Null pointer dereference in armink struct2json 1.0 allows remote attackers to crash any application that deserializes attacker-controlled JSON through the library's `S2J_STRUCT_GET_string_ELEMENT` function. The root cause is an absence of null validation on the `valuestring` field during JSON deserialization in `struct2json/inc/s2jdef.h`, yielding a remotely triggerable denial-of-service. A public proof-of-concept exploit has been disclosed on GitHub; no vendor patch has been issued and the vendor did not respond to responsible disclosure.
Use-after-free in open62541 up to version 1.5.5 allows remote unauthenticated attackers to crash the OPC UA server's History Backend by sending crafted requests targeting the `UA_DataValue_backend_copyRange` function in the in-memory history data plugin. The impact is availability loss only - no confidentiality or integrity compromise. A public proof-of-concept exists via a GitHub issue, and the project closed the disclosure report on procedural grounds rather than issuing a formal security advisory.
Authorization bypass in Soarkey StudentManagement (学生信息管理系统) exposes administrative functions to unauthenticated remote attackers by allowing manipulation of the `action` parameter in the Administrative Servlet's `AdminDao.doGet()` handler. The CVSS 4.0 vector confirms PR:N - no credentials required - and a public proof-of-concept exploit exists via GitHub issue #32. The project maintainer was notified but has not responded, leaving the vulnerability unpatched across all known versions through commit e08f7f1d.
IP-based access control bypass in MegaEase EaseProbe up to 2.3.0 allows unauthenticated remote attackers to spoof their source IP by manipulating HTTP headers (X-Forwarded-For, X-Real-IP, True-Client-IP), circumventing middleware-enforced restrictions in the web monitoring interface. The vulnerable logic resides in the `realIP` function within `web/server.go`, which trusts attacker-controlled headers without validating that the request originated from a legitimate trusted proxy. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to coordinated disclosure.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate the U_USERNAME parameter in the Customer::cusAuthentication function at /login.php, enabling authentication bypass and potential database extraction. A public proof-of-concept exploit is available on GitHub, confirmed by the CVSS 4.0 E:P (proof-of-concept) modifier and a linked exploit write-up. No patch has been identified; this is a small PHP application likely used in academic or learning environments with limited production exposure.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate database queries through the emp_email parameter on the rider login endpoint. The Employee::employeeAuthentication function at /rider/login.php incorporates unsanitized email input directly into SQL queries, enabling authentication bypass and potential data extraction. A public proof-of-concept exploit has been released with no vendor patch available, making any deployed instance immediately exploitable by low-skill attackers.
Direct remote access to an unprotected SQL database backup file in code-projects Simple Inventory System 1.0 allows unauthenticated attackers to retrieve the full contents of the inventory database without any credentials or user interaction. The file inventorymanagement.sql is stored within the web-accessible directory and is directly downloadable via HTTP. A publicly documented proof-of-concept on GitHub confirms trivial exploitability of this exposure.
Remote code injection in SeaCMS 13.6 and earlier allows unauthenticated network attackers to execute arbitrary code by passing malicious input through the `searchtype` parameter, which flows into the `parseIf` function of the template engine in `search.php` without adequate sanitization. A public proof-of-concept exploit has been disclosed on GitHub under the title 'cascade-template-rce,' materially lowering the attack threshold for any internet-exposed instance. No vendor-released patch has been identified at time of analysis; publicly available exploit code exists.
Unauthenticated remote attackers can bypass authorization controls in SeaCMS 13.6 via the `/ass.php` endpoint, disclosing premium or paywalled content URLs without valid subscription credentials. The vulnerability exploits CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class flaw where a user-supplied parameter determines access rights without server-side validation. A publicly available proof-of-concept is referenced in a GitHub security advisory; no active exploitation has been confirmed by CISA KEV, and impact is confined to information disclosure with no integrity or availability consequences.
Unrestricted file upload in Cozmoslabs Profile Builder Plugin for WordPress (versions through 3.16.1) is exploitable without authentication via the wppb_ajax_simple_avatar function exposed on the /wp-admin/admin-ajax.php endpoint. The CVSS 4.0 vector (PR:N, AV:N, AC:L) confirms unauthenticated remote access with no prerequisites beyond reaching the endpoint, and a proof-of-concept exploit has been publicly released, substantially lowering the barrier to opportunistic mass exploitation. Vendor-released patch version 3.16.2 is available and should be applied immediately on all affected WordPress installations.
