Arbitrary code execution in jahlives openssl_encrypt before 1.4.9 stems from a flawed plugin trust model that uses a denylist rather than an allowlist to identify built-in plugins, so unsigned plugins dropped into top-level plugins/ directories or unrecognized subdirectories evade signature verification entirely. An attacker who can place a malicious plugin along documented installation paths gains code execution inside the CLI process, exposing user passwords and cryptographic keys. No public exploit identified at time of analysis, and the CVSS 4.0 score is 9.3 (Critical), though the network vector conflicts with the local plugin-placement prerequisite.
Arbitrary command execution in jahlives' openssl_encrypt before 1.4.9 arises when the tool's 'info' command reconstructs and prints a CLI invocation using untrusted metadata fields (such as pepper_name) without shell-quoting. An attacker who controls the metadata of an encrypted file can embed shell commands that run on the victim's system the moment the printed CLI block is copied and pasted into a terminal. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk hinges on the victim copy-pasting attacker-influenced output.
SQL injection in toools Isquad exposes the '/ws/apiprensa/getVideoNextPrev' endpoint to unauthenticated database manipulation through the unsanitized id_ambito parameter, which is concatenated directly into a MariaDB query. Remote attackers can inject arbitrary SQL syntax to break query execution, trigger verbose database error messages, and enumerate the internal query and schema structure, which facilitates full data extraction. Reported by INCIBE with a vendor patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
SQL injection in Toools iSquad's '/ws/apiprensa/getVideoSubcanal' API endpoint lets remote unauthenticated attackers manipulate backend database queries via the unsanitized 'id_video' parameter. Failed injection attempts trigger the Slim framework's default error handler, which discloses internal file paths and full stack traces, compounding the SQLi with an information-disclosure primitive. No public exploit has been identified at time of analysis, but a vendor patch is available via INCIBE advisory INCIBE-CERT.
Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker take over or disable a victim team's WeChat (iLink) bot binding. The WeChat share-channel endpoints authorize on the public shareId alone with no identity or team-ownership check, so an attacker who reads a shareId from any shared chat URL can wipe the stored WeChat token (offlining the bot) or bind the app to their own bot to siphon the team's private responses. No public exploit identified at time of analysis, but the flaw is trivially triggerable and fixed in version 4.15.2.
Signature verification bypass in openssl_encrypt (the jahlives Python encryption library) before version 1.4.9 lets attackers who possess a revoked or expired-but-formerly-trusted GPG signing key defeat plugin authenticity checks and run malicious code in the host process. The flaw lives in gpg_runner.verify_detached, which treats a VALIDSIG status line as success while ignoring REVKEYSIG, EXPKEYSIG, and gpg's own exit code. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, unauthenticated CVSS 4.0 score of 9.3 marks it as high priority for any deployment that loads signed plugins.
Account takeover affects the 3DPassport identity component bundled with Dassault Systèmes 3DSwymer across 3DEXPERIENCE releases R2023x through R2026x, where an improper authorization flaw (CWE-285) lets a remote, unauthenticated attacker who lures a victim into interacting with crafted content gain access to some user accounts. Because 3DPassport is the platform's single-sign-on gateway, a successful attack yields high confidentiality and integrity impact and crosses a trust boundary (scope-changed) into downstream 3DEXPERIENCE apps. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied.
SQL injection in toools Isquad lets remote unauthenticated attackers manipulate database queries via the id_seccion parameter of the '/ws/apiprensa/getVideoUltimasSeccion' web-service endpoint. The parameter is concatenated into a complex query using grouping and sorting, letting an attacker break the query structure, trigger database errors that leak internal query logic, and potentially extract or alter content-retrieval data. No public exploit is identified at time of analysis, though the flaw is trivially reachable (AV:N/AC:L/PR:N) and carries a 9.3 CVSS 4.0 score.
