Stored cross-site scripting in the SOGO Add Script to Individual Pages Header Footer WordPress plugin (through version 3.9) enables any contributor-level WordPress user to inject arbitrary JavaScript into per-post header and footer script fields without sanitization or capability gating. The payload executes in an administrator's browser when reviewing the pending post, enabling session hijacking and full site takeover, and persists for all site visitors once the post is published. A publicly available proof-of-concept exists per WPScan, though EPSS remains at 0.15% (5th percentile) and there is no CISA KEV listing, indicating limited opportunistic exploitation to date.
Arbitrary file write via path traversal in the WPvivid - Backup, Migration & Staging WordPress plugin (versions before 0.9.133) allows high-privilege WordPress administrators to extract backup archives with traversal sequences that write files outside the designated restore directory. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.17% (7th percentile) and CISA KEV lists no active exploitation at time of analysis. Successful exploitation can lead to remote code execution by placing malicious PHP files in web-accessible directories.
Improper privilege management in the Really Simple Security WordPress plugin before 9.8.0 permits a subsite administrator on a WordPress multisite network to install an arbitrary plugin from a user-supplied URL, placing attacker-controlled PHP code into the network-shared plugin directory normally reserved for network (super) administrators. Successful exploitation achieves remote code execution with full confidentiality, integrity, and availability impact across the entire multisite network. A public proof-of-concept is available via WPScan, though EPSS remains low (0.15%) consistent with the high-privilege, non-default-configuration prerequisites; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.
The `qs.stringify` function in the qs Node.js query-string library throws an uncaught `TypeError` when serializing any object whose `constructor.isBuffer` property is truthy but not callable, enabling denial of service against applications that re-serialize attacker-controlled data. Express 4 (default query-parser) and body-parser with `extended: true` both parse incoming HTTP data using options that preserve the `constructor` key in output, meaning a crafted request body or query string can reach the vulnerable code path with no non-default configuration required on the target application. A working proof-of-concept is embedded in the CVE description; no CISA KEV listing exists at time of analysis.
Authentication bypass in Magma 1.9.0's AMF Registration Complete Message Handler allows remote, unauthenticated attackers to manipulate registration state in the 5G core network's Access and Mobility Management Function. The vulnerable code path resides in tasks/amf/amf_fsm.cpp, where the finite state machine processing Registration Complete messages fails to properly verify actor identity per CWE-287. A public proof-of-concept exploit exists (GitHub issue #16020), and no confirmed patch version has been identified at time of analysis.
Improper input validation in the NGSetupRequest Handler of Linux Foundation Magma 1.9.0 allows remote unauthenticated attackers to impact availability of the 5G core's Access and Mobility Management Function (AMF) by supplying a malformed NG-IoT-DefaultPagingDRX argument. A public proof-of-concept is available via GitHub issue #16023, though the vulnerability has not been added to CISA KEV and the project maintainers have not responded to the coordinated disclosure, meaning no patch is available. The CVSS 4.0 score of 6.9 reflects limited availability impact only, with no confidentiality or integrity exposure.
State machine mismanagement in the NGSetup Handler of Linux Foundation Magma 1.9.0 allows remote, unauthenticated attackers to induce an invalid state in the AMF component by sending crafted NGAP NGSetup messages. The affected function resides in ngap_amf_handlers.c, which processes the initial setup handshake between 5G base stations (gNBs) and the Access and Mobility Management Function (AMF). A public proof-of-concept is available via a GitHub issue; this is not listed in the CISA KEV catalog.
Race condition exploitation in FileCodeBox's Pickup Limit Handler allows remote unauthenticated attackers to bypass configured file download quotas by sending concurrent retrieval requests. The flaw exists in the `update_file_usage` function (`apps/base/views.py`) across all releases prior to v2.5.0 - including v2.4.0 despite the CVE description citing only 'up to 2.3'. A public proof-of-concept is available via GitHub issue #482, though no active exploitation has been confirmed by CISA KEV. The vendor-released fix is confirmed in v2.5.0 via commit 8d7d856.
