Unauthenticated stored or reflected Cross-Site Scripting in the LeadConnector WordPress plugin (versions ≤ 4.0.5) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser session without any prior authentication. The CVSS vector confirms a scope change (S:C), meaning the injected script escapes the plugin's context and can affect the broader WordPress session environment. No public exploit code or active exploitation has been identified at time of analysis, but the lack of authentication barrier lowers the effort required to attempt attacks at scale against WordPress installations.
Cross-site scripting in Uncode WordPress theme versions 2.12.7 and below allows unauthenticated attackers to inject arbitrary JavaScript that executes in victims' browsers upon interaction. The CVSS scope change (S:C) indicates injected scripts run in a security context beyond the theme itself - typically the authenticated victim's browser session - enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated cross-site scripting in the Email Subscribers & Newsletters WordPress plugin (versions ≤ 5.9.33) by Icegram allows remote, unauthenticated attackers to inject malicious scripts that execute in the browsers of users who visit affected pages. The CVSS scope-change indicator (S:C) confirms the injected payload crosses trust boundaries into the victim's browser context, enabling session hijacking, credential theft, or administrative account takeover on the affected WordPress site. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Server-Side Request Forgery in MCPHub prior to v1.0.32 allows any authenticated non-admin user to register an arbitrary server URL, coercing the hub into issuing outbound HTTP requests with no egress filtering against loopback, RFC1918, or link-local 169.254.0.0/16 ranges. Via the OpenAPI proxy path, the full HTTP response body is reflected back to the caller, enabling exfiltration of data from internal services including cloud metadata endpoints; via SSE and streamable-HTTP transports, the requests are sent blind, enabling internal port scanning and service triggering. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated XSS in miniOrange's WordPress Social Login and Register plugin (versions 7.8.2 and earlier) allows remote attackers to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL targeting the plugin's social login flow. The scope-changed CVSS vector (S:C) confirms cross-context impact, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog at time of analysis.
Unauthenticated cross-site scripting in SliceWP WordPress affiliate plugin versions 1.2.10 and earlier allows a remote unauthenticated attacker to inject malicious scripts that execute in the browser context of other users, including site administrators. The scope-changed CVSS vector (S:C) indicates the injected payload crosses browser security boundaries, enabling session hijacking, credential theft, or administrative action takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack disclosure provides sufficient detail for exploit development by capable actors.
Unauthenticated XSS in RegistrationMagic WordPress plugin versions 6.0.9.8 and below exposes sites to script injection attacks requiring only that a victim visit a crafted URL. The CVSS scope-change metric (S:C) confirms the injected payload executes in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or administrative action on behalf of the victim. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in the Super Store Finder WordPress plugin (versions <= 7.10) allows unauthenticated remote attackers to inject malicious client-side scripts that execute in the security context of victim users' browsers. The CVSS Scope Change metric (S:C) confirms the attack crosses from the plugin's server-side context into the victim's browser environment, enabling session hijacking, credential harvesting, or malicious redirects against site visitors or administrators who interact with the affected input. No public exploit code or active exploitation has been identified at time of analysis, but the PR:N unauthenticated attack vector means any internet-facing WordPress installation running this plugin version is reachable without attacker credentials.
Unauthenticated cross-site scripting in the Tailored Tools WordPress plugin (versions 3.0.2 and earlier) allows a remote, unauthenticated attacker to inject malicious scripts that execute in the context of an authenticated victim's browser session. The scope change indicated by the CVSS vector (S:C) confirms that the injected payload crosses the plugin's security boundary into the victim's browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or active exploitation has been identified at time of analysis.
SMTP command injection in Nodemailer (npm) versions up to and including 8.0.4 allows an attacker who can influence the transport `name` configuration option to inject arbitrary SMTP commands by embedding CRLF sequences in the value. The EHLO, HELO, and LHLO commands are constructed via direct string concatenation in lib/smtp-connection/index.js without sanitization, enabling unauthorized email sending, spoofing, and phishing through the configured SMTP relay. A proof-of-concept is publicly available in the GHSA advisory; no KEV listing is present, indicating exploitation has not been confirmed at mass scale at time of analysis.
