CVE-2026-80489 cannot be meaningfully summarized - the description is absent and no CVSS, CWE, CPE, EPSS, KEV, or patch data was provided. The sole intelligence signal is a Ubuntu vendor report, suggesting the affected package may be distributed via Ubuntu repositories, but the specific product, vulnerability class, and impact are entirely unconfirmed. No exploitation status, severity, or affected scope can be determined from available data.
Git textconv injection in GitList 2.0.0 enables remote code execution on the server by exploiting repository-controlled `.gitattributes` textconv filter definitions. When a user browses a commit diff or blame view, GitList invokes `git show` or `git blame` without the `--no-textconv` guard, causing git to execute attacker-committed shell scripts as the web server process. A public proof-of-concept exists embedded in the patch's own regression test suite; the vulnerability is absent from the CISA KEV catalog at time of analysis.
Server-side request forgery in PowerJob up to version 5.1.2 allows unauthenticated remote attackers to issue arbitrary server-originated requests via the MuConnectionManager.getOrCreateConnection function exposed through the Transport Endpoint in TestController.java. Publicly available exploit code exists (confirmed by CVSS 4.0 E:P modifier and description), and no vendor patch is available - the project was notified via GitHub issue but has not responded. Successful exploitation can be used to probe internal services, access cloud instance metadata endpoints, or exfiltrate credentials from the server's internal network.
Missing authentication on the edit endpoint in cu silicon up to version 0.1.5 allows unauthenticated remote attackers to interact with the `create_app` function in `views.py` without any credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no special conditions against a network-accessible deployment, and a publicly available proof-of-concept exploit (E:P) reduces the barrier to abuse. No vendor patch exists; the vendor did not respond to coordinated disclosure, leaving users without an official fix.
Server-side request forgery in Hyperledger Firefly up to 1.4.0 allows unauthenticated remote attackers to manipulate the webhook subscription URL parameter, causing the Firefly server to issue arbitrary HTTP requests to internal or otherwise inaccessible network resources. The vulnerability resides in the ValidateOptions function within the webhook subsystem (internal/events/webhooks/webhooks.go) and is exploitable without authentication or user interaction per the CVSS 4.0 AV:N/PR:N/UI:N vector. A public proof-of-concept exploit exists (CVSS 4.0 E:P), and no vendor patch or response has been identified at time of analysis.
Uncontrolled recursion in Samsung's rlottie animation library crashes any application embedding it when processing a crafted Lottie animation file containing pathologically nested shape-group structures. The flaw resides in lottieparser.cpp's parseGroupObject() function, which processed nested shape groups recursively without any depth ceiling, enabling stack exhaustion via a malicious .lottie/.json file. No active exploitation is confirmed and no public exploit has been identified at time of analysis; this is a local, user-interaction-dependent denial-of-service vulnerability.
Off-by-one out-of-bounds write in Zephyr RTOS's LwM2M JSON formatter allows a LwM2M server peer to corrupt one byte of memory adjacent to a STRING resource buffer by sending a WRITE payload whose string length exactly equals the buffer size. Affected devices are Zephyr LwM2M clients with the JSON content formatter enabled (cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*). The overflow deterministically writes a NUL byte past the buffer boundary, enabling potential crash or silent data corruption depending on memory layout; no public exploit has been identified at time of analysis, but the fix commit and security advisory are publicly visible.
Address bar spoofing in Firefox for iOS lets a malicious webpage stall a popup's cross-origin navigation after the browser internally commits it, causing the address bar to display the intended destination's origin while the popup continues rendering attacker-controlled content. All Firefox for iOS releases prior to 155.0 are affected; the fix shipped in version 155.0 per Mozilla advisory MFSA2026-81. No public exploit has been identified and CISA SSVC confirms exploitation status as none, but the phishing potential is realistic given the deceptive UI state.
Unauthenticated access control bypass in TOTOLINK T6 router (firmware 4.1.5cu.748_B20211015) allows any attacker on the adjacent network to arbitrarily modify Wi-Fi scheduling via the setWiFiScheduleCfg handler. By sending a crafted POST to /cgi-bin/cstecgi.cgi without credentials, an attacker can suppress or extend wireless availability windows, causing service disruption for wireless clients. EPSS at 0.18% (7th percentile) and absence from CISA KEV reflect no known active exploitation at time of analysis.
