Authentication bypass in pac4j-oidc before 6.5.6 allows remote unauthenticated attackers to establish authenticated sessions by submitting OIDC callback requests carrying only a third-party access token, bypassing issuer, audience, nonce, and subject validation entirely. Applications built on the pac4j Java security framework that use OIDC for single sign-on are vulnerable to token substitution attacks from any attacker who holds a valid access token issued by the same identity provider for any other registered OAuth client. No public exploit code has been identified at time of analysis; vendor-released patch is available in version 6.5.6.
MasterStudy LMS WordPress Plugin versions before 3.7.42 expose order billing records - including customer names, email addresses, phone numbers, and postal addresses - to any authenticated user holding the instructor role, via insecure direct object reference on order IDs. An instructor can iterate through order IDs in the plugin's order-detail endpoint to retrieve billing information belonging to arbitrary other users without any administrative interaction. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation has been observed and the EPSS probability remains extremely low at 0.13%.
Missing authorization enforcement in the Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 allows authenticated customers to escalate their own booking status without approval and tamper with other customers' statuses on shared appointments. The flaw (CWE-863) stems from the absence of a WordPress capability check before processing status-change requests, meaning any user with a booking can invoke the endpoint and set arbitrary statuses. No public exploitation has been confirmed by CISA KEV, but a publicly available proof-of-concept exists per WPScan.
SQL injection in PHPGurukul Student Information System 1.0 exposes the `/student_edit1.php` endpoint to database manipulation via an unsanitized `ID` parameter. Remote attackers with low-privilege application credentials can read, alter, or partially disrupt data stored in the backend database. A public proof-of-concept is available on GitHub, lowering the technical barrier for opportunistic exploitation against internet-facing deployments.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the unsanitized 'ID' parameter in /pages/emp_del.php. The CVSS 4.0 vector (PR:L, E:P) confirms exploitation requires a low-privileged authenticated session but no special configuration beyond basic access. A public proof-of-concept exploit has been released, raising the practical risk above what the moderate CVSS score alone suggests; however, this vulnerability is not currently listed in CISA KEV.
Server-Side Request Forgery in MITRE SAF Heimdall 2.11.6 through 2.13.x allows unauthenticated remote attackers to reach internal network hosts by supplying an arbitrary host_url parameter to the Tenable proxy endpoint, which the backend forwards without validation. The root cause is the absence of both authentication guards and URL allowlist enforcement on the /tenable proxy route, as confirmed by the fix commit adding JwtAuthGuard and an origin-based allowlist. No public exploit code and no CISA KEV entry are identified at time of analysis, limiting immediate real-world risk despite the network-accessible, no-authentication attack vector.
Stored XSS in Formwork through 2.3.14 allows unauthenticated remote attackers to inject persistent malicious markup into the Statistics panel by crafting HTTP requests with malicious Referer headers. The visit-tracking subsystem records the Referer host value without HTML escaping, storing attacker-controlled content in the statistics data. When an administrator opens the Statistics panel, the injected payload executes in their browser, enabling session hijacking, credential theft, or further compromise of the admin interface. No public exploit code or CISA KEV listing is identified at time of analysis.
Open redirect in pac4j-core before 6.5.6 allows network-accessible attackers to redirect authenticated users to attacker-controlled sites immediately after logout. DefaultLogoutLogic.perform() validated logout redirect targets against a URL pattern regex, but that regex did not exclude backslash characters; browsers normalize backslash-prefixed paths (e.g., \evil.com) into network-path references (//evil.com), bypassing the intended allow-list. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the low attack complexity makes exploitation straightforward once a crafted logout link reaches a victim.
TOTP code replay in Rodauth before 2.47.0 allows an attacker who has already obtained a victim's credentials and observed a valid one-time password to reuse that code within the configured drift window, bypassing the second authentication factor. The otp feature lacked any mechanism to record when a code was last accepted, so a single 30-second TOTP token could authenticate multiple distinct sessions during the drift period. No active exploitation is confirmed in CISA KEV, but the patch commit includes a working exploit reproduction in the regression test suite, and the attack mechanic is mechanically straightforward for any adversary who holds prior credential access.
JWT access token indefinite renewal in Rodauth before 2.47.0 allows an attacker who possesses a valid access token to bypass the refresh token requirement entirely. By sending a non-POST HTTP request to the jwt_refresh route, the library still issues a new valid JWT access token without validating a refresh token, enabling perpetual session extension. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the patch is available in version 2.47.0.
Open redirect in Rodauth before 2.47.0 enables post-authentication phishing by failing to reject protocol-relative return-to paths beginning with double slashes. The three affected features - confirm_password, login_return_to_requested_location, and two_factor_auth_return_to_requested_location - stored the raw request path into session without validating that it could not resolve as an external URL. No public exploit or active exploitation has been confirmed at time of analysis, and a patch is available in version 2.47.0.
CSRF protection bypass in Rodauth before 2.47.0 allows remote attackers to force victims into authenticated sessions under attacker-controlled accounts by exploiting an unanchored regular expression in the JSON feature. The JSON content type detection regex used a word-boundary anchor instead of a start-of-string anchor, enabling cross-origin form submissions with content types such as 'application/x-www-form-urlencoded; application/json' to be misclassified as JSON requests, which Rodauth treats as CSRF-exempt. No active exploitation has been confirmed in CISA KEV, and no public exploit tooling has been identified at time of analysis.
Race condition in macrozheng mall's /order/submit endpoint (versions up to 1.0.3) allows authenticated remote attackers to exploit unsynchronized order state through concurrent HTTP request timing. The CVSS 4.0 vector (AV:N/AC:H/PR:L) confirms network reachability but high attack complexity and a required authenticated session, yielding limited integrity and availability impact. No public exploit code has been identified and the vendor deleted the associated GitHub issue without explanation, reducing transparency around scope and remediation.
Payment status workflow bypass in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to manipulate the orderId parameter at the /order/paySuccess endpoint, potentially marking arbitrary orders as paid without completing actual payment. This CWE-841 business logic flaw directly threatens e-commerce transaction integrity - a proof-of-concept exists (CVSS 4.0 E:P), though no active exploitation is confirmed in CISA KEV. Notably, the vendor silently deleted the GitHub disclosure issue without providing any remediation, leaving no patch available at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote low-privileged attackers to manipulate database queries via the `ID` parameter in `/pages/emp_edit.php`. The vulnerability requires a valid (low-privilege) application account but no further conditions, and a public proof-of-concept exploit is available per the VulDB report. Real-world risk is dampened by the product's narrow deployment footprint - itsourcecode distributes educational/tutorial-grade PHP source code primarily consumed by students, not production deployments.