OAuth authorization code forwarding to attacker-controlled hosts is enabled by an open redirect flaw in Twenty CRM through version 2.35.0, where the OAuthPropagatorController.propagateOAuthCallback endpoint accepts the state query parameter as an unvalidated redirect URL. Instances running with IS_MULTIWORKSPACE_ENABLED disabled are specifically vulnerable because this configuration bypasses the domain validation logic that would otherwise restrict redirect targets. No active exploitation has been confirmed in the CISA KEV catalog and no public proof-of-concept code was identified in the provided data, but the attack requires only a crafted link and passive victim interaction.
Capture-replay authentication bypass in the Forminator WordPress plugin (versions up to and including 1.57.1) allows unauthenticated network-accessible attackers to achieve low-level integrity impact against affected installations. Reported by Patchstack under CWE-294, the flaw enables replay of captured authentication or nonce tokens, potentially allowing unauthorized form actions or integrity-affecting operations without valid credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Server-Side Request Forgery in the Everest Forms WordPress plugin (all versions up to and including 3.4.4) enables unauthenticated remote attackers to force the WordPress server to issue arbitrary outbound HTTP HEAD requests to attacker-controlled URLs. The flaw resides in the plugin's upload field handling: when a form submission triggers re-rendering due to a missing required field, unsanitized POST-supplied URLs are passed directly to WordPress's `wp_remote_head()` without any domain restriction. No active exploitation has been confirmed by CISA KEV, though the zero-authentication requirement and WordPress's broad deployment footprint elevate practical risk for internal network reconnaissance and cloud metadata endpoint probing.
Authentication bypass via identity spoofing in WPDeveloper's Essential Addons for Elementor WordPress plugin (versions through 6.8.0) enables unauthenticated network attackers to circumvent CAPTCHA verification controls. The flaw, classified as CWE-290 (Authentication Bypass by Spoofing), allows an attacker to spoof identity data accepted by the plugin, defeating bot-protection mechanisms on login, registration, or other CAPTCHA-gated forms. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified; however, the low complexity and zero-privilege requirement make opportunistic abuse plausible.
Reflected XSS in the All Video Share Joomla extension (versions 1.0.0 through 4.5.0) exposes site visitors to script injection attacks when they interact with attacker-crafted URLs. Multiple user-supplied input parameters are rendered in HTTP responses without HTML encoding, providing several distinct reflected XSS entry points. No public exploit code or active exploitation has been identified at time of analysis, and no KEV listing exists.
Path traversal in houtini-lm (versions up to 2.13.2) allows an authenticated remote user to supply crafted absolute paths to the code_task_files tool, causing the server to read files outside its intended working directory. Because code_task_files forwards file contents directly to the configured LLM endpoint - which may be a remote provider such as OpenRouter - a successful traversal can silently exfiltrate sensitive files (SSH keys, environment files, cloud credentials) off the machine to a third-party service. No public exploit has been identified and the CVE has not been added to the CISA KEV catalog; an upstream fix is available in commit 35d97bca.
Cross-site request forgery in AVideo's live-channel controls endpoint allows a remote, unauthenticated attacker to silently hijack a logged-in streamer's viewer-redirect configuration. The PHP endpoint `/plugin/Live/myLiveControls.save.json.php` accepts GET requests without a CSRF token or origin check, permitting an attacker who can socially engineer a streamer to visit a malicious page to overwrite `customUrl`, `customMessage`, and `autoRedirect` settings persisted in `users.externalOptions`. Downstream impact falls on stream viewers, who can be silently redirected to attacker-controlled phishing sites or shown spoofed messages. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.1 reflects the mandatory victim-interaction requirement.
Graylog Server's system catalog entity titles API endpoint leaks protected database fields - including user password hashes - to authenticated requesters who craft custom field-selection parameters. PR:L authentication is required, and permission checks are partially enforced: regular users are limited to their own password hash, but any user holding an admin role can extract password hashes for every account in the system. No public exploit or CISA KEV listing has been identified; vendor-released patch 7.1.4 is available and is the only remediation.
Dsync stream protocol command injection in OX Dovecot Pro and OX Dovecot CE allows an authenticated mail user to store crafted content that is later interpreted as dsync protocol commands when an administrator runs dsync with the stream protocol during a migration or replication. Successful injection enables modification of mailbox state on the destination server, including internal mailbox attributes that a user should not be able to manipulate directly. No public exploits are known and no CISA KEV listing exists; exploitation depends on an administrator-initiated dsync stream operation against a mailbox containing attacker-controlled content.