Stored XSS in Sulu CMS prior to versions 2.6.25 and 3.0.8 allows an authenticated attacker with media upload permissions to execute attacker-controlled JavaScript in a victim's browser on the Sulu origin. By uploading an HTML, XHTML, or XML file and crafting a download URL with the inline=1 query parameter, the attacker bypasses the expected Content-Disposition: attachment behavior, causing the browser to render the document instead of downloading it. When an authenticated victim opens the crafted link, the attacker's JavaScript executes with full access to the victim's Sulu-origin session and can read sensitive data or perform privileged actions on the victim's behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Missing Authorization in the WPExperts Post SMTP WordPress plugin (versions 4.0.0 through beta.1) permits low-privilege authenticated users to perform settings changes that should be restricted to administrators. The flaw, rooted in CWE-862, means certain plugin actions lack adequate capability checks before execution, allowing role-inappropriate operations against the plugin's SMTP configuration. Impact is confined to integrity and availability - an attacker can alter mail server settings or disrupt outbound email delivery - with no confidentiality impact identified. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in QD (versions 20220208-20250803) allows a low-privileged authenticated attacker to inject arbitrary JavaScript into the task execution log output, which then executes in a victim user's browser when they trigger the affected task run. The injection path runs through HAR template variables - specifically the `__log__` field populated via the `extract_variables` mechanism and the `api://util/unicode` endpoint - which are rendered unsanitized into HTML via Python `%` string formatting in `TaskRunHandler.post()`. A public POC is available via GitHub Gist; no patch version has been confirmed at time of analysis.
OAuth state validation in @hono/oauth-providers prior to 0.8.6 fails open when the state parameter is absent from both the callback request and the stored session, treating two null values as a matching pair and bypassing CSRF protection entirely. This affects the google, github, facebook, discord, twitch, linkedin, and msentra social login providers in any Hono application using this middleware at version 0.8.5 or earlier. An attacker who tricks a victim into visiting a crafted OAuth callback URL can silently bind the attacker's third-party identity to the victim's session (login CSRF) or permanently link the attacker's account to the victim's account (forced account linking), enabling later sign-in as the victim. No public exploit has been identified at time of analysis.
Server-Side Request Forgery in the MapSVG WordPress plugin (versions <= 8.15.0) exposes the hosting WordPress server as a proxy to internal or adjacent network resources, reachable without authentication. The CVSS scope-change indicator (S:C) confirms that successful exploitation can cause the server to issue requests beyond the WordPress application boundary, potentially exposing internal APIs, cloud metadata endpoints, or intranet services. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Stored cross-site scripting in Nokia NSP's workflow application allows an authenticated attacker to inject persistent malicious scripts that execute in the browsers of other NSP users who view the compromised content. The vulnerability spans a wide range of NSP releases from version 22.3 through 25.11, affecting operators relying on Nokia's network management and orchestration platform. No public exploit code or active exploitation has been identified; SSVC assessment confirms exploitation status as none with a non-automatable attack path.
Infinite loop denial-of-service in BBEdit's Lasso Language Tokenizer affects all versions up to 15.5.5, allowing a remote attacker to hang the application by delivering a specially crafted Lasso language file that the victim opens. The vulnerability is limited to application-level availability loss with no confidentiality or integrity impact, and requires user interaction to trigger. No active exploitation has been identified; vendor-released fix is available in BBEdit 16.0.
Uncontrolled recursion in BBEdit's Java Language Module (versions through 15.5.5) allows a remote attacker to crash or hang the editor by delivering a specially crafted Java source file that a user then opens. The root cause is CWE-674: the Java parser lacks depth-limiting guards, enabling deeply nested constructs to exhaust the call stack and produce a denial-of-service against the editor process. No active exploitation has been recorded and no public proof-of-concept exploit code is known; the issue was surfaced through fuzzing research by Cipher Security Labs, and Bare Bones Software has released a fix in BBEdit 16.0.