Improper integrity check validation in Linux Foundation Magma 1.9.0's SecurityModeComplete Handler allows remote unauthenticated attackers to bypass NAS-layer security verification in the mobile core network. The SecurityModeComplete message is part of the LTE Non-Access Stratum security negotiation procedure; failure to validate the integrity check value (CWE-354) means crafted messages can be accepted without proper cryptographic verification. A publicly available proof-of-concept exists on GitHub, and the CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation with low-level impact across confidentiality, integrity, and availability dimensions.
Stack-based buffer overflow in NASA Trick 19.6.0's JSONVariableServer component exposes the simulation framework to remote exploitation via crafted TCP requests, with no patch available and no vendor response to disclosure. The vulnerability resides in JSONVariableServerThread::parse_request, where user-supplied network data is processed through an unbounded sscanf call without bounds checking on a stack-allocated buffer. Unauthenticated remote attackers reaching the TCP socket can trigger this overflow, potentially crashing the simulation process or achieving code execution on the host.
Internal Ash attribute and argument names leak through GraphQL error responses in ash_graphql 1.9.0 through 1.10.x, bypassing application-configured error handlers intended to redact them. A logic flaw in AshGraphql.Errors causes a sanitizing error_handler's decision to suppress the :path field to be silently overridden, re-injecting raw internal field names via build_error_path/5. Unauthenticated remote clients can trigger validation failures on non-exposed or nested fields to enumerate internal schema structure that the application deliberately chose to hide. No public exploit or KEV listing exists at time of analysis.
Relay node query crash in AshGraphql (ash_graphql 0.27.0 through 1.10.x) allows an unauthenticated remote caller to abort the Absinthe node(id:...) resolver by supplying a base64-encoded relay ID whose type segment resolves to an existing BEAM VM atom that is not a registered relay resource type. Because the resolver calls Map.fetch!/2 before Absinthe's rescue handlers run, the resulting KeyError surfaces as an unhandled process exception rather than a structured GraphQL error, potentially leaking an internal stacktrace with module names and file paths. No public exploit code has been identified at time of analysis, though the fix commit is publicly visible on GitHub.
Authenticated administrators in SiYuan before v3.8.1 can bypass the IsForbiddenAbsPath security guard - introduced to remediate GHSA-c8r8-95hg-mp34 - by targeting the /history/*path and /repo/diff/*path API endpoints, which construct file paths independently and were never covered by the guard. Exploitation enables retrieval of historical file snapshots including data/.siyuan/publishAccess.json, which stores plaintext publish-mode passwords, and files under data/templates/. No public exploit identified at time of analysis; the vendor-released patch is v3.8.1.
Arbitrary directory creation in browser-use web-ui 2.0.0-3.0.0 allows remote unauthenticated attackers to create directories at any path writable by the root-running container. The `run_agent_task` function passes user-supplied `save_recording_path`, `save_trace_path`, `save_agent_history_path`, and `save_download_path` values directly to filesystem operations without sanitizing absolute path inputs. Because the Gradio interface requires no authentication and containers commonly run as root, the effective write surface spans the entire container filesystem. No public exploit has been identified at time of analysis.
SiYuan's publish mode before v3.8.1 leaks invisible-tier content to unauthenticated readers through three unguarded rendering pathways: SQL embed blocks, attribute-view keys, and attribute-view backlinks. Administrators who mark notes as invisible to control what anonymous visitors see receive no protection - those same visitors can enumerate the hidden content by exploiting any of the three listing mechanisms. No active exploitation has been identified (no CISA KEV listing, no public POC), and the vendor has released a fix in v3.8.1.
WWBN AVideo's Live plugin exposes an unauthenticated endpoint at plugin/Live/api/preauthorize.json.php that accepts credentials via HTTP GET with no rate limiting, enabling two distinct abuse vectors: sustained brute-force password guessing against any user account and uncapped triggering of two-factor authentication confirmation emails. All versions of AVideo are affected per CPE data, and exploitation requires no privileges or user interaction. No public exploit code or active exploitation has been identified at time of analysis, though the attack surface is trivially low-complexity for any remote attacker.