Server-side request forgery in NASA Earthdata Search exposes the application server as an open proxy, allowing remote unauthenticated attackers to issue arbitrary outbound HTTP requests by controlling the `openSearchOsdd` argument to the granules endpoint. The vulnerable code path is the `OpenSearchGranuleSearchLambda` function in `serverless/src/openSearchGranuleSearch/handler.js` of version 1.0.0, deployed as an AWS serverless Lambda. A public proof-of-concept has been released by the reporting researcher; no vendor patch or acknowledgment exists.
Unrestricted file upload in ShopEx ECShop 2.5.1 and earlier allows remote attackers to upload arbitrary file types by manipulating the pack_img argument passed to the check_img_type function in admin/pack.php. Successful exploitation can result in webshell deployment, granting full server-side code execution. A public exploit has been disclosed, and the vendor has not responded to disclosure outreach, leaving no official patch available.
Server-side request forgery in NASA's earthdata-search 1.0.0 allows unauthenticated remote attackers to make the serverless scaleImage endpoint issue arbitrary HTTP requests on behalf of the server. The vulnerability exists in the `scaleImage` function within `serverless/src/scaleImage/handler.js`, where user-supplied URL parameters are passed to the server without sufficient validation. A public proof-of-concept exists per the VulDB report and a dedicated research repository; no patch has been released and NASA has not responded to disclosure attempts.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes unauthenticated attackers to direct database manipulation via the Password Recovery Interface. The `Customer::find_phone` function in `/passwordrecover.php` accepts the `phonenumber` parameter without sanitization, allowing arbitrary SQL to be injected into backend queries. A public proof-of-concept exploit has been disclosed on GitHub; the vulnerability is not currently listed in CISA KEV, but the low complexity and zero-authentication requirement make opportunistic exploitation trivial.
Unauthenticated SQL injection in code-projects Online Shopping System 1.0 exposes the backend database through the Search Functionality's `keyword` parameter in `/action.php`. The GitHub-linked proof-of-concept specifically documents a time-based blind injection technique, allowing remote attackers without credentials to enumerate database contents, extract data, and potentially modify records. No public KEV listing exists, but exploit code is publicly available, lowering the bar for opportunistic exploitation.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows unauthenticated remote attackers to manipulate backend database queries via the Category parameter in the Product Category Filter Interface at /index.php?q=product. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no privileges or user interaction, and a public proof-of-concept is available on GitHub (E:P), materially lowering the exploitation barrier. Impact is rated Low across confidentiality, integrity, and availability, suggesting constrained database access rather than full system compromise; no CISA KEV listing has been identified.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes the Product Search Interface to remote unauthenticated database manipulation via the Search argument handled by the `loadResultList` function at `/index.php?q=product`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication, no complexity, and no user interaction are required. Publicly available exploit code exists, documented on GitHub via VulDB submission, though this product has not been added to the CISA KEV catalog and no widespread exploitation has been confirmed.
SQL injection in itsourcecode Online Medicine Delivery System 1.0 exposes database contents to remote unauthenticated attackers through the `ID` parameter in the `loadResultList` function on the Product Detail Page. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no credentials, no special configuration, and no user interaction. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the bar for opportunistic attackers beyond what the moderate score alone implies.
Unauthenticated SQL injection in ShopEx ECShop up to version 2.5.1 exposes e-commerce installations to remote database compromise via the cart update endpoint. The vulnerable parameter rec_id in /flow.php?step=update_cart is passed to the flow_update_cart function without sanitization, allowing remote attackers to execute arbitrary SQL queries against the backend database. A proof-of-concept exploit has been publicly disclosed and no vendor patch is available, as the vendor did not respond to the disclosure.
SQL injection in kishan0725 Hospital-Management-System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Contact parameter in /search.php, potentially exposing or modifying sensitive patient and operational records. A public exploit has been released, elevating the risk of opportunistic attacks against any internet-facing instance. No vendor patch exists; the developer did not respond to coordinated disclosure.