NoSQL injection in FastGPT Community Edition 4.10.0-4.14.0 allows unauthenticated remote attackers to bypass authorization on the POST /api/core/chat/getHistories endpoint by embedding MongoDB operators in crafted JSON payloads, exposing chat history titles for all users across the platform. A public proof-of-concept repository (ExploreIO/CVE-2026-79483-FastGPT-NoSQL-Injection) exists, materially lowering the exploitation bar. EPSS at 0.33% (26th percentile) indicates no widespread exploitation observed yet, but the zero-authentication-required, low-complexity attack surface makes this a realistic opportunistic threat against internet-exposed deployments.
Sulu CMS versions prior to 2.6.25 and 3.0.8 allow authenticated admin users to generate or revoke public preview links for any page, article, or snippet - including content in webspaces they are explicitly forbidden from viewing - because PreviewLinkManager::generate() and PreviewLinkManager::revoke() omit the VIEW permission check before executing. The resulting preview URLs are publicly accessible via an opaque token with no authentication required, meaning the attacker or any recipient of the link can read otherwise-restricted CMS content. No public exploit has been identified at time of analysis, but the attack path is straightforward and directly reproducible from the published commit diff and GitHub security advisory.
Insecure Direct Object Reference in GROWI's bookmark folder APIs allows authenticated users to retrieve, modify, and delete other users' private bookmark data without authorization. Affected across all tracked versions per CPE data (cpe:2.3:a:growi,_inc.:growi:*:*:*:*:*:*:*:*), exploitation requires only a valid session - no elevated privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the attack pattern (predictable or enumerable object IDs in API endpoints) is trivially reproducible by any authenticated user.
Out-of-bounds read in Systerel S2OPC versions up to 1.7.3 allows an authenticated remote attacker to partially disrupt availability of an OPC UA server through crafted string array range write operations. The vulnerable function set_range_matrix_on_string_array in sopc_builtintypes.c fails to enforce memory boundaries during range matrix processing on string arrays. No vendor patch has been released; the project was notified via issue report but has not responded. No public exploit or CISA KEV listing exists at time of analysis.
Unfiltered exception serialization in ash_ai 0.6.0-0.x leaks internal application details - database schema, raw SQL fragments, policy module names - to authenticated chat users via the LLM conversation stream. AshAi.ToolLoop and AshAi.Tools used Elixir's Exception.message/1 verbatim to encode any raised tool exception into the tool-result payload, which the language model then relayed to the requesting user. Any authenticated user able to steer tool arguments into a code path that raises an exception could extract sensitive internal reconnaissance data; ash_ai 1.0.0 closes the gap by routing all tool exceptions through a safe formatter. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Four discrete access control defects in DataEase's sharing link module (versions before 2.10.26) allow any authenticated platform user to cross-access password-protected shares, enumerate other users' share mappings, and disrupt share availability by manipulating tickets they do not own. The flaws span ticket validation (cross-share reuse via ShareTicketManage.validateTicket), password-verification bypass of the mandatory-ticket policy (POST /de2api/share/validate), unauthorized ticket mutation/deletion, and insecure user-ID handling in the share enumeration endpoint. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept code has been identified at time of analysis.
Missing object-level authorization across three REST API surfaces in DataEase before 2.10.26 enables authenticated platform users to read, modify, and delete resources owned by other users. The affected endpoints cover chart detail retrieval (ChartViewManege), dashboard linkage read and write operations (VisualizationLinkageService), and map geometry management (MapManage) - all of which accepted arbitrary resource identifiers without verifying the requesting user held any permission over the target resource. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the low attack complexity makes horizontal privilege escalation straightforward for any authenticated user.
CRLF injection in Nodemailer's List-* header construction allows any application-level user with control over list comment parameters to inject arbitrary RFC822 message headers into outbound emails. Versions up to and including 8.0.8 of the npm package are affected; the fix is available in 8.0.9. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, making this a medium-severity issue with practical impact confined to applications that expose the list comment API surface to untrusted input.