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium versions up to and including 0.103.0, where the default-on "Safe import" filter sanitizes HTML for text notes but omits the 'book' note type. Because book-note content is rendered through the same HTML path as text notes and injected via jQuery's html() in grid-view preview cards, an attacker-supplied import archive can smuggle an executable payload past sanitization; on the Electron desktop client with Node integration enabled this becomes full RCE. No public exploit identified at time of analysis, though the upstream fix commit ships a proof-style test payload, and it is not listed in CISA KEV.
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, where the default-on "Safe import" filter sanitizes HTML only for text notes and skips the mindMap note type entirely. An attacker who gets a victim to import a crafted note archive can embed a dangerouslySetInnerHTML payload in the mind map's unsanitized JSON, which Mind Elixir assigns directly to a node's innerHTML when the map is opened; on the Electron desktop client, Node integration turns that XSS into full RCE. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.104.0.
Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, where an attacker-supplied import archive can carry a note whose title contains an HTML event-handler payload. The default-on "Safe import" filter strips scripts but never escapes titles, and the GeoMap view interpolates the marker note's title directly into innerHTML, so the payload fires the moment the victim opens the map; on the desktop Electron client, Node integration turns that XSS into full RCE on the victim's host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw is fixed in version 0.104.0.
Terminal escape-sequence injection in jahlives openssl_encrypt before 1.4.9 lets an attacker embed control characters in a file's metadata that are emitted verbatim when a victim runs the tool's 'info' command, letting the attacker repaint the terminal and forge the integrity/verification output the tool displays. The practical impact is spoofing: a tampered or malicious file can be made to appear verified or trustworthy to the operator. No public exploit identified at time of analysis, and the flaw requires the victim to run 'info' on attacker-supplied input.
Terminal escape-sequence injection in jahlives' openssl_encrypt (a Python OpenSSL-based file encryption utility) before 1.4.9 lets an attacker embed ANSI/VT control sequences in the key_id field of a crafted encrypted file; because the tool prints this attacker-controlled value unescaped to stderr during decrypt key auto-detection, an attacker can repaint the terminal and forge authenticity-verification output to deceive the operator. Any user who decrypts a malicious file is affected. This is a CWE-117 output-neutralization flaw reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.
Verdict spoofing in the openssl-encrypt pip package (versions <= 1.4.8) lets an attacker who controls the contents of a scanned drive forge a PASSED tamper-check result. Because filenames read from untrusted drive data are printed by the verify-usb command without neutralizing terminal control bytes, crafted names containing cursor-movement and erase-line sequences can repaint the screen to hide genuine tamper detection. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue is fixed in 1.4.9, which routes drive-derived names through sanitize_for_display().
Output-encoding text injection in jahlives openssl_encrypt before 1.4.9 lets an attacker forge the desktop GUI's irreversible-removal confirmation dialog. By embedding bidirectional-override and line-separator control characters in the recovery-slot identifier of a crafted encrypted file, an attacker can rewrite the warning text a victim sees, tricking them into approving destructive file-removal operations. No public exploit is identified at time of analysis, and the record is not in CISA KEV; the published 9.3 CVSS 4.0 rating appears inflated relative to the spoofing-only mechanism.
Cryptographic-integrity bypass in the openssl_encrypt file-encryption utility (jahlives) before 1.4.9 lets an attacker edit the header of an envelope-format encrypted file to delete recovery-slot fields without any key and without re-encrypting the payload. Because recovery-slot presence is never cryptographically verified (CWE-347), recovery paths that the owner deliberately added can be silently stripped and the tampering goes undetected. There is no public exploit or CISA KEV listing at time of analysis, and no EPSS score was supplied; the action is trivially performed by anyone able to modify the file, which drives the critical CVSS 4.0 score of 9.3.