Cross-tenant database manipulation in ToolJet before v3.16.208 exposes all organizations on shared instances to unauthorized DDL and DML operations by any builder-role user in a co-tenant organization. The database write and destroy API routes accept a user-supplied organizationId without server-side ownership verification, enabling permanent table deletion, arbitrary data insertion, and schema alteration across organizational boundaries. No public exploit has been identified at time of analysis, and exploitation requires a valid builder-role account and knowledge of a target organizationId, limiting opportunistic risk while remaining severe for multi-tenant deployments.
Out-of-bounds heap write in GDB's legacy STABS debug format parser allows arbitrary code execution within the GDB process when a user opens a crafted ELF binary. The root cause is a linked-list removal bug in `read_member_functions()` (gdb/stabsread.c) that retains destructor entries in the main function list after decrementing the length counter, causing the subsequent array copy to write beyond allocated bounds. Confirmed under controlled conditions to achieve command execution within GDB; no inferior process execution is required, and no public exploit code is known at time of analysis.
Privilege escalation in HP ImageDiags prior to version 5.0.0.36 enables a local low-privileged attacker - contingent on active interaction by a higher-privileged user - to gain elevated system privileges through insufficient access controls on temporary file resources (CWE-379). All versions of HP ImageDiags before 5.0.0.36 are affected per HP security bulletin HPSBGN04143. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Path traversal in Kirby CMS's filesystem containment logic allows remote unauthenticated attackers to access image files in PHP-readable sibling directories that share a string prefix with the Kirby installation root, and to create thumbnails from those files via the media handler. Versions prior to 4.9.5 (4.x line) and 5.5.2 (5.x line) are affected, with the impact limited to subsequent-system confidentiality exposure - staging sites, backups, or co-hosted internal sites - rather than the Kirby instance itself. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 AT:P metric confirms specific environmental preconditions must exist for exploitation.
Server-side request forgery in Smarty's {fetch} template function (versions prior to 4.5.7 on the 4.x line and 5.8.2 on the 5.x line) allows network-accessible attackers to bypass the trusted_uri allowlist and reach arbitrary internal endpoints by exploiting PHP's default redirect-following behavior. The security policy's isTrustedUri() check validates only the initial URL; when file_get_contents() silently follows an HTTP redirect placed on a trusted host, the request lands on an attacker-chosen internal target, enabling SSRF to services such as cloud metadata endpoints or internal APIs. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Missing authentication on the DownloadPublic endpoint in sdcb chats through version 1.12.0 exposes signed file downloads to unauthenticated remote access, representing a CWE-306 failure in the .NET FileController. The flaw is network-exploitable but carries a CVSS 4.0 score of 2.9 due to high attack complexity and limited confidentiality impact. A proof-of-concept exploit has been publicly released, and the vendor has not responded to disclosure, leaving no official patch available.
Path traversal in MCPHub's MCPB file upload handler, prior to version 0.12.13, enables a remote attacker to extract files to arbitrary filesystem locations and delete arbitrary directories on the host by embedding traversal sequences in a crafted archive manifest. The vulnerability exists at `src/controllers/mcpbController.ts:107`, where `manifest.name` is unsanitized before concatenation into `fs.mkdirSync` and `fs.renameSync` calls; the same unsanitized value flows into `cleanupOldMcpbServer` at line 110, enabling directory deletion. No public exploit code or CISA KEV listing has been identified at time of analysis, though the full source-level disclosure in the GHSA advisory makes weaponization straightforward.
Incorrect authorization in GROWI exposes other users' bookmark data to unauthenticated remote attackers without any privileges or user interaction. The flaw (CWE-863) indicates that bookmark retrieval endpoints fail to enforce proper access control checks, allowing any network-accessible attacker to enumerate or read bookmark data belonging to arbitrary users. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided in the source intelligence.