Unauthenticated remote SQL injection in SeaCMS 13.6 and earlier exposes database contents and integrity via the `/zyapi.php?ac=videolist` API endpoint. An attacker with network access can manipulate the `ids` parameter to inject arbitrary SQL, enabling read, write, or deletion of backend database records. A public proof-of-concept exploit has been released, meaning exploitation requires minimal skill and no authentication.
SMTP command injection in Nodemailer before 8.0.4 lets attackers smuggle arbitrary SMTP verbs (notably RCPT TO) into outgoing mail by planting CRLF characters in the envelope.size value, silently adding attacker-controlled recipients or otherwise manipulating the MAIL FROM dialogue. Only applications that pass a custom envelope object and expose its size property to untrusted input are affected, since Nodemailer's default auto-constructed envelope never sets size. A working proof-of-concept is published in the GHSA advisory; there is no public exploit identified beyond that PoC and no evidence of active exploitation.
Hard-coded Google OAuth client secret exposure in Inbox Foundry ActiveInbox Extension up to version 7.10.24 allows any party who downloads the Chrome extension to extract valid OAuth application credentials from the bundled service worker JavaScript. The secret is statically embedded in `dist/service-worker.production-esm.js`, a file that is fully readable by anyone who unpacks the publicly distributed `.crx` archive. A publicly available proof-of-concept on GitHub demonstrates extraction; the vendor has acknowledged the disclosure but deferred remediation, citing a backlog of existing bug bounty reports.
Default credentials hardcoded in the aca.sql database initialization file of sambitraj's Student-Management-System expose unauthenticated remote attackers to authentication bypass using publicly known passwords across all commits through 56ba287f. The project's GitHub issue tracker hosts a public proof-of-concept, and the maintainer has not responded to the disclosure, leaving no remediated release available. The limited deployment footprint (a niche student-facing open-source project) constrains aggregate real-world impact despite the trivial exploitability of default credentials.
OS command injection in the Digitální a informační agentura (DIA) eObčanka-Identifikace macOS client (the Czech national electronic-ID 'eOP' identification app) lets a remote attacker execute arbitrary shell commands by luring a victim to open a crafted czeeopauth:// URL. Versions prior to 3.6.0 pass incoming URL-scheme parameters into a compiled AppleScript wrapper via string concatenation without sanitization, so attacker-controlled input breaks out of the intended command. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the CVSS 9.3 rating reflects unauthenticated network-reachable code execution requiring only that the user follow a malicious link.
Unreviewed code execution in Google Cloud Build (GitHub-triggered builds prior to the 2026-06-24 fix) allowed a remote attacker to bypass the GitHub Trigger Comment Control approval gate via webhook suppression and run attacker-supplied code inside the build environment. The Comment Control feature is meant to require a maintainer's approval comment before a pull request from an outside contributor triggers a build; the flaw let that check be evaded so unapproved code executed. No public exploit identified at time of analysis, and Google states the issue was patched server-side with no customer action required.
CSRF protection is absent for the netmount command in elFinder prior to 2.1.70, allowing a cross-site request from an attacker-controlled page to mount an attacker-chosen FTP server into an authenticated victim's session without a valid X-elFinder-CSRF token. Because the default connector.minimal.php-dist configuration enables FTP mounts and passes fully attacker-controlled parameters - host, port, credentials, path - directly to elFinderVolumeFTP, this also creates a server-side request forgery primitive: the PHP process itself initiates a TCP connection to the attacker-specified host and port. A vendor-confirmed patch is available in version 2.1.70; no public exploit has been identified at time of analysis.
Evidence-validation bypass in @hulumi/policies (npm) before 1.3.2 lets actors in a deployment pipeline suppress Cloudflare and deployment-governance policy violations by supplying unrelated but compliant-looking evidence. Because validators accepted stack-wide evidence shortcuts rather than correlating proof to the specific protected resource, evidence from one zone, hostname, origin, or repository could silence guardrails for a completely different resource in the same stack. No public exploit identified at time of analysis; the issue was reported by VulnCheck and fixed by correlating evidence to the protected resource in 1.3.2.