Signature-trust bypass in the openssl_encrypt Python library (PyPI 'openssl-encrypt') versions 1.4.8 and earlier lets an attacker get a forged GPG key enrolled as a plugin-signing trust anchor. Because enroll_trust_key matches key fingerprints with a suffix-tolerant comparison, an operator who verifies only a short (~32-bit, forgeable) GPG key id can be tricked into trusting an attacker-controlled colliding key, which then validly signs malicious plugins even under the strict ENFORCE signature policy. No CISA KEV listing and no public exploit identified at time of analysis; the fix is in 1.4.9.
Silent cryptographic key substitution affects openssl_encrypt (the jahlives Python encryption library) before 1.4.9, which loads identities from identity.json without re-deriving and validating their fingerprints. An attacker who can tamper with an identity store can swap in their own public keys while preserving the claimed fingerprint, so the library encrypts data to attacker-controlled keys and treats attacker signatures as valid without any visible warning. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Silent cryptographic key substitution in jahlives openssl_encrypt before 1.4.9 lets attackers register 'shadow' contact entries in the IdentityStore whose namespace collides with a user's own identity, staying hidden until that own identity is deleted. Once the own identity is removed, the attacker-controlled contact surfaces and resolves to the attacker's keys, so files subsequently encrypted for that identity are protected with keys the attacker holds. No public exploit is identified at time of analysis, and the issue is not in CISA KEV; the high CVSS 4.0 score (9.3) reflects the severe confidentiality and integrity impact of undetected key substitution.
Sensitive-file exposure in the openssl-encrypt pip package (openssl_encrypt) at versions <= 1.4.8 stems from its 'Encrypted USB Workspace' feature writing a marker that falsely declares the workspace AES-256-GCM encrypted while the derived key is never applied and the directory remains in cleartext. Users who trust the branding and store files in the workspace leave them fully readable on the removable media, so anyone with physical possession of the USB device can recover the data. No public exploit identified at time of analysis and the flaw is not in CISA KEV, but the failure silently defeats the product's core security promise.
Cryptographic integrity bypass and weak key derivation in the openssl-encrypt Python package (jahlives) before 1.4.9 let an attacker with physical write access to a portable USB drive plant an undetected root-level autorun payload and precompute the drive encryption key offline. The integrity verifier only checks manifest-listed files, so added files pass verification, while a hard-coded fallback KDF salt (_LEGACY_FIXED_SALT) enables an offline rainbow-table attack against drives lacking a per-drive salt. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in the Telnyx MCP server (team-telnyx/telnyx-node, through 6.83.0) lets any network-reachable caller invoke MCP tools with no credential. The Streamable HTTP transport bound to all interfaces and parsed auth headers in a non-failing mode, so a request lacking credentials still completed initialisation and dispatched tools - which then forwarded the server's own stored Telnyx API key, client secret, and code-execution key upstream. Reported by VulnCheck with CVSS 4.0 9.3; no public exploit identified at time of analysis.
Unauthenticated remote code execution affects mims-harvard ToolUniverse through 1.2.6, where the python_code_executor tool runs caller-supplied Python in a sandbox that can be escaped and the HTTP/MCP servers listen on all interfaces with no authentication. Any attacker who can reach the exposed port executes arbitrary code as the server process, since the deny-list source inspection can be bypassed via dunder attribute traversal and a per-call flag that widens the import allow-list. No public exploit code is identified at time of analysis, but the flaw is reported by VulnCheck and carries a CVSS 4.0 base score of 9.3; it is fixed in version 1.3.0.
Missing authentication on the mcp-router CLI's MCP aggregator exposes every backend MCP server it fronts to any network-reachable attacker. In releases before 0.6.3, the `serve` command bound to the all-interfaces address (0.0.0.0) on fixed port 3283 by default and only enforced a token when the operator explicitly passed the `--token` flag, so a normal `mcpr-cli serve ...` invocation published the aggregator unauthenticated to the entire network. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit code or active-exploitation reporting is identified at time of analysis.