Stored or reflected cross-site scripting in SOY Gallery, a web-based gallery application by Tsuyoshi Saito, allows an authenticated low-privilege attacker to inject arbitrary script that executes in the browser of any logged-in user who views the affected content. The CVSS scope-change metric (S:C) confirms the impact crosses from the attacker's session into the victim's browser context, enabling session hijacking or credential theft. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-site scripting in SOY Calendar (by Tsuyoshi Saito) enables a remote attacker holding a low-privilege account to inject arbitrary JavaScript that executes within the browser session of other logged-in users. The CVSS scope-change indicator (S:C) confirms the injected script breaks out of the application's own security boundary, elevating the practical risk beyond the medium base score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored or persistent cross-site scripting in SOY Calendar by Tsuyoshi Saito allows a low-privileged authenticated attacker to inject arbitrary JavaScript that executes in other logged-in users' browsers. The CVSS scope change (S:C) confirms the payload crosses a security boundary, targeting victim sessions rather than the attacker's own context. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure was coordinated through JPCERT/CC.
Stored cross-site scripting in the MongoDB BI Connector Transition Readiness Report tool allows a low-privileged MongoDB user with write access to inject malicious script payloads into database metadata. When a second user generates and opens the resulting HTML report, the embedded scripts execute in their browser context, potentially exposing report contents or manipulating the displayed output. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the stored delivery model increases reachability beyond typical reflected-XSS scenarios.
Stored Cross-Site Scripting in the Bit Assist WordPress plugin (versions before 1.7.2) allows an authenticated administrator to inject persistent malicious scripts via the Call-To-Action feature. When other users or administrators visit affected pages, the injected payload executes in their browser context, enabling session hijacking, credential theft, or forced redirection to attacker-controlled sites. No public exploit or CISA KEV listing is confirmed at time of analysis; EPSS of 0.15% (4th percentile) reflects very low observed exploitation probability.
Use-after-free (CWE-416) in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to crash the browser through a crafted webpage, resulting in a denial-of-service condition. Critically, the CVE description claims code execution capability, but the CVSS vector (C:N/I:N/A:L, score 4.3) directly contradicts this - a genuine RCE would produce C:H/I:H impact in the 8-9+ range; this discrepancy should be verified against the full MSRC advisory. No active exploitation has been confirmed and no public POC has been reported; a vendor patch is available via the Microsoft Security Response Center.
Memory corruption via out-of-bounds write in OX Dovecot Pro and OX Dovecot CE's ManageSieve service allows authenticated network attackers to crash the ManageSieve process, denying all users the ability to remotely manage Sieve email filter scripts. The root cause is improper handling of extreme numeric literals during Sieve script compilation. The vendor notes that remote code execution may theoretically be achievable via the same memory corruption primitive, though no public exploit demonstrates this; no public exploits are known and the vulnerability is not listed in CISA KEV.
Server-Side Request Forgery in Synology Chat Server's webhook functionality allows remote authenticated users to probe internal or external network resources and retrieve non-sensitive information. Affected versions are all Chat Server releases prior to 2.4.5-22148. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the authenticated network attack vector and low complexity make this straightforward to exploit for any valid user of the application.
Authenticated availability disruption in OX Dovecot Pro and OX Dovecot CE allows any valid credential holder to crash the imap-hibernate service by opening many concurrent connections and sending malformed IMAP commands, triggering an intermittent out-of-bounds read (CWE-125). The crash terminates the imap-hibernate process, dropping hibernated IMAP sessions for co-hosted users and degrading service availability. No public exploit code is known and the vulnerability is not listed in CISA KEV; however, the low attack complexity means any authenticated user on a shared mail platform could attempt disruption.
Uncontrolled CPU consumption in OX Dovecot Pro and OX Dovecot CE allows authenticated IMAP users to trigger a denial of service by issuing malformed or resource-intensive IMAP LIST commands. Both the commercial (Pro) and community (CE) editions of Open-Xchange's Dovecot distribution are affected across all tracked versions per CPE data. No public exploit code has been identified at time of analysis, and the CVSS score of 4.3 reflects the authenticated-access prerequisite and limited availability impact.