Quadratic time complexity in pypdf's `read_until_whitespace` function allows remote unauthenticated attackers to cause denial of service by supplying a crafted PDF containing a long non-whitespace byte stream. All versions prior to 6.15.0 accumulate bytes via immutable concatenation in a single-byte loop, producing O(N²) processing cost that stalls Python worker processes and degrades availability of any PDF-parsing pipeline exposed to untrusted input. A confirmed patch is available as version 6.15.0; no active exploitation has been identified at the time of analysis.
Availability disruption in Kubio AI Website Builder (a WordPress page-builder plugin by Extend Themes) affects all versions before 2.9.1, exploitable by authenticated high-privilege users over a network connection. CWE-20 improper input validation allows a privileged attacker to submit malformed input to the plugin, producing a denial-of-service condition against the vulnerable system with no confidentiality or integrity impact. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 6.9 reflects the high-privilege requirement that substantially limits the realistic attacker pool.
Session cookie exposure in sambitraj's Student-Management-System allows attackers to steal session tokens via client-side JavaScript due to the absence of the HttpOnly flag in the `session_start` function. All commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected, and no vendor patch exists as the maintainer has not responded to the responsible disclosure. A publicly available proof-of-concept exists, though exploitation requires high attack complexity and a co-present XSS vector to materialize as a session hijack.
Sensitive WooCommerce order and product data is exposed to authenticated subscribers in the 'Print Barcode Labels for your WooCommerce products/orders' WordPress plugin versions 4.0.0 and below, developed by ukr_solution. The flaw (CWE-201) allows low-privilege authenticated users - those holding only a subscriber role - to retrieve data beyond their authorized scope, yielding a High confidentiality impact per CVSS. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in the Booking and Rental Manager WordPress plugin (versions <= 2.7.6) allows subscriber-level authenticated users to perform privileged write operations they should not be authorized to execute. The flaw, rooted in CWE-862 (Missing Authorization), means any registered site user - the lowest non-guest WordPress role - can manipulate booking or rental data with high integrity impact. No public exploit code has been identified at time of analysis, but the low privilege bar makes this attractive to any account-holding attacker on a WooCommerce-based rental or booking site.
Ethernet bridge input processing in Zephyr RTOS leaks RX packet buffers when CONFIG_NET_ETHERNET_BRIDGE is enabled, allowing any adjacent L2 attacker to exhaust the fixed-size RX pool through a broadcast flood and halt all network reception until reboot. The root cause is eth_bridge_handle_locally() returning NET_OK without consuming the packet, so ethernet_recv() never frees the buffer. An unauthenticated attacker on the same Ethernet segment can emit broadcast or multicast frames with arbitrary EtherType values to permanently consume CONFIG_NET_PKT_RX_COUNT buffers one by one. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV.
TX packet pool exhaustion in Zephyr RTOS's IPv6 Neighbor Solicitation path allows an adjacent unauthenticated attacker to render a device permanently unable to transmit any network traffic. The leak in net_ipv6_send_ns() (subsys/net/ip/ipv6_nbr.c) occurs when an NS is already outstanding for a neighbor - each subsequent outbound packet during the ~3-second INCOMPLETE resolution window allocates a new net_pkt that is never released, silently consuming the fixed-size TX pool. With CONFIG_NET_PKT_TX_COUNT defaulting to as low as 4, a brief low-rate spoofed-source burst suffices to produce a complete, reboot-required network denial of service; no public exploit or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Kalles Addons WordPress plugin (versions <= 1.0.6) allows a low-privileged subscriber-level user to inject malicious JavaScript that executes in the browsers of other site visitors or administrators. The scope-changed CVSS vector (S:C) confirms the injected payload escapes the plugin's execution context and can affect other authenticated sessions. No public exploit or active exploitation has been identified at time of analysis.
