Unauthenticated integrity manipulation in KubeEdge CloudCore through 1.23.1 allows any network-reachable attacker to submit forged node task status reports to the CloudCore HTTPS server on port 10002, deceiving the Kubernetes edge control plane about the real state of node upgrade jobs. By falsely marking upgrades as succeeded or failed, an attacker can permanently block further upgrade scheduling for affected nodes without any credentials. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.8 reflects network-accessible, zero-interaction exploitation with high integrity impact.
Unauthenticated SQL injection in the Rest Routes WordPress plugin (through version 5.5.5) allows any remote attacker to extract sensitive data from the underlying WordPress database by crafting a malicious request to a publicly accessible REST endpoint. The flaw stems from a URL-derived parameter being passed directly into a SQL query without sanitization or parameterization, requiring no authentication and no user interaction. A publicly available proof-of-concept exists per WPScan, though the EPSS score of 0.18% (7th percentile) indicates exploitation remains infrequent despite the PoC's accessibility.
Unauthenticated access to privileged operations in the User Profile Builder WordPress plugin (versions up to 4.0.1) allows any visitor to enumerate the site's media library and alter unpublished posts, pages, and media items belonging to other users. The front-end file upload feature omits the required WordPress role capability checks, effectively granting anonymous users the access level of a trusted content author. A publicly available proof-of-concept exploit exists via WPScan, though EPSS at 0.13% (3rd percentile) indicates limited observed in-the-wild activity despite POC disclosure.
Full-read Server-Side Request Forgery in the SmartAIPress WordPress plugin (through version 1.2.0) allows any subscriber-level authenticated user to force the WordPress server to fetch arbitrary internal or external URLs and return the full response body. The vulnerability stems from a missing capability check on an AJAX action combined with zero server-side URL validation, making internal cloud metadata endpoints, intranet services, and private API surfaces reachable by low-privilege users. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.13% (3rd percentile), indicating limited mass automated exploitation at time of analysis.
Unauthenticated information disclosure in the HEL Online Classroom WordPress plugin (versions ≤ 1.0.3) exposes the BigBlueButton shared secret through an unprotected REST API route, enabling any remote attacker to retrieve stored plugin settings without credentials. With the exposed shared secret, an attacker can forge valid HMAC-signed API requests directly against the connected BigBlueButton server, allowing unauthorized access to or disruption of virtual classroom sessions. No public KEV confirmation exists, but a public exploit is available via WPScan; EPSS is low at 0.14%, consistent with the plugin's niche footprint.
Payment confirmation bypass in the Appointment Booking Calendar Plugin and Scheduling Plugin for WordPress (versions before 1.6.3) lets unauthenticated users complete paid appointment bookings by submitting only a fraction of the listed price. The plugin stages a server-side price for each booking but fails to validate the amount actually received from the payment processor against that staged figure before confirming the appointment. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV, and EPSS sits at just 0.14%, indicating limited observed mass exploitation despite the PoC.
Remote code execution in BookStack before 26.05.4 stems from a missing MIME-type enforcement gate in the portable ZIP import pipeline, allowing authenticated users with Import Content and Create Books permissions to store a PHP webshell directly in the public web root. The import runner extracts the attacker-supplied .php file from the ZIP archive and places it in the publicly accessible image storage path without validating the file type against a supported image MIME allowlist, because the cover field used the generic fileReferenceRule() rather than imageFileReferenceRule(). Once stored, any unauthenticated HTTP client can request the cover URL to trigger PHP execution on the server. No public exploit code has been identified at time of analysis, but VulnCheck has reported this issue and a patch commit is confirmed available.
Directory traversal in the cohttp OCaml HTTP library before version 6.3.0 allows unauthenticated remote attackers to read arbitrary files outside the configured document root by supplying percent-encoded path traversal sequences such as `..%2f..%2f` in HTTP request URIs. The root cause (CWE-180) is that `Cohttp.Path.resolve_local_file` validated and stripped `.` and `..` segments before percent-decoding the URI, meaning encoded traversal bypassed sanitization entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a straightforward read primitive for any server using cohttp's static file resolution.
Server-side template injection in Skyvern's TextPromptBlock before version 1.0.45 allows authenticated workflow users to achieve remote code execution at server process privileges. The flaw arises from a double-rendering design defect: user-controlled workflow parameters are first rendered through a sandboxed Jinja2 environment, then re-rendered through an unsandboxed call inside send_prompt, defeating the sandbox entirely. No public exploit has been identified at time of analysis, but Jinja2 SSTI exploitation is well-documented, making this a low-effort path for any attacker holding a workflow user account.
