GitList 2.0.0's XML-based commit parser in CommandLine.php can be remotely triggered without authentication to cause a denial-of-service condition, crashing or hanging the PHP process that renders the GitList interface. The root cause is PHP's SimpleXMLElement being used to parse git log output formatted as XML - commit content can be crafted to cause pathological resource consumption or unhandled parse failures (CWE-404). A public proof-of-concept exists per GitHub issue #948 and the CVSS 4.0 E:P exploitability modifier; the flaw is not listed in CISA KEV, so mass active exploitation is not confirmed at time of analysis.
Null pointer dereference in armink struct2json 1.0 allows remote attackers to crash any application that deserializes attacker-controlled JSON through the library's `S2J_STRUCT_GET_string_ELEMENT` function. The root cause is an absence of null validation on the `valuestring` field during JSON deserialization in `struct2json/inc/s2jdef.h`, yielding a remotely triggerable denial-of-service. A public proof-of-concept exploit has been disclosed on GitHub; no vendor patch has been issued and the vendor did not respond to responsible disclosure.
Use-after-free in open62541 up to version 1.5.5 allows remote unauthenticated attackers to crash the OPC UA server's History Backend by sending crafted requests targeting the `UA_DataValue_backend_copyRange` function in the in-memory history data plugin. The impact is availability loss only - no confidentiality or integrity compromise. A public proof-of-concept exists via a GitHub issue, and the project closed the disclosure report on procedural grounds rather than issuing a formal security advisory.
Authorization bypass in Soarkey StudentManagement (学生信息管理系统) exposes administrative functions to unauthenticated remote attackers by allowing manipulation of the `action` parameter in the Administrative Servlet's `AdminDao.doGet()` handler. The CVSS 4.0 vector confirms PR:N - no credentials required - and a public proof-of-concept exploit exists via GitHub issue #32. The project maintainer was notified but has not responded, leaving the vulnerability unpatched across all known versions through commit e08f7f1d.
IP-based access control bypass in MegaEase EaseProbe up to 2.3.0 allows unauthenticated remote attackers to spoof their source IP by manipulating HTTP headers (X-Forwarded-For, X-Real-IP, True-Client-IP), circumventing middleware-enforced restrictions in the web monitoring interface. The vulnerable logic resides in the `realIP` function within `web/server.go`, which trusts attacker-controlled headers without validating that the request originated from a legitimate trusted proxy. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to coordinated disclosure.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate the U_USERNAME parameter in the Customer::cusAuthentication function at /login.php, enabling authentication bypass and potential database extraction. A public proof-of-concept exploit is available on GitHub, confirmed by the CVSS 4.0 E:P (proof-of-concept) modifier and a linked exploit write-up. No patch has been identified; this is a small PHP application likely used in academic or learning environments with limited production exposure.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate database queries through the emp_email parameter on the rider login endpoint. The Employee::employeeAuthentication function at /rider/login.php incorporates unsanitized email input directly into SQL queries, enabling authentication bypass and potential data extraction. A public proof-of-concept exploit has been released with no vendor patch available, making any deployed instance immediately exploitable by low-skill attackers.
Direct remote access to an unprotected SQL database backup file in code-projects Simple Inventory System 1.0 allows unauthenticated attackers to retrieve the full contents of the inventory database without any credentials or user interaction. The file inventorymanagement.sql is stored within the web-accessible directory and is directly downloadable via HTTP. A publicly documented proof-of-concept on GitHub confirms trivial exploitability of this exposure.
Remote code injection in SeaCMS 13.6 and earlier allows unauthenticated network attackers to execute arbitrary code by passing malicious input through the `searchtype` parameter, which flows into the `parseIf` function of the template engine in `search.php` without adequate sanitization. A public proof-of-concept exploit has been disclosed on GitHub under the title 'cascade-template-rce,' materially lowering the attack threshold for any internet-exposed instance. No vendor-released patch has been identified at time of analysis; publicly available exploit code exists.
Unauthenticated remote attackers can bypass authorization controls in SeaCMS 13.6 via the `/ass.php` endpoint, disclosing premium or paywalled content URLs without valid subscription credentials. The vulnerability exploits CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class flaw where a user-supplied parameter determines access rights without server-side validation. A publicly available proof-of-concept is referenced in a GitHub security advisory; no active exploitation has been confirmed by CISA KEV, and impact is confined to information disclosure with no integrity or availability consequences.