Privilege escalation in XueZhiSi Open Source Exam System (xzs) 3.9.0 and earlier allows authenticated teacher-level users to retrieve user listings across roles they are not authorized to view by freely controlling the role parameter in POST /api/teacher/user/page/list requests. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the server trusts the client-supplied role field in UserPageRequestVM without enforcing server-side role binding, exposing potentially sensitive user data. No public exploit code or active exploitation has been identified, and EPSS places this at the 4th percentile.
Stored cross-site scripting in the Venueless default Docker image allows a low-privileged authenticated user to upload an SVG file containing executable JavaScript, which executes in the browser of any user who subsequently views the file. The root cause is absent Content Security Policy enforcement combined with unfiltered SVG delivery, classified as CWE-80. The vendor addressed this by adding a valid CSP to the default image; no public exploit code or CISA KEV listing has been identified at time of analysis.
Use-after-free and double-free memory corruption in the Silicon Labs SiWx917 WiFi driver for Zephyr RTOS enables an adjacent unauthenticated attacker to corrupt the kernel networking buffer pool and crash the device. The driver's siwx91x_send() incorrectly releases a net_pkt owned by the L2 ethernet stack, causing use-after-free reads and a double-free when the caller accesses and unrefs the same packet; under concurrent network load, the trailing unref corrupts a live packet's reference count drawn from the recycled slab slot. No public exploit has been identified at time of analysis, but the vulnerable code path is compiled in by default and is exercisable via ordinary WiFi traffic that any adjacent-network peer can induce.
Tenant hijacking and request degradation in AshPhoenix (ash_phoenix 2.1.26 through 2.3.24) allows unauthenticated remote clients to force an Ash multi-tenant application to resolve an arbitrary tenant by supplying a crafted HTTP Host header. The root cause is that AshPhoenix.Helpers.get_subdomain/2 interpolated the configured root domain verbatim into a regex pattern, causing domain dots to act as any-character wildcards and the match to be applied unanchored and globally - so Host: foo.exampleXcom.attacker.net satisfied a rule intended to match only subdomains of example.com, returning foo as the tenant. A separate case-sensitivity flaw allowed TENANT.EXAMPLE.COM to bypass the allowlist check entirely. No CISA KEV listing and no public proof-of-concept have been identified at time of analysis, but exploitation requires no authentication and no special tooling.
Broken access control in the OwnerRez API WordPress plugin (versions <= 1.2.6) permits subscriber-level users to invoke API endpoints or perform actions reserved for higher-privileged roles such as editors or administrators. Reported by Patchstack and tracked under CWE-862 (Missing Authorization), the flaw enables an authenticated but low-privilege WordPress user to read, modify, or potentially delete vacation-rental booking data managed through the OwnerRez integration. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity keeps real-world risk non-trivial for any multi-tenant WordPress deployment hosting this plugin.
Command injection in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 allows network-accessible attackers with low-privilege credentials to execute arbitrary OS commands by manipulating the 'ussd' parameter in the setUssd function exposed via /cgi-bin/cstecgi.cgi. A proof-of-concept exploit has been publicly released on GitHub, lowering the skill threshold for exploitation. On embedded router firmware, CGI processes typically run with root or near-root privileges, meaning successful exploitation likely yields full device control - a substantially higher real-world impact than the provided CVSS 4.0 score of 2.1 suggests.
Heap-based buffer overflow in FLVMeta versions up to 1.2.2 allows remote attackers to trigger a crash via a crafted FLV file that manipulates the length argument passed to amf_string_new() during AMF string processing. A public proof-of-concept exists, but the CVSS 4.0 score of 2.1 reflects the strictly limited impact - low-severity availability disruption only, with no confidentiality or integrity consequences. The project maintainer has publicly disputed that the reported bugs are practically exploitable, further tempering the real-world risk assessment.
