Stored XSS in the MW WP Form WordPress plugin (all versions before 5.1.6) lets authenticated users holding the Editor role or above inject persistent malicious JavaScript into form settings, which then executes in the browser of any administrator who views the affected dashboard page. A publicly available proof-of-concept has been published by WPScan, though EPSS sits at 0.15% (5th percentile), indicating low measured exploitation probability at this time. No confirmed active exploitation has been reported and the vulnerability is not listed in the CISA KEV catalog.
Predictable authentication token generation in TOTOLINK N600R firmware 4.3.0cu.7866_B20220506 exposes the router's web management interface to session token prediction attacks from the network. The loginAuth function in /web_cste/cgi-bin/cstecgi.cgi generates insufficiently random values (CWE-330), enabling unauthenticated remote attackers to predict valid session tokens and gain unauthorized access to router configuration data. A proof-of-concept exploit script (poc.py) is publicly available on GitHub, though high attack complexity limits practical exploitation to technically capable attackers.
Denial of service in Open5GS AMF (Access and Mobility Management Function) versions up to 2.7.7 allows a remote low-privileged attacker to crash the AMF process by submitting a crafted N1N2MessageTransfer request containing an unrecognized ngapIeType value, triggering an unchecked assertion termination. The AMF is a singleton or small-cluster critical component of 5G core infrastructure; its crash disconnects all user equipment registered through that instance until service restarts. A public exploit exists (GitHub issue #4396) and the fix is available in version 2.8.0, making patching the clear immediate action.
Denial of service via improper resource shutdown in Magma 1.9.0's gNB Termination Handler allows remote low-privileged attackers to disrupt or crash the AMF's NGAP processing of 5G base station connections. The flaw in tasks/ngap/ngap_amf.c stems from CWE-404 (improper resource release), producing availability impact against the vulnerable system with no confidentiality or integrity consequence. A public proof-of-concept exploit exists per the referenced GitHub issue #16019, though CISA has not confirmed active exploitation.
Reflected cross-site scripting in SourceCodester Queue Management System 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the unvalidated `Name` parameter of `/api/add_customer.php`. The flaw (CWE-79) stems from PHP output rendered without encoding, enabling script execution in a victim's browser when a crafted URL is visited. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub.
Server-side request forgery in Forgejo up to 15.0.4 allows authenticated users to bypass the repository migration IP allowlist by manipulating `net.LookupIP` in the migration handler, causing the Forgejo server to issue requests to internal network resources that should be unreachable. The CVSS 4.0 vector confirms network-exploitable, low-privilege access with limited but real impact across confidentiality and integrity. Publicly available exploit code exists via Codeberg issue #13433, and the project maintainer has explicitly declined to backport the fix to v15 or v16, leaving those release lines permanently exposed absent a self-applied patch.
Improper authorization in sambitraj Student Management System allows authenticated low-privileged users (students) to access or tamper with other students' records by manipulating the `roll_no` parameter in `student_dashboard.php`. Confirmed by CPE `cpe:2.3:a:sambitraj:student_management_system:*:*:*:*:*:*:*:*`, all commits up to `56ba287f2e9031523ccb4244cb6e3fe530e4e5d5` are affected. A public proof-of-concept is available via a GitHub issue; the project has not responded to disclosure, leaving the flaw unpatched with no KEV listing.
Weak password recovery in Beetel 450TC3 router firmware 01.00.00_01 allows low-privileged authenticated attackers to exploit a flawed account recovery workflow over the network, potentially escalating privileges to administrative control of the device. A public proof-of-concept has been disclosed on GitHub, and the exploit reference explicitly describes authenticated privilege escalation as the realized impact. The vendor did not respond to coordinated disclosure, meaning no patch exists and no vendor-confirmed mitigations are available.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/sup_searchfrm.php endpoint to database manipulation via the unsanitized ID parameter. Low-privileged authenticated attackers can remotely exploit this classic CWE-89 flaw to read, modify, or potentially delete backend database records. A public proof-of-concept exploit has been disclosed via GitHub; no active exploitation or CISA KEV listing has been identified at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/cust_searchfrm.php` customer search endpoint to database manipulation via an unsanitized `ID` parameter. Authenticated remote attackers with low-privilege access can alter backend SQL queries to read, modify, or delete customer and inventory records. A public proof-of-concept exploit is available, lowering the bar for targeted attacks despite the absence of a CISA KEV listing.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the ID parameter in /pages/pro_edit.php. The vulnerability stems from unsanitized user input passed directly to SQL queries (CWE-89), enabling read and limited write access to the underlying database. A public proof-of-concept exploit has been disclosed on GitHub; no active exploitation by KEV standards is confirmed at this time.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/emp_searchfrm.php` endpoint to authenticated remote attackers who can manipulate database queries by injecting malicious SQL through the unsanitized `ID` parameter. Low-privileged users with valid credentials can read, modify, or corrupt application database contents. A public proof-of-concept exploit has been published via GitHub, making active exploitation a credible near-term risk for any internet-exposed instance.
