SQL injection in itsourcecode Payroll System 1.0 exposes the pre-authentication login endpoint to unauthenticated remote attackers via the Username parameter handled by admin_class.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction network exploitation with no prerequisites, and the E:P modifier confirms a public proof-of-concept exploit has been disclosed, lowering the skill bar for exploitation. Partial confidentiality, integrity, and availability impact is assessed (VC:L/VI:L/VA:L), consistent with an attacker being able to manipulate or extract payroll database records but not achieve full system takeover.
Path traversal in Apache Camel's camel-azure-storage-datalake component allows anyone with write access to a consumed Azure Data Lake Storage Gen2 filesystem to direct the Camel process to write or overwrite files at arbitrary locations on the local filesystem. The downloadToFile operation constructs local paths by joining the configured fileDir with the remote file name exactly as returned by the Azure SDK - without lexical normalization or any boundary check - meaning a remote path name containing parent-directory segments (e.g., '../../etc/cron.d/payload') resolves outside fileDir. Depending on what the Camel process can write, this integrity violation can escalate to code execution or service disruption. No active exploitation has been identified at time of analysis, and vendor-released patches are available in versions 4.14.9, 4.18.4, and 4.22.0.
Uncontrolled recursion in Autodesk 3ds Max's SVG parser allows a crafted file to exhaust the call stack and crash the application, resulting in denial of service. The attack requires user interaction - a victim must open a maliciously crafted SVG file - and has no impact on confidentiality or integrity. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unrestricted file upload in itsourcecode Online Pharmacy System 1.0 allows remote unauthenticated attackers to upload arbitrary files via the photo argument to the user registration endpoint (all_users/register.php), exploiting the PHP move_uploaded_file function without adequate file type or content validation. The CWE-284 root cause (Improper Access Control) combined with a public registration surface means no authentication barrier exists before reaching the vulnerable code path. A publicly available exploit has been confirmed (E:P in the supplied CVSS 4.0 vector; corroborated by VulDB submission and a published GitHub PoC), making this immediately weaponizable; no active CISA KEV listing has been identified at time of analysis.
Cross-Site Request Forgery in Fluent Support Pro WordPress plugin (all versions up to and including 2.3.1) enables an unauthenticated attacker to perform unauthorized state-changing actions by tricking an authenticated plugin user into visiting a crafted page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered with no attacker privilege requirement, but is gated entirely on victim interaction - limiting mass exploitation. No public exploit or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided.
Broken access control in Fluent Support Pro (WordPress plugin by WP ManageNinja LLC) versions up to and including 2.3.1 permits subscriber-level authenticated users to perform actions restricted to higher-privileged roles. Rooted in CWE-862 (Missing Authorization), the flaw allows the lowest standard WordPress user role - subscribers, often self-registered customers - to invoke plugin functionality without the authorization checks that should gate those actions, resulting in limited confidentiality and integrity impact against support ticket data. No public exploit code and no active exploitation confirmed by CISA KEV have been identified at time of analysis.
Prototype pollution in rexrainbow/phaser3-rex-notes up to version 1.80.17 allows remote authenticated attackers with low privileges to manipulate JavaScript object prototype attributes via a crafted key argument to the SetValue function in the BehaviorTree Blackboard Data Interface. Exploitation can result in low-level confidentiality disclosure, integrity modification, and availability disruption, consistent with classic prototype pollution impact on downstream object behavior. No public exploit code has been confirmed at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Reflected XSS in Page Builder CK, a third-party Joomla extension by joomlack.fr, allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL that embeds a payload in the `iscontenttype` parameter. All versions prior to 3.6.5 are affected; exploitation requires passive user interaction - a victim must click or be redirected to the crafted URL. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of authentication requirements make this trivially weaponizable against any Joomla site running the unpatched extension.
Zephyr RTOS versions 4.3.0 through 4.4.1 leak 8 bytes of uninitialised kernel stack memory per MIDI 2.0 discovery request through the UMP Stream responder library. Two reply-packet builder functions declare their result struct without zero-initialisation, causing stale stack contents in the trailing two 32-bit words to be transmitted verbatim over the wire. The default unauthenticated Network MIDI 2.0 UDP endpoint exposes this to any remote peer; the request is freely repeatable, enabling accumulation of stack disclosures. No public exploit has been identified at time of analysis, and KEV status is absent.
Unauthenticated REST API disclosure in Apache Allura through version 1.19.1 exposes certain content items to unauthorized actors without any credentials. The vulnerability stems from insufficient access control on REST endpoints, allowing any network-accessible client to retrieve content that should require authentication. No public exploit or CISA KEV listing has been identified at time of analysis, but the low exploitation barrier (unauthenticated, network-accessible) makes this a straightforward information leakage risk for any publicly exposed Allura instance.
Missing per-object authorization on Ghostwriter's report template lint endpoints through version 7.2.6 exposes cross-tenant template metadata to any authenticated user. The RoleBasedAccessControlMixin.test_func method defaults to checking only request.user.is_active, and neither the lint-trigger endpoint nor the lint-result retrieval endpoint overrides this with ownership or client-scope validation. Any holder of a valid active account can lint an arbitrary template by supplying its primary key, overwriting that template's stored lint result and reading returned findings that enumerate variable names and template-engine errors - disclosing template structure across organizational boundaries. No public exploit confirmed at time of analysis, though a public researcher writeup exists.