Submission-login process crashes with an epoll() panic in OX Dovecot Pro and CE when the per-IP connection limit (mail_max_userip_connections, default 10) is reached, due to improper file descriptor handling (CWE-403). In high-performance mode - the default for Pro releases - the crash terminates all connections managed by the affected process, not just the triggering one, creating a broader denial-of-service for email submission. A secondary side effect of duplicate message delivery is possible when backend TLS is absent. No public exploits are known and this vulnerability is not listed in CISA KEV.
DOM-based cross-site scripting in Yamcs's /ext URL routing endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL - typically via phishing. The vulnerability exists in extension.component.ts, where URL path segments are inserted into the DOM via innerHTML without validation against legitimate custom element names, allowing injected HTML event handlers to fire. Vendor-released patches are available in yamcs-5.12.8 and yamcs-5.13.2; no public exploit code or CISA KEV listing has been confirmed at time of analysis.
Incomplete authorization fix in Vikunja v2.3.0 allows Write-level collaborators to detach a shared child project from its parent hierarchy by supplying parent_project_id: 0, bypassing the Admin permission gate introduced by the CVE-2026-35595 fix. The flaw exists in versions v2.3.0 through the latest unstable builds and is fixed in v2.4.0. A detailed, independently reproducible proof-of-concept with curl commands is publicly documented in the GHSA advisory, though no CISA KEV listing has been identified at time of analysis.
Memory disclosure in OX Dovecot Pro and OX Dovecot CE exposes uninitialized server process memory to authenticated IMAP users who send a malformed URLFETCH command. The IMAP URLAUTH extension's error-handling path fails to sanitize its response buffer, returning raw memory contents to the requesting client that may include session tokens, cached credentials, or message data from co-resident sessions. No active exploitation has been identified and no public exploits are known, though the low attack complexity for authenticated users makes insider threats and compromised accounts realistic vectors.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated low-privilege attacker to coerce the application server into issuing arbitrary outbound HTTP requests, enabling internal network enumeration and potentially pivoting to other attacks against backend infrastructure. The CVSS vector (PR:L/AV:N/AC:L) confirms this is exploitable over the network by any authenticated user without elevated permissions or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via their support portal.
Authentication bypass in OX Dovecot Pro and CE allows any host configured as a trusted proxy to impersonate arbitrary mail users without knowing their passwords, by injecting forged fields into Dovecot's internal authentication pipeline. The flaw is conditional: both a trusted proxy must be configured and the password database must honour a field permitting password-free authentication - deployments without trusted proxies are fully unaffected. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis.
Login process denial-of-service in OX Dovecot Pro and OX Dovecot CE allows a host designated as a trusted proxy to crash the Dovecot authentication process by injecting a NUL byte into proxy forwarding headers, disrupting subsequent login attempts for all users. The vulnerability carries a CVSS 4.3 (Medium) score with an adjacent-network vector, confining realistic exposure to deployments that explicitly configure trusted proxy hosts - a non-default setup. No public exploit is identified at time of analysis, and Open-Xchange has issued a security advisory with patch guidance.
Incorrect access control in the getDeviceInfo endpoint of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes device identification details to unauthenticated adjacent-network attackers via a crafted POST request to /cgi-bin/cstecgi.cgi. The missing authentication check on this CGI function allows any host on the same network segment to enumerate device model, firmware version, and related identification metadata without credentials. No public exploit or active exploitation has been identified; with an EPSS of 0.18% (7th percentile) and adjacent-only reach, real-world risk is low.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes AP-specific Wi-Fi scheduling rules to adjacent-network attackers. The getApWiFiSchCfg CGI function at /cgi-bin/cstecgi.cgi enforces no access control, allowing any host on the same network segment to retrieve scheduling configurations via a crafted POST request without credentials. No active exploitation or public exploit code has been identified; EPSS at 0.18% and SSVC 'Exploitation: none' both confirm low real-world priority.
Guest Wi-Fi configuration exposure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any adjacent-network attacker without credentials to retrieve the router's guest wireless settings by sending a crafted POST to /cgi-bin/cstecgi.cgi invoking the getWiFiGuestCfg function. The CGI dispatcher performs no session or privilege check before returning guest SSID and passphrase data, a pattern consistent with multiple other access-control deficiencies in the same firmware. No public exploit code or active exploitation has been identified; EPSS stands at 0.18% (7th percentile) and SSVC rates technical impact as partial.