Stored cross-site scripting in the Beetel 450TC3 router's User Management component allows a low-privileged authenticated attacker to inject persistent malicious scripts via the Username field. Any administrator who subsequently views the User Management page triggers execution of the stored payload in their browser context. A public proof-of-concept exploit is available on GitHub; no vendor patch has been issued and the vendor did not respond to responsible disclosure.
Stored cross-site scripting in Coppermine Photo Gallery up to 1.6.28 allows an authenticated attacker to inject persistent malicious scripts via the Hidden Album Update Endpoint in db_input.php, which execute in the browsers of other users who view the affected album. The public proof-of-concept (stored_xss_album_desc.md on GitHub) confirms exploitation via the album description field. No active exploitation has been confirmed by CISA KEV, and the low CVSS 4.0 score of 2.0 reflects limited server-side impact, though browser-side session hijacking remains a realistic outcome.
Stored cross-site scripting in Coppermine Photo Gallery up to version 1.6.28 allows an authenticated user to inject malicious JavaScript into the Biography field of the edit_profile endpoint in profile.php, which executes in the browser of any user who subsequently views that profile. A public proof-of-concept exploit is available on GitHub (Leousum/VulnPoC), and the vendor has released version 1.6.29 to remediate the issue. No active exploitation is confirmed in the CISA KEV catalog, but the PoC lowers the practical barrier to abuse significantly.
GraphQL subscription payloads carrying unauthorized record data leak to authenticated subscribers in ash_graphql 1.4.0-1.10.x due to a missing authorization filter in the batch-processing codepath of AshGraphql.Subscription.Batcher. When two or more subscription notifications arrive within the default one-second batching window, only the first is passed through the should_send?/1 authorization gate; all subsequent notifications in the same batch bypass that check entirely and are published to the subscriber's WebSocket connection. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 1.11.0.
Cross-session record leakage in ash_graphql's subscription batcher allows one subscriber's resolved GraphQL records to be delivered to a different subscriber's topic, potentially crossing tenant and actor boundaries. Versions 1.4.0 through 1.10.x are affected when the Batcher process falls back to inline `:backpressure_sync` or `:noproc` execution paths and a subscription resolver triggers a nested synchronous Ash notification in the same caller process. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 1.11.0.
Improper access control in SiteServer SSCMS 7.4.0's Agent Installation Workflow allows remote attackers to bypass security restrictions by manipulating the SecurityKey argument, potentially gaining unauthorized access to protected functionality. The CVSS 4.0 score of 2.3 reflects genuine exploitation difficulty - high attack complexity and required passive user interaction significantly limit opportunistic abuse - though the authentication bypass characterization indicates a security boundary violation is achievable under the right conditions. No patch is available; the project has not responded to responsible disclosure submitted via GitHub issue #3898, and no public exploit has been identified at this time.
Memory corruption in Open5GS versions up to 2.7.7 allows a low-privileged remote attacker to crash the Access and Mobility Management Function (AMF) by sending a crafted UE MM context transfer request with an oversized allowedNssai array. The vulnerable function amf_namf_comm_decode_ue_mm_context_list in src/amf/namf-handler.c lacked both null-pointer checks and array bounds enforcement on mmContextList[*].allowedNssai entries, relying instead on ogs_assert() which terminates the process rather than handling the error gracefully. No public exploit is confirmed in CISA KEV, but the CVSS 4.0 vector carries E:P indicating publicly disclosed exploit code exists.
Zip Slip-style path traversal in Admidio's photo ZIP download feature allows authenticated users who hold album-creation rights to embed directory traversal sequences in album names, which are then reflected verbatim as archive entry paths. When a recipient extracts the resulting ZIP, files may be written outside the intended target directory, providing a limited but real filesystem write primitive on the extracting machine. No public exploit code has been identified at time of analysis; the CVSS 4.0 base score of 2.1 reflects the multiple preconditions - authentication, user interaction, and high attack complexity - that constrain real-world exploitability.