Cleartext API key storage in browser-use web-ui versions 2.0.0 through 3.0.0 exposes configured LLM provider credentials to any local user with filesystem read access. The application writes API keys to predictably-named JSON files in a temporary settings directory without encryption or access controls, as identified in src/webui/webui_manager.py. An attacker who gains read access to that directory can silently harvest credentials and use them to impersonate the victim against third-party LLM APIs, incurring charges or extracting data. No public exploit code has been identified at time of analysis.
Server-Side Request Forgery (SSRF) in Apache Shiro's Jakarta EE integration module (shiro-jakata-ee) enables a low-privileged authenticated user to steer server-initiated POST requests to an attacker-controlled host and transmit attacker-controlled data. Versions 2.0.0-alpha-0 through 3.0.0 of the shiro-jakata-ee artifact are affected, but only when the Jakarta EE integration module is deployed - the 1.x line and non-Jakarta-EE deployments are not vulnerable. No public exploit has been identified at time of analysis, and vendor-released patch 3.0.1 is available as of 2026-08-24.
Unsafe Erlang term deserialization in ash_cloak 0.1.0-0.3.x allows an attacker who can influence encrypted column bytes to crash the BEAM runtime node via unbounded atom table exhaustion or a decompression bomb. Applications configured with Cloak's unauthenticated AES.CTR cipher are the highest-risk targets: an authenticated application user who knows their own plaintext can XOR-derive the keystream and write a forged ciphertext of equal length without the encryption key, causing the deserialization to fire on any subsequent column read. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the patch commit confirms two distinct, low-skill attack primitives against unpatched deployments.
Path traversal in SiYuan 3.8.0 allows an authenticated attacker to read arbitrary files within the workspace directory via the POST /api/template/render endpoint, including conf/conf.json, which contains the API token and cookie signing key. The RenderTemplate function enforces only a workspace-boundary check (util.IsAbsPathInWorkspace) but omits the sensitive-path exclusion (refuseToAccess() blocklist) applied by the file API, creating an inconsistency in access controls across API surfaces. The issue is fixed in v3.8.1; no public exploit identified at time of analysis.
AshOban versions 0.2.5 through 0.8.13 expose an authorization bypass and tenant isolation break in the build_trigger/3 function, allowing any user whose input reaches the :args option to retarget update or destroy background jobs at arbitrary records - including records belonging to other tenants. The root cause is an Elixir atom-vs-string key collision: trusted job fields are stored as atom keys, user-supplied :args arrive as string keys after JSON round-tripping, Map.merge sees no collision and both survive, and JSON serialization then keeps the last (string) key when the job is persisted, causing the worker to read attacker-controlled values. No public exploit has been identified at time of analysis, though the mechanism is straightforward and fully documented by the vendor advisory GHSA-gj9p-x393-rf9h.
Authorization policy bypass in ash_sql (versions 0.4.1 through 0.7.0) silently drops the caller-supplied `exists/2` predicate when a relationship combines a limit or `from_many?` declaration with a `parent(...)`-referencing filter or sort. Policy expressions such as `authorize_if expr(exists(memberships, user_id == ^actor(:id)))` degenerate to matching any actor that has any related row regardless of the actor-ID condition, enabling unauthorized access to data the policy was designed to protect. No public exploit code is known at time of analysis and no CISA KEV listing exists; a vendor-released patch is available in version 0.7.1.
Uncontrolled recursion in ash_oban's compile-time-generated Oban worker code enables unbounded heap growth and CPU exhaustion in the BEAM worker process when a trigger's on_error action deterministically raises on the job's final attempt. Affected versions span 0.8.0-rc.1 through 0.8.13 of the ash-project/ash_oban Elixir library. Any condition that causes the on_error action to fail repeatedly - a data-layer outage, a misconfigured action, or a record the action validates and rejects - loops handle_error/4 forever, growing the process heap without bound until the BEAM runtime kills the worker. No public exploit has been identified at time of analysis; a vendor-released patch is confirmed at 0.8.14.
