Stored cross-site scripting in code-projects Online Shopping System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the email parameter of the Newsletter Subscription component at /offersmail.php. When a privileged user such as an administrator views stored subscription data, the injected payload executes in their browser. A public proof-of-concept is confirmed via GitHub; the vulnerability has not been listed in the CISA KEV catalog, and the CVSS 4.0 score of 2.1 reflects the constrained real-world impact due to required user interaction and a low integrity-only impact ceiling.
Unrestricted file upload in jeecgboot jeewx-boot's doUpload endpoint exposes the server to arbitrary file write via manipulation of the File argument in MyJwWebJwid3Controller, within the WeChat integration module. The vulnerability stems from improper access control (CWE-284) and public exploit code has been disclosed (CVSS 4.0 E:P), though the project maintainer has not yet responded to the issue report. The rolling-release development model means no fixed version can be cited, leaving all deployments at the affected commit hash and earlier without vendor guidance.
AshAdmin's Table, DataTable, and Show LiveView components constructed row-action URLs via raw Elixir string interpolation, splicing unencoded record primary keys directly into query strings. Attackers who control a record's string primary key - common in Ash applications using slugs or email addresses as identifiers - can craft a key containing query-string metacharacters (e.g., `legitimate-slug&action_type=destroy`) that override URL parameters when an administrator clicks a row-action link, silently redirecting them to an unintended action such as resource destruction. No public exploit code has been identified at time of analysis; exploitation requires write access to a string-keyed Ash resource and active administrator interaction, affecting ash_admin 0.3.0-rc.0 through 1.3.0.
Improper authorization in LogNet's grpc-spring-boot-starter affects annotation processing logic in versions up to 5.2.0, allowing authenticated remote attackers with low privileges to bypass access controls under high-complexity conditions. The vulnerability stems from CWE-266 (Incorrect Privilege Assignment) in the component responsible for processing security annotations on gRPC service endpoints. A proof-of-concept exploit has been publicly disclosed; no vendor patch is available as the project has not yet responded to the responsible disclosure report.