Incorrect string trimming in ash_sql causes divergent behavior between SQL-layer and in-memory evaluation of the `string_trim/1` function, enabling users to pad string fields with tab, newline, carriage-return, or form-feed characters to bypass trimmed uniqueness or equality checks. All ash_sql versions from 0.1.0 up to (not including) 0.7.1 are affected wherever `string_trim/1` appears in Ash filters, validations, or identity constraints that are evaluated at the SQL layer. No public exploit has been identified and no active exploitation is confirmed; the overall risk is low (CVSS 4.0: 2.1), but the bypass can permit duplicate record creation or filter evasion in affected applications.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the supplier edit endpoint `/pages/sup_edit.php` to authenticated remote attackers who can manipulate the `ID` parameter to interact with the underlying database. The vulnerability allows low-privileged authenticated users to read, modify, or potentially delete database records via crafted SQL payloads. A public exploit has been released (reflected in CVSS 4.0 E:P), though no active exploitation or CISA KEV listing has been identified; the realistic risk is bounded by the product's narrow deployment footprint as a student/demo PHP codebase.
JSON path injection in AshSqlite (0.1.2-rc.0 through 0.2.17) allows any attacker who can supply user-controlled input to a get_path/2 query segment to read nested JSON sub-fields that the application never intended to expose. The vulnerable AshSqlite.SqlImplementation code naively concatenates user-supplied segments with periods into a SQLite json_extract path, so a segment containing a dot (e.g., 'private.secret') descends two JSON levels instead of matching a single literal key. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog; a vendor patch is available targeting version 0.2.18.
SQL LIKE wildcard injection in ash_sql (Elixir, versions 0.1.1-rc.10 through 0.7.0) allows any user who can supply a search string to the contains/2, string_starts_with/2, or string_ends_with/2 filter functions to reintroduce live LIKE wildcards that the escape helper was intended to neutralize. The escape helper prefixes % and _ with backslash but never first escapes a backslash already present in user input, so the sequence \% survives escaping with its % intact as an unescaped wildcard, enabling attackers to widen query matches, evade negated filter guards, or crash individual queries with a trailing lone backslash. No public exploit has been identified at time of analysis, and a vendor-released fix is available in version 0.7.1.
Cubic-complexity denial of service in ash_paper_trail's full-diff list change builder allows any user permitted to invoke a paper-trailed Ash action with an accepted array attribute to exhaust backend CPU and memory. Versions 0.1.1 through 0.6.x are affected; the root cause is an O(n³) list accumulation pattern in `AshPaperTrail.ChangeBuilders.FullDiff.ListChange` where unbounded action input directly drives allocation. No public exploit has been identified and the issue is not in CISA KEV, but no rate-limiting or length check guards the vulnerable path, making the attack trivially reproducible by any user with action access.
Aggregate authorization bypass in ash_sql 0.1.0 through 0.7.0 allows a caller to receive aggregate data - counts, sums, or lists - computed over rows that a stricter actor- or tenant-scoped filter should have excluded. The root cause is a single-character logical operator error in AshSql.Aggregate.different_queries?/2 (AND instead of OR), causing same-named aggregates carrying different authorization filters to be treated as already-computed identical queries, returning the first-registered broader value. No public exploit has been identified at time of analysis, and the vendor-confirmed fix is available in ash_sql 0.7.1.
Cross-tenant aggregate data leakage in ash_sql affects Elixir applications using schema-based multitenancy with strategy(:context), covering versions 0.1.0 through 0.7.0. The AshSql.AggregateQuery.add_single_aggs/5 function discards the tenant schema prefix when rebuilding outer queries for distinct aggregates, causing aggregate computations to silently read the repository default schema instead of the tenant's isolated schema. An authenticated tenant user can thereby receive aggregate values - counts, sums, or other statistics - derived from another tenant's rows, breaching the core data isolation guarantee of the multitenant deployment. No public exploit has been identified and the issue is not listed in CISA KEV.
Plaintext values of encrypted fields in ash_cloak leak verbatim into application logs, error-tracker payloads, changeset inspection output, and telemetry when the source attribute is not explicitly declared sensitive. All ash_cloak versions 0.1.0 through 0.3.x for the Elixir/Ash Framework are affected; a patch is available in 0.4.0. No public exploit is identified at time of analysis.