Unauthenticated wireless credential exposure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any device on the adjacent network to retrieve SSIDs and Wi-Fi pre-shared keys by sending a crafted POST request to the router's `/cgi-bin/cstecgi.cgi` CGI endpoint invoking the `getWiFiBasicCfg` function. The handler performs no authentication check before returning sensitive wireless configuration data, meaning no credentials, tokens, or session state are required. No public exploit is identified at time of analysis, and EPSS sits at 0.18% (7th percentile), indicating limited observed exploitation pressure to date.
Unauthenticated guest Wi-Fi credential exposure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows adjacent-network attackers to retrieve the guest network SSID and password by posting a crafted request to /cgi-bin/cstecgi.cgi targeting the getWiFiEasyGuestCfg handler, which performs no session or authentication validation before returning configuration data. The vulnerability is part of a broader pattern of access-control omissions across this firmware's CGI dispatcher. No public exploit or CISA KEV listing exists, and the 0.18% EPSS score (7th percentile) reflects minimal automated exploitation interest; the adjacent-network constraint (AV:A) limits the realistic attacker population to physically proximate parties.
Unauthenticated disclosure of advanced wireless configuration on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 is possible by any attacker with LAN or WiFi adjacency to the device. The getWiFiAdvancedCfg handler in /cgi-bin/cstecgi.cgi performs no access-control check before returning advanced WiFi settings in response to a crafted POST request. No public exploit has been identified and EPSS is very low (0.18%, 7th percentile); exploitation is bounded to adjacent-network attackers and carries no integrity or availability impact.
Unauthenticated DDNS credential disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any attacker on the local network to retrieve the router's configured DDNS domain, username, and password by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The getDdnsCfg function lacks any authentication gate (CWE-284), returning sensitive DDNS account credentials without verifying session state. No public exploit code and no CISA KEV entry exist; EPSS sits at 0.18%, indicating opportunistic rather than systematic exploitation.
Smart QoS configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows unauthenticated attackers on the same network segment to read QoS rules and configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The getSmartQosCfg function lacks any access control enforcement, exposing network prioritization policies and associated device rules without credentials. EPSS is low (0.18%, 7th percentile) and no active exploitation has been identified; however, this flaw is consistent with a documented systemic pattern of missing authentication across multiple TOTOLINK T6 CGI endpoints.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes UPnP enablement status and parsed port-mapping rules to adjacent-network attackers. The getUPnPCfg CGI handler on /cgi-bin/cstecgi.cgi accepts POST requests without enforcing authentication, violating the access-control model for device configuration endpoints. No active exploitation has been recorded and EPSS sits at the 7th percentile, reflecting low real-world threat at this time.
Unauthenticated storage configuration disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the device's storage feature state to any attacker on the adjacent network. The `getStorageCfg` function in the CGI handler at `/cgi-bin/cstecgi.cgi` fails to enforce access control, allowing a crafted POST request to retrieve storage configuration data without credentials. Impact is limited to read-only disclosure of storage feature state - not credentials or encryption keys - and no public exploit or active exploitation has been identified at time of analysis.
Incorrect access control in the TOTOLINK T6 router's `getStaticDhcpRules` CGI handler exposes static DHCP reservation rules to any unauthenticated attacker within adjacent network range, requiring only a crafted POST to `/cgi-bin/cstecgi.cgi`. Affected firmware is version 4.1.5cu.748_B20211015; the attack vector is limited to adjacent network (LAN or Wi-Fi), narrowing the realistic threat surface considerably. No public exploit code or active exploitation has been identified; the EPSS score of 0.18% (7th percentile) confirms very low exploitation probability at time of analysis.
Unauthenticated information disclosure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) exposes schedule and scheduled-reboot configuration to any adjacent-network host. The CGI dispatcher at /cgi-bin/cstecgi.cgi serves the getScheduleCfg function without validating session credentials, allowing any LAN or Wi-Fi neighbor to retrieve timing configuration data via a crafted POST request. No public exploit identified at time of analysis, and the 0.18% EPSS score at the 7th percentile reflects very limited exploitation probability.
Unauthenticated MAC filter rule disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 permits any LAN-adjacent device to retrieve the router's MAC address filtering policy via a crafted POST to /cgi-bin/cstecgi.cgi without credentials. The getMacFilterRules CGI handler fails to enforce access control (CWE-284), exposing firewall policy data that could assist a local attacker in MAC address spoofing to bypass network access restrictions. No public exploit code or active exploitation is identified; EPSS of 0.18% (7th percentile) reflects negligible real-world exploitation interest.