Nodemailer's jsonTransport transport fails to enforce disableFileAccess and disableUrlAccess controls during message normalization in all versions prior to 8.0.9, allowing attackers with control over message content fields to read local filesystem content or trigger outbound SSRF-style HTTP requests. Applications that use jsonTransport as a safe serializer or queue payload generator while trusting those access-control options as a security boundary are the primary affected population. No public exploit code has been identified and the CVE is not in CISA KEV, but the flaw's mechanics are straightforward and fully documented in the GHSA advisory.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows any party who can supply a malicious template to execute arbitrary JavaScript in the browsers of users who render Select schema components. The Select plugin's UI renderer interpolates template-controlled option values directly into an innerHTML assignment without HTML encoding, meaning a value containing `">` breaks out of the attribute context and injects arbitrary HTML and event handlers. A detailed proof-of-concept is publicly documented in GHSA-qq9g-96v4-m3cj; no active exploitation is recorded in CISA KEV at time of analysis.
Cross-workspace authorization bypass in ToolJet through 3.0.0-ee-beta.2 exposes TooljetDB table schemas and restricted app definitions to authenticated low-privilege users via the POST /api/v2/resources/export endpoint. Authenticated users can supply an arbitrary organization_id in the request body to extract database schemas belonging to workspaces they are not members of, and can additionally sidestep per-app granular export permissions within their own workspace to retrieve restricted app definitions. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires valid credentials.
Missing authorization in the bbPress WordPress forum plugin (versions through 2.6.14) allows unauthenticated remote users to bypass access control restrictions and perform actions gated behind specific forum capability checks without proper authorization. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack requires no authentication and no user interaction against a standard installation. No public exploit or CISA KEV listing exists at time of analysis, but the zero-prerequisite attack conditions make this accessible to opportunistic, automated targeting of WordPress sites running the affected plugin.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-reachable attacker to delete Wi-Fi schedule entries without credentials by sending a crafted POST request to /cgi-bin/cstecgi.cgi. The delWiFiScheduleCfg CGI handler fails to enforce authentication before processing deletion requests, enabling unauthorized modification of time-based Wi-Fi access control policies. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.18% (7th percentile), indicating minimal observed exploitation pressure.
Unauthenticated log erasure in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes network defenders to forensic blind spots. The clearTracerouteLog CGI endpoint imposes no access control, allowing any network-reachable attacker to wipe traceroute history via a crafted POST to /cgi-bin/cstecgi.cgi. While integrity impact is rated low (log data only), this capability is routinely used as a cover-tracks primitive following initial compromise of the router or downstream network activity. No active exploitation confirmed; EPSS is 0.18% (7th percentile), consistent with a niche SOHO device.
Incorrect access control in the SystemSettings function of TOTOLINK T6 router firmware 4.1.5cu.748_B20211015 exposes administrative import and export endpoint information to unauthenticated remote attackers. By sending a crafted POST request to /cgi-bin/cstecgi.cgi, an attacker can enumerate configuration management endpoints without any credentials. No public exploit code or CISA KEV listing exists; EPSS at 0.16% (6th percentile) reflects negligible observed exploitation activity, though the disclosed endpoint data could facilitate chained attacks against the device's management API.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows execution of arbitrary JavaScript in users' browsers via unsanitized SVG content rendered directly to innerHTML. The SVG schema plugin's viewer and readOnly form modes assign raw SVG markup to container.innerHTML without stripping script elements, event handler attributes, or foreignObject payloads. A working proof-of-concept is published in the GHSA advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Open redirect in Nokia NSP (Network Services Platform) enables remote unauthenticated attackers to craft URLs that bypass server-side validation of the redirect or URL parameter, redirecting authenticated users to attacker-controlled sites. Affected versions span NSP 23.11 through NSP 25.11 per EUVD data, covering a wide release window. No public exploit identified at time of analysis; EPSS of 0.14% at the 4th percentile reflects negligible observed exploitation activity, and the vulnerability is not listed in CISA KEV.