HCL Hive 1.0 exposes its authentication endpoint without rate limiting, enabling unauthenticated remote attackers to conduct brute-force or credential stuffing attacks that can lead to unauthorized account access, or to flood the endpoint causing a denial of service. Classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts), the flaw requires no privileges or user interaction and is network-accessible against default deployments. No public exploit code or active exploitation has been identified at time of analysis, but the attack class is trivially automated with widely available tooling.
Authorization bypass in Dolibarr ERP versions 21.0.0 through 23.x allows authenticated users holding project-creation permission to clone tasks into private projects they are not authorized to access. The flaw is an inverted boolean logic error in the clonetasks mass action handler - `!in_array()` is used where `in_array()` is required, causing the private-project membership check to pass precisely for unauthorized users and fail for authorized ones. No public exploit code exists and this vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means any authenticated user with project-creation rights can trivially abuse the flaw against any private project in the same Dolibarr instance.
Information disclosure in Murrelektronik Xelity industrial Ethernet switches allows unauthenticated network attackers to retrieve MAC addresses from the device when an administrator uses the 'Copy learned MAC Addresses' function. The application improperly exposes logged MAC address data via browser developer tools (CVSS 4.0: 5.3). No public exploit code has been identified, but the trivial attack path (opening developer tools) and network accessibility present a moderate risk to industrial facilities.
DNS-based server-side request forgery in jackson-databind exposes any Java application that deserializes user-supplied JSON into objects containing `java.net.InetAddress`-typed fields, causing the library to perform unsolicited outbound DNS lookups against attacker-controlled hostnames. Affected across all major release lines from 2.x through 3.x (com.fasterxml and tools.jackson.core artifact groups), the flaw allows unauthenticated remote attackers to enumerate internal hostnames and map internal network topology via DNS side-channels. No active exploitation or public exploit code has been identified; vendor patches are available across all affected release lines.
Header injection via structured-mode CloudEvents in Apache Camel's Knative consumer enables unauthenticated SSRF, path traversal, and message-dispatch redirection against routes that forward to header-driven components. The flaw exists because CloudEvent extension fields in structured content mode (Content-Type: application/cloudevents+json) are copied directly into Camel Exchange headers without applying the KnativeHttpHeaderFilterStrategy that correctly guards the binary content-mode path - an incomplete fix of the same filter-bypass pattern addressed across multiple related CVEs (CVE-2025-27636, CVE-2025-29891, CVE-2025-30177, CVE-2026-40453, CVE-2026-47323). No public exploit or CISA KEV listing has been identified at time of analysis, but the attack surface - unauthenticated HTTP POST to a Knative endpoint - requires no special tooling.
Zephyr RTOS's Hearing Access Service (HAS) GATT peripheral crashes when a previously bonded Bluetooth peer reconnects during a boot-time race window before bt_has_register() completes service initialization. The security_changed() callback - registered unconditionally via BT_CONN_CB_DEFINE - fires against NULL attribute pointers, triggering either a kernel assertion or a NULL dereference in bt_gatt_is_subscribed(). With CVSS AV:A/AC:H and confirmed DoS-only impact, this represents a medium-severity availability risk against embedded hearing-aid devices running Zephyr 3.6.0 through 4.4.1; no public exploit code has been identified, and a vendor patch is confirmed at 4.4.2.
Insufficient access control granularity in HCL Hive's Keycloak IAM instance exposes protected resources to unauthenticated or unauthorized network attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is remotely exploitable without credentials or user interaction against the IAM layer, resulting in unauthorized read access to confidential resources. No public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor knowledge base article (KB0131731) has been published.
Stored cross-site scripting in Baserow's rich-text mention renderer allows any authenticated workspace member - at the lowest permission level - to permanently inject and execute arbitrary scripts in the browsers of all other workspace members who view any table containing a mention of the attacker's account. The attack requires no victim interaction beyond passively loading the table view, and the payload persists until the attacker's display name is corrected or the offending row is deleted. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the zero-click broadcast delivery model makes this operationally more impactful than the CVSS 5.3 base score suggests for multi-tenant Baserow deployments.
Broken access control in BookStack's Image Gallery API before v26.05.4 allows authenticated API users holding image-update or image-delete permissions to manipulate any other user's profile avatar without requiring user-management privileges. The API controller accepts arbitrary image IDs and skips the content-type and gallery restrictions enforced by the web controller; when the target avatar's uploaded_to field references a page the attacker can already access, the authorization check incorrectly passes. Affected operations include renaming, replacing, or deleting the victim's avatar; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Insecure Direct Object Reference (IDOR) in Fluent Boards Pro versions up to and including 2.0.11 exposes protected board or task objects to unauthorized access via manipulated object identifiers. The vulnerability is classified under CWE-639 and reported by Patchstack with a Medium CVSS score of 5.3. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network-accessible attack vector and absence of complexity requirements lower the bar for discovery and abuse.