OS command injection in Liman server management software (limanmys/core) before version 2.2.2 - 1103 lets an authenticated administrator run arbitrary operating-system commands on the host via the log rotation configuration endpoint. The unsanitized `ip_address` parameter is concatenated into a shell command, allowing single-quote shell-escape to break out and execute attacker-controlled commands. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is fixed in 2.2.2 - 1103.
Arbitrary file upload in the Fluent Boards Pro WordPress plugin (versions 2.0.11 and earlier) lets a user holding the Editor role (or higher) upload files of dangerous types, typically leading to web shell placement and remote code execution on the host. The flaw carries a CVSS 9.1 rating driven by a scope-changed, full-CIA-impact chain, but requires an authenticated privileged account. No public exploit or active-exploitation evidence is present in the supplied data; the issue was catalogued by Patchstack.
Persistent session hijacking is possible in Flowintel version 3.3.0 and later because the application fails to invalidate existing authenticated sessions when a user changes their password. An attacker who already holds a valid session token (from prior access or theft) keeps full authenticated access to the account even after the victim resets the password, since the old session remains usable until natural expiry. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; a vendor fix commit exists.
Improper authorization in Spring Security's embedded UnboundID test LDAP server (UnboundIdContainer) exposes an administrative directory account to the network: the container unconditionally registers an admin credential and binds its listener to all local interfaces (0.0.0.0) rather than loopback. Affected releases span 5.7.0-5.7.25, 5.8.0-5.8.27, 6.4.0-6.4.18, 6.5.0-6.5.11, 7.0.0-7.0.6 and 7.1.0; any application that instantiates this container becomes reachable by remote unauthenticated clients that can then read and modify directory contents using the known admin bind. No public exploit has been identified, and EPSS is low (0.29%, 21st percentile).
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input escape the restricted SimpleEvaluationContext sandbox when the SpEL bytecode compiler is active, affecting Spring Framework 5.2.x through 7.0.8 across the 5.3, 6.0, 6.1, 6.2 and 7.0 lines. Because SimpleEvaluationContext is the API applications are told to use to safely evaluate untrusted expressions, this bypass can escalate a data-binding-only context into broader method invocation with high integrity and availability impact (CVSS 9.1, CWE-913). There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), indicating no observed mass exploitation yet.
Arbitrary file deletion in Veno File Manager (VFM) 4.4.9 lets attackers destroy files outside the intended scope by supplying a crafted path in the `remove=` parameter of the translations-update handler (/vfm-admin/index.php?section=translations&action=update). Because path traversal is not neutralized, an attacker can delete configuration, application, or user files anywhere the web server has write access, enabling denial of service, defacement, or removal of security-relevant files. Publicly available exploit code exists (GitHub PoC), though EPSS remains low (0.16%) and the flaw is not in CISA KEV.
Remote code execution in Spring Integration allows a remote, unauthenticated attacker to run arbitrary code on applications that expose the SerializingHttpMessageConverter on an inbound HTTP endpoint. The converter reads any request body sent with Content-Type application/x-java-serialized-object through a raw java.io.ObjectInputStream.readObject() with no allow-list or class filtering, so if any known Java deserialization gadget is present on the application classpath it can be chained to code execution. No public exploit is identified at time of analysis, but EPSS places it in the 88th percentile (3.44%) and the vulnerability class is well-understood, making it a high-priority patch for exposed deployments.
Remote code execution in Spring Batch 5.2.0-5.2.6 and 6.0.0-6.0.4 arises because the JobParameterDeserializer fails to enforce the trusted-types allowlist when Jackson2ExecutionContextStringSerializer deserializes execution contexts from a job repository backed by an untrusted data source. An attacker who can plant crafted execution-context data can trigger known Jackson polymorphic deserialization gadgets to execute arbitrary code in the batch application's process. No public exploit identified at time of analysis; EPSS is low (0.25%, 16th percentile) and CISA SSVC lists exploitation status as none, so the 9.8 CVSS reflects worst-case impact rather than observed activity.