Privilege escalation in the @hulumi/policies npm package before 1.3.2 lets attackers bypass the administrator-policy guardrail (CIS 1.16) by crafting admin-equivalent inline or attached IAM policy shapes that the validator failed to fully inspect. Any environment relying on this library to detect over-privileged IAM policies could silently pass admin-equivalent access as compliant. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
IAM boundary bypass in hulumi versions before v1.3.2 stems from a deployment Service Control Policy (SCP) template that permits tag-on-create bypasses of the hulumi:iac-role protections. Operators of downstream AWS deployments provisioned with the weakened template can circumvent intended organizational IAM restrictions, undermining privilege boundaries meant to constrain the IaC deployment role. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation in hulumi before v1.3.2 lets an actor holding the documented IAM principal abuse the weekly integration IAM policy to perform role lifecycle operations on af-e2e-* roles that lack sufficient permission-boundary restrictions. Because the policy allows role creation without a constraining boundary, the actor can mint persistent, higher-privilege roles inside the sandbox AWS account, converting scoped test access into durable elevated access. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Security-guardrail bypass in the @hulumi/policies npm library (versions before 1.3.2) allows dangerous AWS IAM configurations to pass automated policy inspection. The G_OIDC_1 trust-policy inspector only matched exact StringLike/StringEquals condition operators, so set-qualified operators like ForAnyValue:StringLike could smuggle wildcard GitHub Actions OIDC 'sub' conditions past the mandatory check, letting an overly permissive AWS role assumption go undetected. Reported by VulnCheck; no public exploit is identified at time of analysis, and it is not on CISA KEV. The CVSS 4.0 score is 9.3 (Critical).
SQL injection in the E-goi 'Smart Marketing SMS and Newsletters Forms' WordPress plugin (versions 5.1.24 and earlier) lets unauthenticated remote attackers inject arbitrary SQL through a plugin input, per a Patchstack advisory. The CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact and a changed scope, meaning the site database can be read without credentials. No public exploit is identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken object-level authorization in Sulu CMS's media move endpoint (prior to 2.6.25 and 3.0.8) allows authenticated backend users to bypass collection-level access controls and exfiltrate restricted media assets. The move API validates permissions against the attacker-supplied collection ID in the request body rather than the media item's actual stored source collection, enabling an authenticated user with edit rights on any collection to relocate content out of a restricted collection they cannot legitimately access. No public exploit has been identified at time of analysis and no KEV listing exists; exploitation is bounded by the requirement for a valid backend account.
SQL injection in the Throws SPAM Away WordPress anti-spam plugin (versions 3.8.2 and earlier) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's request handling, exposing WordPress database contents such as user records and secrets. The CVSS 3.1 base score is 9.3 (S:C), reflecting network reach and no authentication. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
SQL injection in the WP Data Access WordPress plugin (versions <= 5.5.81) lets remote unauthenticated attackers inject arbitrary SQL through a vulnerable parameter, enabling extraction of sensitive database contents such as user credentials and secrets. The flaw is network-reachable with no authentication or user interaction, carries a high CVSS of 9.3, and was reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Security-check bypass in @hulumi/drift before 1.3.2 allows remote attackers to submit forged execute plans that the orphan reconciler treats as trusted, enabling unsafe reconciliation operations across all three impact dimensions. The flaw stems from missing provenance validation on externally supplied plans (CWE-345), and the CVSS 4.0 base score is 9.3 (Critical) with a network, no-privilege, no-interaction vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fixed release (1.3.2) and a GHSA advisory are available.
Missing authorization in the 爱采集数据采集和发布插件 WordPress plugin (all versions through 1.0.0) exposes internal handler methods to unauthenticated HTTP requests with no capability or nonce verification, allowing any remote attacker to create WordPress user accounts and taxonomy terms. A publicly available exploit has been documented by WPScan, significantly lowering the barrier to opportunistic exploitation across WordPress installations running this plugin. No KEV listing confirms active widespread exploitation at time of analysis, but the trivial attack complexity and public exploit code make targeted abuse realistic.
Local privilege escalation in Colorful iGameCenter 2.0.0.81 stems from its bundled WinRing0x64.sys driver, whose sub_11504 IOCTL handler exposes arbitrary physical-memory access via attacker-controlled PhysicalAddress/AlignNumer/AlignSize arguments. A low-privileged local user can abuse this IOCTL Dispatch path to read and write kernel-visible physical memory and escalate to SYSTEM. Publicly available exploit code exists for the underlying WinRing0 driver class, but this specific CVE is not listed in CISA KEV and EPSS is unavailable; no active exploitation is confirmed.