Broken access control in MagePeople Inc.'s Booking and Rental Manager WordPress plugin (all versions through 2.7.5) permits unauthenticated remote attackers to invoke restricted plugin functionality and read limited application data without any credentials. Rooted in CWE-862 (Missing Authorization), the flaw arises from absent capability checks on one or more plugin endpoints - a structural weakness common in WooCommerce extensions that register AJAX handlers or REST routes without verifying caller permissions. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at the time of analysis.
Broken access control in the RepairBuddy WordPress plugin (versions up to and including 4.1223) allows unauthenticated remote attackers to perform unauthorized actions against affected WordPress installations. The root cause is CWE-862 (Missing Authorization), meaning one or more plugin endpoints or AJAX handlers execute privileged operations without verifying the requesting user's identity or capability. The integrity impact (I:L) suggests unauthorized modification of repair shop records or plugin settings is possible, though confidentiality and availability are unaffected. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file upload in NewSiteServer (NSS) by CyberTutor allows unauthenticated remote attackers to store malicious HTML files on the server, producing stored XSS-equivalent effects against users who subsequently access those files. All known versions are affected per EUVD and CPE wildcard data; the upload endpoint requires no authentication. No public exploit code or active exploitation has been identified at time of analysis, and no patch version has been independently confirmed from available references.
Server-Side Request Forgery in FluentCRM Pro (WordPress plugin by WP Manage Ninja LLC) versions up to and including 3.1.12 allows low-privileged authenticated users holding the subscriber role to induce the WordPress server to make outbound HTTP requests to arbitrary internal or external destinations. The scope-changed CVSS vector (S:C) confirms the vulnerability can pivot beyond the WordPress application boundary to reach internal network services not otherwise exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data was not supplied.
Stored XSS via SVG logo upload in Roskus Prospero Flow CRM before 5.15.13 permits authenticated users with company management permissions to plant malicious scripts in the application origin. Uploading an SVG document containing embedded script elements or JavaScript event handlers as a company logo causes those scripts to execute in any victim's browser session when the company profile is viewed. No public exploit has been identified at time of analysis and this CVE does not appear in CISA KEV, but the attack is low-complexity and requires only standard CRM user permissions.
Stored cross-site scripting in Hugo's fenced-code-block renderer (versions 0.93.0 through 0.165.0) allows a low-privileged content author to inject arbitrary JavaScript into statically generated HTML pages by embedding crafted attribute values in a code-fence info string. The vulnerability arises because Hugo's `markup/internal/attributes/attributes.go` converts attribute values from byte slices to strings during storage, silently bypassing the escaping branch in `RenderAttributes` that only operates on byte slice types - contradicting the function's own documentation. Every visitor who loads an affected page executes the injected script; no public exploit identified at time of analysis, and exploitation has not been confirmed in CISA KEV.
Path traversal in achorein expo-share-intent up to version 8.0.0 allows a local attacker to write files outside the intended cache directory by supplying a crafted `_display_name` value during Android file sharing operations. The `getDataColumn` function in `ExpoShareIntentModule.kt` constructed file paths directly from the unvalidated content-provider display name, enabling directory escape via sequences such as `../../`. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch (v8.0.1) resolves the issue.
HCL Hive exposes its Swagger API documentation publicly to unauthenticated users, revealing API endpoint structures, HTTP methods, request/response schemas, and operational surface without access controls. While no credentials or PII are directly disclosed per the vendor's assessment, the exposed documentation materially reduces the reconnaissance effort required for follow-on attacks against the API. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, placing it in the lower-priority tier despite its network-accessible nature.
Intercepted VNC sessions in Devolutions Remote Desktop Manager are possible because the IronVNC client automatically accepts the server's RSA key without verification during RSA-AES authentication, leaving an on-path attacker able to substitute their own key and relay tampered traffic. Both the 2026.2.x branch (up to 2026.2.17.0) and the 2026.1.x branch (up to 2026.1.24.0) are affected. No public exploit exists and EPSS sits at 0.11% (1st percentile), but the attack requires only network positioning and a user-initiated VNC session, making it a realistic threat on untrusted or adversary-adjacent networks.
Cross-Site Request Forgery (CSRF) in the Hash Form WordPress plugin versions 1.4.0 and below enables unauthenticated remote attackers to trigger unauthorized state-changing actions on behalf of authenticated WordPress users who visit a malicious page. The vulnerability stems from missing or insufficient CSRF token (nonce) validation in the plugin's request handling, classified under CWE-352. With no public exploit identified at time of analysis and an integrity-only impact (CVSS 4.3), this is a medium-severity finding requiring user interaction to exploit.
Stored cross-site scripting in the contacts component of NethServer's WebTop groupware module allows an authenticated attacker to inject persistent JavaScript into shared address book fields, which executes silently in any victim's browser upon viewing the poisoned contact record. All WebTop installations on version 1.5.6 and earlier are at risk; successful exploitation can cascade into session hijacking, credential theft, and unauthorized access across all integrated groupware services including email and file storage. No public exploit has been identified at time of analysis, though the stored XSS class requires minimal technical sophistication once an attacker holds a low-privilege account.