Open redirect in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows unauthenticated network-accessible attackers to craft redirect URLs that bypass the site's origin validation. The return parameter accepts arbitrary Base64-encoded strings without invoking Joomla's Uri::isInternal() check, meaning the decoded destination is never validated as belonging to the host site. An attacker can exploit this to redirect victims to attacker-controlled external domains, enabling highly convincing phishing campaigns that abuse the trusted appearance of the legitimate site URL. No active exploitation has been identified at time of analysis.
Prototype pollution in Livewire's client-side query-string parser enables reflected cross-site scripting against applications running versions 3.0.0-beta.1 through 3.8.2 or 4.0.0 through 4.3.3. The dot-notated URL parser in js/plugins/history/index.js accepts __proto__, constructor, and prototype as path segments, injecting attacker-controlled values into Object.prototype; multiple effect handlers then read effects.html, effects.js, effects.xjs, and effects.scripts without hasOwnProperty guards, treating inherited values as trusted server-delivered directives and executing arbitrary JavaScript in the application's origin. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and zero-privilege requirement make this a meaningful risk for all unpatched Livewire deployments.
Cross-site scripting in Apache Wicket's Palette component allows injection of arbitrary HTML attributes into rendered `<option>` tags when applications override specific attribute-extension methods with attacker-influenced data. Affected are `wicket-extensions` versions spanning the 8.x, 9.x, and 10.x release lines; applications relying on the default method implementations are definitively not affected. Vendor-released patches are available at versions 8.19.0, 9.24.0, and 10.11.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Apache Wicket's MetaDataHeaderItem class allows injection of arbitrary HTML attributes into generated <meta> and <link> header tags when applications pass attacker-influenced data to the addTagAttribute, forMetaTag, or forLinkTag APIs. The flawed escaping logic - replacing double-quote characters with backslash-double-quote, which carries no escaping semantics in HTML - permits a double-quote in an attacker-controlled value to break out of the attribute context and inject additional attributes such as JavaScript event handlers. Affected release lines span 8.0.0-8.18.0, 9.0.0-9.23.0, and 10.0.0-10.10.0; no public exploit has been identified at time of analysis.
Cross-site scripting in Apache Wicket's AutoLabelTextResolver allows injection of arbitrary markup into web pages when attacker-controlled data reaches a form component's label model via FormComponent#setLabel(IModel). The resolver, registered by default in every WebApplication, writes label values directly into rendered markup without any escaping and ignores the escape-model-strings application setting entirely - meaning there was no available configuration workaround. Applications are vulnerable wherever user-influenced data flows into a label model; this includes both stored XSS (data retrieved from a database) and reflected XSS (data sourced from the current request). No public exploit has been identified at time of analysis, but the vulnerability affects all supported release lines and all unsupported releases from 1.5.0 onwards.
Cross-site scripting in Apache Wicket's Button component allows injection of arbitrary markup into rendered pages when the button is bound to a `<button>` HTML element whose model contains attacker-influenced data. The root cause is an intentional design choice - Button's constructor clears the escape-model-strings flag to prevent double-encoding of `<input>` attribute values - that becomes a security flaw in the `<button>` rendering path, where element body content is never encoded by ComponentTag. Subclasses AjaxButton, AjaxFallbackButton, and WizardButton inherit the same constructor and are equally affected; no public exploit or CISA KEV listing is recorded at time of analysis.
Cross-site scripting vulnerabilities in Apache Wicket's AjaxEditableChoiceLabel and related wicket-extensions components allow an attacker who can influence rendered choice or model data to inject arbitrary HTML or JavaScript into page markup, executing in the browser of any user viewing the affected page. Versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0 of the org.apache.wicket:wicket-extensions module are confirmed affected. The root cause is that two distinct rendering paths bypass Wicket's default HTML escaping, and the escapeModelStrings configuration property has no corrective effect on these components. No public exploit has been identified at time of analysis.
Stored cross-site scripting in Aix-DB through version 1.2.4 allows authenticated low-privilege users to inject persistent malicious HTML and JavaScript into chat responses, skill descriptions, or knowledge messages, which then execute in other users' browsers when the content is viewed. The root cause is two separate rendering paths - a markdown-it component and a marked-based knowledge view - that both pass rendered HTML directly into Vue.js v-html bindings without sanitization. No public exploit has been identified and there is no CISA KEV listing, but the attack is trivially reproducible given the unsanitized rendering pipeline confirmed by source code evidence.