Unrestricted file upload in Cozmoslabs Profile Builder Plugin for WordPress (versions through 3.16.1) is exploitable without authentication via the wppb_ajax_simple_avatar function exposed on the /wp-admin/admin-ajax.php endpoint. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms unauthenticated remote access with no prerequisites beyond reaching the endpoint, and a proof-of-concept exploit has been publicly released, substantially lowering the barrier to opportunistic mass exploitation. Vendor-released patch version 3.16.2 is available and should be applied immediately on all affected WordPress installations.
Server-side request forgery in NASA Earthdata Search exposes the application server as an open proxy, allowing remote unauthenticated attackers to issue arbitrary outbound HTTP requests by controlling the `openSearchOsdd` argument to the granules endpoint. The vulnerable code path is the `OpenSearchGranuleSearchLambda` function in `serverless/src/openSearchGranuleSearch/handler.js` of version 1.0.0, deployed as an AWS serverless Lambda. A public proof-of-concept has been released by the reporting researcher; no vendor patch or acknowledgment exists.
Unrestricted file upload in ShopEx ECShop 2.5.1 and earlier allows remote attackers to upload arbitrary file types by manipulating the pack_img argument passed to the check_img_type function in admin/pack.php. Successful exploitation can result in webshell deployment, granting full server-side code execution. A public exploit has been disclosed, and the vendor has not responded to disclosure outreach, leaving no official patch available.
Server-side request forgery in NASA's earthdata-search 1.0.0 allows unauthenticated remote attackers to make the serverless scaleImage endpoint issue arbitrary HTTP requests on behalf of the server. The vulnerability exists in the `scaleImage` function within `serverless/src/scaleImage/handler.js`, where user-supplied URL parameters are passed to the server without sufficient validation. A public proof-of-concept exists per the VulDB report and a dedicated research repository; no patch has been released and NASA has not responded to disclosure attempts.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes unauthenticated attackers to direct database manipulation via the Password Recovery Interface. The `Customer::find_phone` function in `/passwordrecover.php` accepts the `phonenumber` parameter without sanitization, allowing arbitrary SQL to be injected into backend queries. A public proof-of-concept exploit has been disclosed on GitHub; the vulnerability is not currently listed in CISA KEV, but the low complexity and zero-authentication requirement make opportunistic exploitation trivial.
Unauthenticated SQL injection in code-projects Online Shopping System 1.0 exposes the backend database through the Search Functionality's `keyword` parameter in `/action.php`. The GitHub-linked proof-of-concept specifically documents a time-based blind injection technique, allowing remote attackers without credentials to enumerate database contents, extract data, and potentially modify records. No public KEV listing exists, but exploit code is publicly available, lowering the bar for opportunistic exploitation.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the Category parameter in the Product Category Filter Interface at /index.php?q=product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, and a public proof-of-concept is available on GitHub (E:P), materially lowering the exploitation barrier. Impact is rated Low across confidentiality, integrity, and availability, suggesting constrained database access rather than full system compromise; no CISA KEV listing has been identified.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes the Product Search Interface to remote unauthenticated database manipulation via the Search argument handled by the `loadResultList` function at `/index.php?q=product`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no user interaction are required. Publicly available exploit code exists, documented on GitHub via VulDB submission, though this product has not been added to the CISA KEV catalog and no widespread exploitation has been confirmed.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes database contents to remote unauthenticated attackers through the `ID` parameter in the `loadResultList` function on the Product Detail Page. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the bar for opportunistic attackers beyond what the moderate score alone implies.
Unauthenticated SQL injection in ShopEx ECShop up to version 2.5.1 exposes e-commerce installations to remote database compromise via the cart update endpoint. The vulnerable parameter rec_id in /flow.php?step=update_cart is passed to the flow_update_cart function without sanitization, allowing remote attackers to execute arbitrary SQL queries against the backend database. A proof-of-concept exploit has been publicly disclosed and no vendor patch is available, as the vendor did not respond to the disclosure.
SQL injection in kishan0725 Hospital-Management-System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Contact parameter in /search.php, potentially exposing or modifying sensitive patient and operational records. A public exploit has been released, elevating the risk of opportunistic attacks against any internet-facing instance. No vendor patch exists; the developer did not respond to coordinated disclosure.
Unauthenticated remote SQL injection in SeaCMS 13.6 and earlier exposes database contents and integrity via the `/zyapi.php?ac=videolist` API endpoint. An attacker with network access can manipulate the `ids` parameter to inject arbitrary SQL, enabling read, write, or deletion of backend database records. A public proof-of-concept exploit has been released, meaning exploitation requires minimal skill and no authentication.
