from a VulnCheck disclosure coordinated with a DrayTek security bulletin dated August 2026.
Command injection via the setDevice function affects multiple DrayTek VigorSwitch managed switch models, allowing an authenticated remote administrator to execute arbitrary OS commands with root privileges by supplying unsanitized input in the username, password, or location fields. The breadth of affected hardware - at least 28 distinct VigorSwitch SKUs spanning G, P, PQ, Q, and FX series - substantially widens the organizational exposure surface. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible management interface and high-impact outcome make this a meaningful post-compromise escalation path.
Command injection in DrayTek VigorSwitch managed switches allows an authenticated remote attacker holding administrative credentials to execute arbitrary OS commands with root privileges by supplying crafted input to the auth_set function via the web management interface. At least 28 distinct VigorSwitch model lines are affected across DrayTek's G, P, PQ, Q, and FX series, with the vulnerability reported by VulnCheck and acknowledged via a DrayTek security advisory in August 2026. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog at time of analysis; the CVSS 4.0 score of 8.6 with PR:H accurately reflects that valid administrative credentials are a prerequisite, materially limiting opportunistic mass exploitation.