Unauthenticated file upload in Documenso before 2.13.0 exposes the /api/files/upload-pdf endpoint to any remote actor without requiring session tokens, API keys, or any credential, enabling indefinite storage exhaustion and database flooding with orphaned document records. The flaw (CWE-306, Missing Authentication for Critical Function) carries a CVSS 4.0 score of 8.7 with a confirmed AV:N/PR:N vector, meaning exploitation requires only network reachability and standard HTTP tooling. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the trivial attack complexity makes automated abuse highly plausible against self-hosted instances exposed to the internet.
Cleartext password storage in rust-iot-platform (through commit 5df942ab) enables unauthenticated network attackers to harvest plaintext credentials for every registered account by querying standard user retrieval and listing API routes. The root cause is CWE-256: the user model persists passwords without hashing, and those fields are then serialized into API responses without sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis, but the triviality of exploitation - a plain HTTP GET to an exposed endpoint - makes CVSS 4.0's 8.7 score a credible reflection of real-world risk for any internet-exposed deployment.
Authentication bypass in pac4j-core before 6.5.6 allows authenticated users holding a weaker profile type to access resources that enforce a stronger profile type requirement, due to a reversed Java class inheritance check in CheckProfileTypeAuthorizer. The single-character logical inversion - swapping the operands of isAssignableFrom - causes the authorizer to grant access when a base/generic profile is presented against a check expecting a specific subtype (e.g., SAML or OIDC profile), instead of blocking it. No public exploit has been identified at time of analysis, but the fix is confirmed in the 6.5.6 release commit alongside five other security hardening changes.
Authorization bypass in iFlytek astron-agent through 1.1.1 enables authenticated low-privilege users to enumerate workflow identifiers and access workflows owned by other tenants via the copyFlow endpoint, which performs no ownership validation. Attackers can both exfiltrate private workflow definitions - exposing proprietary AI automation logic - and overwrite other tenants' production workflows, achieving high confidentiality and integrity impact across tenant boundaries. No active exploitation is confirmed by CISA KEV and no EPSS data was available, but the vulnerability is publicly disclosed via a GitHub issue and a VulnCheck advisory, making the technical details openly accessible to potential attackers.
Privilege escalation in pac4j-oidc before 6.5.6 allows authenticated attackers to forge Keycloak access tokens and claim arbitrary administrative roles without cryptographic validation. The `KeycloakRolesAuthorizationGenerator` component extracted realm and client role claims directly from access token payloads without verifying signatures, issuers, audiences, or expiration - violating core JWT and OIDC validation requirements. Any application relying on pac4j Keycloak role-based authorization is exposed to full authorization bypass; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Privilege escalation in Sudo through 1.9.17p2 allows any local user holding a sudo rule to execute arbitrary commands when ptrace-based intercept mode is enabled. The intercept layer in exec_ptrace.c monitored only execve(2) system calls, leaving execveat(2) - and the fexecve libc wrapper built atop it - entirely uninspected, bypassing both policy enforcement and audit logging. No public exploit has been identified at time of analysis; the upstream fix is available as a confirmed commit to the sudo-project repository.
Privilege escalation in su-exec through version 0.3 allows local attackers with low-privilege access to execute arbitrary programs as root by supplying crafted oversized numeric user or group identifiers. The root cause is an unchecked integer truncation: strtol() returns a 64-bit long on modern Linux, but su-exec assigns the result directly to uid_t and gid_t (32-bit unsigned integers) without range validation - values like 4294967296 (2^32) silently truncate to UID/GID 0, the root account. A public proof-of-concept is available and no vendor-released patch has been identified at time of analysis, making this an active remediation gap for container deployments dependent on su-exec.
Improper certificate validation in Cloud Foundry's bosh-vsphere-cpi-release exposes vCenter administrator credentials to any attacker with a network position between the BOSH Director and vCenter. The vSphere CPI transmits credentials via HTTP Basic authentication on every routine cloud infrastructure operation and fails to enforce TLS certificate authenticity, allowing a rogue endpoint to impersonate the vCenter REST API and silently capture those credentials. Successful interception yields full administrative control over every virtual machine, datastore, and network segment managed by the compromised vCenter instance. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login WordPress plugin (versions ≤5.4.6) allows a remote, unauthenticated attacker to overwrite the plugin's stored IdP X.509 signing certificate and subsequently forge SAML assertions to obtain a fully privileged session as any WordPress account, including administrators. The flaw originates in the ACS handler persisting an attacker-supplied certificate from an incoming SAMLResponse before signature validation is enforced - a logic ordering error that wholly undermines SAML trust. Exploitation is gated by a required administrator interaction (triggering the test_config_error_wpsamlerr004 repair flow), and no public exploit code or CISA KEV listing has been identified at time of analysis.