Hard-coded Google OAuth client secret exposure in Inbox Foundry ActiveInbox Extension up to version 7.10.24 allows any party who downloads the Chrome extension to extract valid OAuth application credentials from the bundled service worker JavaScript. The secret is statically embedded in `dist/service-worker.production-esm.js`, a file that is fully readable by anyone who unpacks the publicly distributed `.crx` archive. A publicly available proof-of-concept on GitHub demonstrates extraction; the vendor has acknowledged the disclosure but deferred remediation, citing a backlog of existing bug bounty reports.
Default credentials hardcoded in the aca.sql database initialization file of sambitraj's Student-Management-System expose unauthenticated remote attackers to authentication bypass using publicly known passwords across all commits through 56ba287f. The project's GitHub issue tracker hosts a public proof-of-concept, and the maintainer has not responded to the disclosure, leaving no remediated release available. The limited deployment footprint (a niche student-facing open-source project) constrains aggregate real-world impact despite the trivial exploitability of default credentials.
CSRF protection is absent for the netmount command in elFinder prior to 2.1.70, allowing a cross-site request from an attacker-controlled page to mount an attacker-chosen FTP server into an authenticated victim's session without a valid X-elFinder-CSRF token. Because the default connector.minimal.php-dist configuration enables FTP mounts and passes fully attacker-controlled parameters - host, port, credentials, path - directly to elFinderVolumeFTP, this also creates a server-side request forgery primitive: the PHP process itself initiates a TCP connection to the attacker-specified host and port. A vendor-confirmed patch is available in version 2.1.70; no public exploit has been identified at time of analysis.
Broken object-level authorization in Sulu CMS's media move endpoint (prior to 2.6.25 and 3.0.8) allows authenticated backend users to bypass collection-level access controls and exfiltrate restricted media assets. The move API validates permissions against the attacker-supplied collection ID in the request body rather than the media item's actual stored source collection, enabling an authenticated user with edit rights on any collection to relocate content out of a restricted collection they cannot legitimately access. No public exploit has been identified at time of analysis and no KEV listing exists; exploitation is bounded by the requirement for a valid backend account.
Missing authorization in the 爱采集数据采集和发布插件 WordPress plugin (all versions through 1.0.0) exposes internal handler methods to unauthenticated HTTP requests with no capability or nonce verification, allowing any remote attacker to create WordPress user accounts and taxonomy terms. A publicly available exploit has been documented by WPScan, significantly lowering the barrier to opportunistic exploitation across WordPress installations running this plugin. No KEV listing confirms active widespread exploitation at time of analysis, but the trivial attack complexity and public exploit code make targeted abuse realistic.
SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the transport `name` configuration option to inject arbitrary SMTP commands by embedding CRLF sequences in the value. The EHLO, HELO, and LHLO commands are constructed via direct string concatenation in lib/smtp-connection/index.js without sanitization, enabling unauthorized email sending, spoofing, and phishing through the configured SMTP relay. A proof-of-concept is publicly available in the GHSA advisory; no KEV listing is present, indicating exploitation has not been confirmed at mass scale at time of analysis.
Path traversal in Kirby CMS's filesystem containment logic allows remote unauthenticated attackers to access image files in PHP-readable sibling directories that share a string prefix with the Kirby installation root, and to create thumbnails from those files via the media handler. Versions prior to 4.9.5 (4.x line) and 5.5.2 (5.x line) are affected, with the impact limited to subsequent-system confidentiality exposure - staging sites, backups, or co-hosted internal sites - rather than the Kirby instance itself. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 AT:P metric confirms specific environmental preconditions must exist for exploitation.
Server-side request forgery in Smarty's {fetch} template function (versions prior to 4.5.7 on the 4.x line and 5.8.2 on the 5.x line) allows network-accessible attackers to bypass the trusted_uri allowlist and reach arbitrary internal endpoints by exploiting PHP's default redirect-following behavior. The security policy's isTrustedUri() check validates only the initial URL; when file_get_contents() silently follows an HTTP redirect placed on a trusted host, the request lands on an attacker-chosen internal target, enabling SSRF to services such as cloud metadata endpoints or internal APIs. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Path traversal in MCPHub's MCPB file upload handler, prior to version 0.12.13, enables a remote attacker to extract files to arbitrary filesystem locations and delete arbitrary directories on the host by embedding traversal sequences in a crafted archive manifest. The vulnerability exists at `src/controllers/mcpbController.ts:107`, where `manifest.name` is unsanitized before concatenation into `fs.mkdirSync` and `fs.renameSync` calls; the same unsanitized value flows into `cleanupOldMcpbServer` at line 110, enabling directory deletion. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full source-level disclosure in the GHSA advisory makes weaponization straightforward.