Cleartext exposure of nested sensitive fields in Ash Paper Trail audit logs (versions 0.3.0-0.6.x) allows any principal with read access to the version resource table to recover credentials, tokens, or other sensitive values stored inside embedded resources, union types, or lists. The redaction logic in `maybe_redact_changes/3` and `AshPaperTrail.Resource.Changes.CreateNewVersion` only inspects top-level resource attributes for the `sensitive?` flag, never recursing into nested structures, so a parent attribute that is not itself marked sensitive silently passes its embedded sensitive children through to the version table in cleartext. No public exploit has been identified and the issue is not listed in CISA KEV; a vendor-released patch is available at version 0.7.0.
Cleartext storage of sensitive Ash resource attributes in AshPaperTrail versions 0.1.1 through 0.6.x allows any actor with read access to the generated version resource to recover plaintext values of fields marked `sensitive? true`. The library's `CreateVersionResource` transformer incorrectly derives the sensitivity flag for the `changes` map from the `ignore_attributes` exclusion list rather than from the actual tracked attributes, causing the map to always be declared `sensitive? false` and `public? true`, which bypasses Ash's built-in redaction and exposes sensitive values in API responses, logs, and inspect output. No public exploit is identified and no active exploitation is confirmed; a vendor patch was released in version 0.7.0.
Information disclosure in the InitialUEMessage Handler of Linux Foundation Magma 1.9.0 allows unauthenticated remote attackers to extract sensitive data by sending crafted UE attachment requests to the mobile core network. A proof-of-concept exploit has been publicly disclosed, elevating practical risk above theoretical concern despite the CVE's medium severity rating. The CVSS 4.0 vector confirms no integrity or availability impact - the exposure is limited to low-confidentiality data leakage - but the zero-authentication, network-accessible nature of the flaw broadens the attack surface for any operator with reachable core signaling interfaces.
Path traversal in Apache Wicket's package resource URL handling exposes files outside the intended package directory to unauthenticated remote attackers, including files under WEB-INF that servlet containers ordinarily protect from direct access. Affected are all releases from 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0. Under default configuration the readable file set is bounded by the SecurePackageResourceGuard's extension allowlist (excluding .xml, .properties, .class), but all configurations unconditionally expose a path-existence oracle usable for reconnaissance, and applications using looser guard configurations can disclose web.xml and other sensitive configuration files. No public exploit identified at time of analysis.
Reachable assertion (CWE-617) in Open5GS through 2.7.7 allows remote authenticated attackers to abort the SMF (Session Management Function) process by supplying an invalid ARP preemption capability or vulnerability enum value via the Nudm SDM interface, disrupting all active PDU sessions managed by that instance. The root cause is the use of ogs_assert() for enum validation in smf_nudm_sdm_handle_get() - when preemptCap or preemptVuln holds an unexpected value, the assertion fires unconditionally and kills the process. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; vendor-confirmed fix is available in version 2.8.0.
Null pointer dereference in Open5GS versions up to 2.7.7 allows network-accessible low-privileged attackers to crash the AMF (Access and Mobility Management Function) by sending crafted SBI messages with missing required body fields to the N1/N2 Transfer Endpoint. The vulnerability exists across multiple code paths in src/amf/namf-handler.c, including UE context transfer, registration status update, and UE MM context list decoding, where pointers were dereferenced without null guards. Successful exploitation causes AMF process termination, denying 5G mobility and UE registration services to all subscribers managed by the affected AMF instance. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Buffer overflow in NASA Core Flight System (cFS) up to version 7.0.1 allows adjacent-network attackers to corrupt memory through the SBN TCP Module's OS_read function. The MsgSz argument read from incoming TCP messages is not bounds-checked before use, enabling a crafted packet to overflow an internal buffer. No vendor patch exists - NASA did not respond to the coordinated disclosure - and no public exploit or KEV listing has been identified at time of analysis.
