Cross-site scripting in the Super Store Finder WordPress plugin (versions <= 7.10) allows unauthenticated remote attackers to inject malicious client-side scripts that execute in the security context of victim users' browsers. The CVSS Scope Change metric (S:C) confirms the attack crosses from the plugin's server-side context into the victim's browser environment, enabling session hijacking, credential harvesting, or malicious redirects against site visitors or administrators who interact with the affected input. No public exploit code or active exploitation has been identified at time of analysis, but the PR:N unauthenticated attack vector means any internet-facing WordPress installation running this plugin version is reachable without attacker credentials.
Unauthenticated cross-site scripting in the Tailored Tools WordPress plugin (versions 3.0.2 and earlier) allows a remote, unauthenticated attacker to inject malicious scripts that execute in the context of an authenticated victim's browser session. The scope change indicated by the CVSS vector (S:C) confirms that the injected payload crosses the plugin's security boundary into the victim's browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or active exploitation has been identified at time of analysis.
Cross-tenant database manipulation in ToolJet before v3.16.208 exposes all organizations on shared instances to unauthorized DDL and DML operations by any builder-role user in a co-tenant organization. The database write and destroy API routes accept a user-supplied organizationId without server-side ownership verification, enabling permanent table deletion, arbitrary data insertion, and schema alteration across organizational boundaries. No public exploit has been identified at time of analysis, and exploitation requires a valid builder-role account and knowledge of a target organizationId, limiting opportunistic risk while remaining severe for multi-tenant deployments.
Out-of-bounds heap write in GDB's legacy STABS debug format parser allows arbitrary code execution within the GDB process when a user opens a crafted ELF binary. The root cause is a linked-list removal bug in `read_member_functions()` (gdb/stabsread.c) that retains destructor entries in the main function list after decrementing the length counter, causing the subsequent array copy to write beyond allocated bounds. Confirmed under controlled conditions to achieve command execution within GDB; no inferior process execution is required, and no public exploit code is known at time of analysis.
Privilege escalation in HP ImageDiags prior to version 5.0.0.36 enables a local low-privileged attacker - contingent on active interaction by a higher-privileged user - to gain elevated system privileges through insufficient access controls on temporary file resources (CWE-379). All versions of HP ImageDiags before 5.0.0.36 are affected per HP security bulletin HPSBGN04143. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.