Incorrect authorization in GROWI exposes other users' bookmark data to unauthenticated remote attackers without any privileges or user interaction. The flaw (CWE-863) indicates that bookmark retrieval endpoints fail to enforce proper access control checks, allowing any network-accessible attacker to enumerate or read bookmark data belonging to arbitrary users. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in the source intelligence.
Quadratic time complexity in pypdf's `read_until_whitespace` function allows remote unauthenticated attackers to cause denial of service by supplying a crafted PDF containing a long non-whitespace byte stream. All versions prior to 6.15.0 accumulate bytes via immutable concatenation in a single-byte loop, producing O(N²) processing cost that stalls Python worker processes and degrades availability of any PDF-parsing pipeline exposed to untrusted input. A confirmed patch is available as version 6.15.0; no active exploitation has been identified at the time of analysis.
Availability disruption in Kubio AI Website Builder (a WordPress page-builder plugin by Extend Themes) affects all versions before 2.9.1, exploitable by authenticated high-privilege users over a network connection. CWE-20 improper input validation allows a privileged attacker to submit malformed input to the plugin, producing a denial-of-service condition against the vulnerable system with no confidentiality or integrity impact. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects the high-privilege requirement that substantially limits the realistic attacker pool.
Sensitive WooCommerce order and product data is exposed to authenticated subscribers in the 'Print Barcode Labels for your WooCommerce products/orders' WordPress plugin versions 4.0.0 and below, developed by ukr_solution. The flaw (CWE-201) allows low-privilege authenticated users - those holding only a subscriber role - to retrieve data beyond their authorized scope, yielding a High confidentiality impact per CVSS. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in the Booking and Rental Manager WordPress plugin (versions <= 2.7.6) allows subscriber-level authenticated users to perform privileged write operations they should not be authorized to execute. The flaw, rooted in CWE-862 (Missing Authorization), means any registered site user - the lowest non-guest WordPress role - can manipulate booking or rental data with high integrity impact. No public exploit code has been identified at time of analysis, but the low privilege bar makes this attractive to any account-holding attacker on a WooCommerce-based rental or booking site.
Ethernet bridge input processing in Zephyr RTOS leaks RX packet buffers when CONFIG_NET_ETHERNET_BRIDGE is enabled, allowing any adjacent L2 attacker to exhaust the fixed-size RX pool through a broadcast flood and halt all network reception until reboot. The root cause is eth_bridge_handle_locally() returning NET_OK without consuming the packet, so ethernet_recv() never frees the buffer. An unauthenticated attacker on the same Ethernet segment can emit broadcast or multicast frames with arbitrary EtherType values to permanently consume CONFIG_NET_PKT_RX_COUNT buffers one by one. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV.
TX packet pool exhaustion in Zephyr RTOS's IPv6 Neighbor Solicitation path allows an adjacent unauthenticated attacker to render a device permanently unable to transmit any network traffic. The leak in net_ipv6_send_ns() (subsys/net/ip/ipv6_nbr.c) occurs when an NS is already outstanding for a neighbor - each subsequent outbound packet during the ~3-second INCOMPLETE resolution window allocates a new net_pkt that is never released, silently consuming the fixed-size TX pool. With CONFIG_NET_PKT_TX_COUNT defaulting to as low as 4, a brief low-rate spoofed-source burst suffices to produce a complete, reboot-required network denial of service; no public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Kalles Addons WordPress plugin (versions <= 1.0.6) allows a low-privileged subscriber-level user to inject malicious JavaScript that executes in the browsers of other site visitors or administrators. The scope-changed CVSS vector (S:C) confirms the injected payload escapes the plugin's execution context and can affect other authenticated sessions. No public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in XueZhiSi Open Source Exam System (xzs) 3.9.0 and earlier allows authenticated teacher-level users to retrieve user listings across roles they are not authorized to view by freely controlling the role parameter in POST /api/teacher/user/page/list requests. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the server trusts the client-supplied role field in UserPageRequestVM without enforcing server-side role binding, exposing potentially sensitive user data. No public exploit code or active exploitation has been identified, and EPSS places this at the 4th percentile.
Stored cross-site scripting in the Venueless default Docker image allows a low-privileged authenticated user to upload an SVG file containing executable JavaScript, which executes in the browser of any user who subsequently views the file. The root cause is absent Content Security Policy enforcement combined with unfiltered SVG delivery, classified as CWE-80. The vendor addressed this by adding a valid CSP to the default image; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free and double-free memory corruption in the Silicon Labs SiWx917 WiFi driver for Zephyr RTOS enables an adjacent unauthenticated attacker to corrupt the kernel networking buffer pool and crash the device. The driver's siwx91x_send() incorrectly releases a net_pkt owned by the L2 ethernet stack, causing use-after-free reads and a double-free when the caller accesses and unrefs the same packet; under concurrent network load, the trailing unref corrupts a live packet's reference count drawn from the recycled slab slot. No public exploit has been identified at time of analysis, but the vulnerable code path is compiled in by default and is exercisable via ordinary WiFi traffic that any adjacent-network peer can induce.