Authorization bypass in ToolJet before v3.16.208 permits any authenticated user to enumerate, create, rename, and delete TooljetDB tables belonging to arbitrary workspaces by supplying a foreign organizationId in the URL path of affected API endpoints. The TooljetDB controller accepts organizationId from the request path without validating it against the requesting user's actual workspace context, completely breaking tenant isolation in multi-workspace deployments. No public exploit code and no CISA KEV listing exist at time of analysis, but the flaw is trivially exploitable by any authenticated user with network access to the instance.
Broken access control in JoomShaper's Helix Ultimate Joomla template extension (versions prior to 2.2.10) allows authenticated backend users to overwrite layout parameters for arbitrary menu items by calling the save-megamenu-settings AJAX endpoint without holding core.edit or core.admin permissions on the targeted com_menus item. The endpoint fails to enforce Joomla's native per-item and component-level ACL checks server-side, meaning any user with backend access can tamper with menu configurations they do not own. No public exploit code and no CISA KEV listing exist at time of analysis.
Arbitrary file deletion within Joomla's `/images/` directory is achievable in Helix Ultimate versions before 2.2.10 by authenticated Author-level users. The `Blog::remove_image()` method validates that the requesting user holds edit rights over the supplied article ID but performs no ownership check on the accompanying image path parameter (`src`), allowing an author to target files belonging to other articles or other content under `/images/`. On Joomla 3 builds where physical file deletion is triggered, this broken object-level authorization flaw enables destructive content tampering without administrative privileges. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege management failure in IObit Uninstaller 15.5.0.11's kernel driver IUForceDelete.sys allows a local low-privileged user to send crafted IOCTL requests to the IRP_MJ_DEVICE_CONTROL handler and trigger improper privilege operations, resulting in limited integrity and availability impact on the local Windows system. The vendor did not respond to coordinated disclosure, leaving no vendor-issued patch or official mitigation guidance available. No public exploit code has been identified and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
iCalendar injection in Wallos prior to v5.0.0 allows authenticated users to break out of VEVENT blocks in exported .ics feeds by embedding raw CRLF sequences in subscription names or notes, enabling insertion of fully attacker-controlled calendar events - including spoofed organizers and arbitrary ATTENDEE email addresses - into any calendar application subscribed to the feed. The root cause is a validation/export mismatch: input sanitization encodes HTML metacharacters but never strips newlines, while the iCal export layer decodes those entities back before writing output, letting CRLF pass through unmodified. No public exploit code or active exploitation (CISA KEV) has been identified; the vendor-released patch is v5.0.0.
Improper privilege management in IObit Unlocker 1.3.0.12's kernel driver (IObitUnlocker.sys) allows a locally authenticated high-privileged user to invoke ZwTerminateProcess through the IRP_MJ_DEVICE_CONTROL handler without adequate authorization checks, enabling termination of processes outside the caller's normal authority. The vulnerability is limited to systems with IObit Unlocker installed and the driver loaded, and requires existing administrator-level access to exploit. No public exploit has been identified at time of analysis, the vulnerability is not in the CISA KEV catalog, and the vendor did not respond to disclosure.
Missing authorization in Xibo CMS prior to 4.4.3 exposes super admin-restricted module settings and full module entity data to authenticated users holding the Module View privilege, via the Module::settingsForm endpoint. The disclosure is read-only - no configuration changes are possible - but the leak of privileged system configuration to lower-trust accounts represents a vertical privilege escalation in the confidentiality dimension. Vendor patch 4.4.3 is available; no public exploit or active exploitation has been identified.
Cross-user data isolation failure in Wallos prior to v4.9.1 allows authenticated users to infer the monthly-normalized subscription cost belonging to other users on the same instance. By setting replacement_subscription_id on their own inactive subscription to a victim's subscription ID, an attacker causes Wallos's stats aggregation engine to dereference the foreign record without user_id scoping, leaking derived financial metadata. A vendor-released patch is available in v4.9.1; no public exploit or CISA KEV listing has been identified at time of analysis.