Integer underflow in NASA cFS's cFE Software Bus module (versions up to 7.0.1) allows a network-reachable, low-privileged attacker to manipulate TotalMsgSize and HdrSize arguments in CFE_SB_GetUserDataLength, triggering a CWE-191 wrap-around that produces an incorrect message-length value. The resulting memory misread yields low-level confidentiality, integrity, and availability impacts on both the vulnerable system and downstream Software Bus consumers. No vendor patch exists - NASA did not respond to coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
Insecure Direct Object Reference in Dolibarr's Users::getGroups REST API endpoint allows any authenticated user to read group memberships of arbitrary users across tenant boundaries without authorization. Versions 10.0.0 through 23.x omit the per-object access check in GET /users/{id}/groups, exposing group names, entity associations, and private notes to any API credential holder. Fixed in 24.0.0; no public exploit or CISA KEV listing identified at time of analysis.
Broken access control in Admidio's profile_function.php allows any authenticated low-privilege user to enumerate another user's future role memberships by directly invoking the reload_future_memberships endpoint with a known victim UUID. Affected are all Admidio installations running versions prior to 5.0.12. An attacker with a valid account can bypass profile-level authorization to harvest sensitive organizational membership planning data without elevated privileges; no public exploit code has been identified at time of analysis.
Cross-site request forgery in wger's gym password-reset endpoint allows a remote attacker to force an arbitrary member's password to be reset by tricking an authenticated trainer or admin into loading a malicious URL. The vulnerable `reset_user_password` view in `wger/gym/views/gym.py` performed its state-changing operation via HTTP GET, which Django's CSRF middleware does not protect by design. The upstream fix - commit 3c6ce4b7f3eeafeb35318c6c4e82b1a3fd28b314 - converts the action to a POST-based confirmation form with full CSRF token enforcement; no public exploit and no CISA KEV listing have been identified at time of analysis.
Reflected cross-site scripting in WWBN AVideo's url2Embed.json.php endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session. The attack is distinctive because the malicious payload is delivered as an encrypted evideo parameter, enabling the crafted link to originate from the target site's own domain and bypass naive URL-reputation checks. Successful exploitation enables session cookie theft and CSRF token harvesting, facilitating account takeover. No public exploit or CISA KEV listing is identified at time of analysis.
Cross-site request forgery in WWBN AVideo's sendEmail.json.php endpoint enables network-based abuse of an authenticated administrator's session to dispatch arbitrary emails from the site's legitimate contact address. When an admin is tricked into visiting a malicious page while logged in, the attacker controls the email subject, body, and recipient list - and because the server sends the message itself, it passes SPF/DKIM/DMARC authentication, making it a viable phishing and brand impersonation vector. No public exploit has been identified at time of analysis; exploitation is constrained by the requirement for admin user interaction.
Heap-based buffer overflow in Open Asset Import Library (Assimp) through version 6.0.2 allows a local low-privilege attacker to corrupt heap memory by supplying a crafted MD5 mesh file. The root cause, confirmed by the patch diff, is that `MakeDataUnique()` pre-allocated only `faces × 3` vertex slots when the output can grow to `numOrigVerts + faces × 3` - meshes declaring more original vertices than face corners overflow the allocation. No public exploit exists and the vulnerability is absent from CISA KEV; impact is locally bounded with a CVSS 4.0 base score of 4.8.
Cross-site request forgery protection bypasses in Apache Wicket's ResourceIsolationRequestCycleListener allow network attackers to execute authenticated listener actions - link callbacks, form submits, behavior endpoints - on behalf of logged-in users across versions 9.1.0-9.23.0 and 10.0.0-10.10.0. The default FetchMetadataResourceIsolationPolicy incorrectly permits cross-site top-level GET navigations (exploitable because Wicket routes Link.onClick() and form callbacks through ordinary browser navigations) and unconditionally trusts Sec-Fetch-Site: same-site requests from sibling origins - both vectors deliver the victim's SameSite=Lax session cookie to the targeted listener. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.24.0 and 10.11.0.
Out-of-bounds read in Exiv2's RemoteIo::Impl::populateBlocks() function affects versions prior to 0.28.9, exploitable only when the tool is invoked against a remote URL rather than a local file. An attacker controlling a remote server can serve a crafted image to trigger the read when a user runs exiv2 against that URL, potentially causing information disclosure or a crash. No public exploit code or active exploitation has been identified; the vulnerability is rated low severity and fixed in the 0.28.9 release.