Unauthenticated remote code execution in the ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 lets remote attackers install and activate arbitrary plugins, yielding PHP execution as the web-server user. The flaw stems from the ppress_connect_process AJAX handler trusting a guessable 32-bit connect token, which an attacker brute-forces before supplying a caller-controlled URL via the file parameter to trigger silent plugin installation. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, though the low token entropy makes weaponization straightforward.
Credential exposure in Ebyte NE2-D11 firmware allows an unauthenticated adjacent-network attacker to recover administrative credentials from exported configuration files. The device exports sensitive configuration data - including credentials - without adequate protection (CWE-312: Cleartext Storage of Sensitive Information), meaning any attacker positioned on the local network who can access or intercept an exported configuration file gains valid credentials. Compromised credentials enable direct device access and, where the same credentials are reused, lateral movement to similarly configured Ebyte deployments. No public exploit or CISA KEV listing has been identified at time of analysis.
Improper access control in the delParentalRules handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete parental-control rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The action requires no authentication (PR:N) and is automatable, though EPSS is low (0.18%) and there is no public exploit identified at time of analysis. SSVC lists exploitation as none, so this is a real but not-yet-exploited network-reachable weakness.
Unauthenticated wireless-configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers reach the setWiFiAdvancedCfg handler through the /cgi-bin/cstecgi.cgi endpoint without credentials and alter advanced Wi-Fi settings to degrade wireless service. The flaw is an improper access-control (CWE-284) issue on a CGI function that should require authentication. No public exploit has been identified at time of analysis, and EPSS is low (0.18%, 7th percentile), indicating little observed exploitation interest so far.
Unauthenticated access-control bypass in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers invoke the setWiFiEasyGuestCf handler on /cgi-bin/cstecgi.cgi with no credentials, creating or weakening the guest wireless network configuration. An attacker can enable or reconfigure guest WiFi to broaden its reach or lower its security, providing an unauthorized foothold onto the local network. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis, though the missing-authorization pattern is trivial to script.
Unauthenticated log erasure in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers wipe system logs by sending a crafted POST request to the clearSyslog handler at /cgi-bin/cstecgi.cgi, with no credentials required. The flaw is an incorrect-access-control (CWE-284) gap on an administrative maintenance function that should be privileged. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.18% (7th percentile), consistent with a niche consumer-router target rather than mass exploitation.
Improper access control in the delVlanCfg handler of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers delete VLAN configuration entries by POSTing to the /cgi-bin/cstecgi.cgi CGI endpoint. Removing VLAN entries collapses network segmentation, which can break isolation between trusted and guest/IoT segments and disrupt connectivity. No public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile), consistent with a niche consumer-router bug rather than mass exploitation.
Unauthenticated WAN configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers alter upstream provisioning and connectivity by POSTing a crafted request to the setWanCfg handler of /cgi-bin/cstecgi.cgi, with no login required. The setWanCfg function performs no access-control check (CWE-284), so an attacker can rewrite WAN/uplink settings - potentially redirecting or severing the device's internet connectivity. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the flaw is not in CISA KEV.
Improper access control in the setUpgradeFW function of the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets unauthenticated remote attackers alter the firmware-upgrade workflow by sending a crafted POST request to /cgi-bin/cstecgi.cgi. Because the CGI endpoint enforces no authentication, an attacker on a reachable network can tamper with the device's firmware update process, risking integrity compromise and denial of service (bricking). EPSS is low (0.18%, 7th percentile) and there is no public exploit or KEV listing at time of analysis.
Unauthenticated policy tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote attackers overwrite URL/browsing filter rules by posting to the /cgi-bin/cstecgi.cgi endpoint's setUrlFilterRules function without any credentials. The flaw is a broken access-control check (CWE-284) reported by MITRE with a CVSS of 9.1; no public exploit is identified at time of analysis and EPSS is low (0.18%, 7th percentile).
Configuration tampering in the TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) lets remote unauthenticated attackers rewrite IPTV service settings by posting a crafted request to the /cgi-bin/cstecgi.cgi endpoint's setIptvCfg handler. The CGI function fails to enforce any authentication or authorization check, so anyone able to reach the web management interface can alter service configuration. No public exploit code has been identified and EPSS is low (0.16%), but the flaw is trivially reachable (CVSS 9.1, AV:N/AC:L/PR:N).