Incorrect access control in the getAccessDeviceCfg handler of TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any unauthenticated device on the local network to retrieve access-device policy rules and client connection state by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CWE-284 flaw exposes MAC-address-level access control lists and client status, enabling network reconnaissance by co-located attackers. No active exploitation is confirmed (absent from CISA KEV), and EPSS at 0.18% (7th percentile) reflects minimal observed scanning activity; GitHub CVE coordination repositories are referenced but contain no confirmed public exploit code.
Unauthenticated access to the RebootSystem function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any adjacent-network attacker to force an immediate device reboot by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The CVSS vector (AV:A) constrains the attack to the same LAN or WiFi segment, limiting exposure to local network adversaries. No public exploit code has been confirmed and EPSS sits at 0.18% (7th percentile), reflecting negligible observed exploitation pressure; researcher coordination documents are publicly available on GitHub.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes WPS runtime status to any attacker on the adjacent network. The `getStaticDhcpRules` CGI handler at `/cgi-bin/cstecgi.cgi` fails to enforce access control, allowing a crafted POST request to retrieve WPS operational state without credentials. No public exploit code or active exploitation has been identified at time of analysis; the EPSS score of 0.18% (7th percentile) reflects correspondingly low real-world exploitation interest.
Incorrect access control in the TOTOLINK T6 router firmware exposes VPN pass-through and WAN ping filter settings to unauthenticated adjacent-network attackers. Firmware version 4.1.5cu.748_B20211015 fails to enforce authentication on the getVpnPassCfg function reachable via a crafted POST to /cgi-bin/cstecgi.cgi, leaking network configuration data. EPSS sits at 0.18% (7th percentile), no public exploit code has been identified, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh portal table data to any adjacent network attacker. The getMeshPortalTable function in /cgi-bin/cstecgi.cgi performs no authentication check, allowing a crafted POST request to retrieve mesh network topology details without credentials. No active exploitation is confirmed and EPSS is low (0.18%), but the adjacent-network vector means exploitation is trivially simple for any attacker already on the local network.
Unauthenticated disclosure of Wi-Fi scheduling rules in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any adjacent-network attacker to read the router's getWiFiScheduleCfg configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi without credentials. The CGI handler performs no access control check before returning scheduling policy data. No public exploit code or active exploitation has been identified; EPSS is 0.18% (7th percentile), consistent with limited real-world attacker interest.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes mesh neighbor table data to any attacker on the adjacent network. The getMeshNeighborTable function in the /cgi-bin/cstecgi.cgi CGI interface fails to enforce access control, allowing a crafted POST request to retrieve mesh network topology without credentials. No public exploit or active exploitation is confirmed; EPSS at 0.18% and SSVC exploitation status of 'none' indicate minimal real-world threat at present.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes Telnet service enablement status to any attacker on the adjacent network segment. The getTelnetCfg function in the CGI interface fails to enforce access control, allowing an unauthenticated POST request to /cgi-bin/cstecgi.cgi to reveal whether the Telnet daemon is active - a reconnaissance-grade leak rather than a full compromise. No public exploitation or active KEV listing exists; EPSS at 0.17% (7th percentile) reflects minimal real-world exploitation interest.
Unauthenticated information disclosure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any adjacent-network attacker to retrieve traceroute diagnostic logs by sending a crafted POST request to /cgi-bin/cstecgi.cgi without credentials. The getTracerouteCfg function applies no access control (CWE-284), returning routing diagnostic data including network hop topology and IP addresses to any LAN-resident requester. EPSS is 0.17% (7th percentile), no CISA KEV listing exists, and no public exploit code has been identified, placing this firmly in a low-priority category despite the zero-authentication requirement.
Broken access control in WpEvently WordPress plugin versions 5.5.0 and earlier permits authenticated subscribers to invoke functionality or access data restricted to higher-privileged roles. The flaw is rooted in CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper capability checks on one or more actions accessible to low-privilege users. No public exploit has been identified at time of analysis, and the absence of a KEV listing combined with the PR:L requirement limits opportunistic mass exploitation, though sites with open user registration face meaningful risk.
Subscriber-level Insecure Direct Object Reference (IDOR) in WP Job Portal WordPress plugin versions up to and including 2.5.9 allows low-privilege authenticated users to perform unauthorized modifications to job-related objects belonging to other users. The flaw arises from missing server-side authorization checks on user-controlled object identifiers, enabling a subscriber to target and alter records - such as job applications or listings - that they do not own. No confirmed active exploitation or public exploit code has been identified at time of analysis.