Tenant hijacking and request degradation in AshPhoenix (ash_phoenix 2.1.26 through 2.3.24) allows unauthenticated remote clients to force an Ash multi-tenant application to resolve an arbitrary tenant by supplying a crafted HTTP Host header. The root cause is that AshPhoenix.Helpers.get_subdomain/2 interpolated the configured root domain verbatim into a regex pattern, causing domain dots to act as any-character wildcards and the match to be applied unanchored and globally - so Host: foo.exampleXcom.attacker.net satisfied a rule intended to match only subdomains of example.com, returning foo as the tenant. A separate case-sensitivity flaw allowed TENANT.EXAMPLE.COM to bypass the allowlist check entirely. No CISA KEV listing and no public proof-of-concept have been identified at time of analysis, but exploitation requires no authentication and no special tooling.
Broken access control in the OwnerRez API WordPress plugin (versions <= 1.2.6) permits subscriber-level users to invoke API endpoints or perform actions reserved for higher-privileged roles such as editors or administrators. Reported by Patchstack and tracked under CWE-862 (Missing Authorization), the flaw enables an authenticated but low-privilege WordPress user to read, modify, or potentially delete vacation-rental booking data managed through the OwnerRez integration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity keeps real-world risk non-trivial for any multi-tenant WordPress deployment hosting this plugin.
Cross-site scripting in Apache Wicket's AbstractSingleSelectChoice base class allows injection of unescaped HTML into the default/null option of DropDownChoice form elements. Affected versions span all supported Wicket branches from 8.0.0 through 10.10.0, as well as unsupported releases back to 1.5.0. An attacker who can influence the value returned by the overridden getNullValidDisplayValue() or getNullKeyDisplayValue() methods, or who controls the relevant resource bundle entries, can execute arbitrary JavaScript in a victim user's browser. No public exploit has been identified at time of analysis.
Reflected XSS in TechStore 1.0 contact_display endpoint allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by embedding a malicious payload in the `id` URL parameter, which the application echoes verbatim into the rendered HTML. The CVSS Scope:Changed metric confirms cross-origin browser-level impact, enabling session theft, credential harvesting, or DOM manipulation against any user who clicks a crafted link. No active exploitation is confirmed via CISA KEV; a public proof-of-concept exists on GitHub at the referenced gist, and EPSS at 0.16% (6th percentile) reflects low current exploitation activity.
Infinite-loop denial-of-service in ash_ai's ToolLoop component (versions 0.6.0 through <1.0.0) allows an attacker who can influence LLM model output - most practically via prompt injection - to hang the agent loop indefinitely and drive unbounded, repeated model API requests. When the LLM returns tool_call_ids that are either invalid or already present in the session history, the post-filter call list empties, yet the loop recurses with a byte-identical message state, making no forward progress and wasting unbounded API budget. No public exploit code or active exploitation has been identified at time of analysis; however, the prompt-injection attack path is well within reach of applications that ingest untrusted user content.
Unauthenticated access to the CloudSrvVersionCheck function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to trigger cloud-based firmware update checks by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The root cause is CWE-284 (Improper Access Control) - the function processes requests without verifying caller identity, a systemic pattern observed across multiple CGI handlers in this firmware batch. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS at 0.18% (7th percentile) indicates low probability of automated exploitation.
Unauthenticated remote manipulation of wireless roaming configuration in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the setRoamingCfg function through /cgi-bin/cstecgi.cgi with no access control enforcement, allowing any network-reachable attacker to overwrite roaming behavior via a crafted POST request. The device performs no authentication check before processing configuration changes through this handler, consistent with a broader pattern of access control failures across multiple TOTOLINK T6 CGI endpoints documented in coordinated disclosure repositories. No public exploit code has been identified and EPSS is 0.16%, suggesting limited active exploitation interest at this time.
Unauthenticated write access to the setApWiFiSchCfg function on TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to arbitrarily overwrite the device's AP wireless availability schedule by posting a crafted request to /cgi-bin/cstecgi.cgi. The CVSS PR:N metric confirms no credentials are required; the attack surface is the standard CGI management endpoint. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.16% (6th percentile), but the unauthenticated network vector makes this trivially reproducible against any device exposing its management interface to untrusted networks.