Reflected cross-site scripting in yaojingang GEOFlow through version 2.1.0 allows remote, unauthenticated attackers to inject arbitrary JavaScript via the Search argument in the JSON-LD Theme Handler (app/Http/Controllers/Site/HomeController.php). Exploitation requires passive user interaction - a victim must follow a crafted link - limiting the attack to phishing and session-hijacking scenarios. A public proof-of-concept has been disclosed via GitHub issue #60, and vendor-released patch v2.1.1 is available.
Arbitrary file deletion in SeaCMS up to version 13.6 is achievable by authenticated remote users through the Avatar Upload component's password-change handler, where the `oldpic` parameter is passed unsanitized to PHP's `unlink()` function. A publicly available proof-of-concept exploit hosted on GitHub demonstrates the technique against the `/member.php?action=chgpwdsubmit` endpoint, lowering the barrier for exploitation to any account holder. While the CVSS 4.0 score of 2.1 reflects limited impact - file deletion only, no data exfiltration - deletion of configuration, credential, or application files could cascade into more severe outcomes than the base score implies; no public exploit identified at time of analysis has been confirmed as actively exploited (CISA KEV).
Path traversal in SeaCMS up to version 13.6 enables authenticated remote attackers to delete arbitrary files by injecting directory traversal sequences into the `itype` or `vid` parameters of the Comment Cache deletion endpoint `/member.php?action=del_pl`. A public proof-of-concept exploit is documented in a GitHub security advisory, lowering the barrier to exploitation. While not confirmed in CISA KEV, the combination of network reachability, low privilege requirement, and public POC elevates practical risk for exposed SeaCMS deployments beyond what the medium CVSS score alone suggests.
Use-after-free in Systerel S2OPC OPC UA stack up to version 1.7.3 allows remote low-privileged attackers to crash the OPC UA server by supplying a crafted EventFilter argument to the subscription monitored-item handler, resulting in a denial of service against industrial communication endpoints. No confirmed active exploitation (not in CISA KEV), though a proof-of-concept is publicly available per the referenced GitLab work item, materially lowering the exploitation barrier. In OT/ICS environments, even a VA:L crash impact can carry significant operational consequences by halting process monitoring or control communications.
Reflected cross-site scripting in SeaCMS up to version 13.6 allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session via the `errtxt` parameter of `/err.php`. Exploitation requires social engineering to deliver a crafted URL to a target user; no privileges or prior authentication are needed. A public proof-of-concept exploit exists on GitHub, raising the likelihood of opportunistic abuse against sites running unpatched SeaCMS installations.
Stored cross-site scripting in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to inject persistent JavaScript via the last_name parameter of /register.php during user registration. When an administrator or privileged user subsequently views the registered user list, the stored payload executes in their browser context, enabling session hijacking or credential theft. A public proof-of-concept is available on GitHub; the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited real-world scope.
Information disclosure in vidIQ Vision for YouTube Extension 3.199.0 on Chrome exposes YouTube video frame captures to any web page able to send crafted postMessage events. The extension's window.addEventListener handler processes incoming messages without validating the sender origin, allowing a remotely-hosted malicious page to exfiltrate frame capture data by manipulating the vidiqEvent argument. No patch is available - the vendor has explicitly stated they do not accept vulnerability submissions and operate no bug bounty program - and a public proof-of-concept exploit is available on GitHub.
Cross-site scripting in Apache Wicket's AbstractSingleSelectChoice base class allows injection of unescaped HTML into the default/null option of DropDownChoice form elements. Affected versions span all supported Wicket branches from 8.0.0 through 10.10.0, as well as unsupported releases back to 1.5.0. An attacker who can influence the value returned by the overridden getNullValidDisplayValue() or getNullKeyDisplayValue() methods, or who controls the relevant resource bundle entries, can execute arbitrary JavaScript in a victim user's browser. No public exploit has been identified at time of analysis.
Out-of-bounds read in Kamailio's IMS AVP handler exposes telecom infrastructure to remote memory disclosure and potential service disruption. The `get_4bytes()` function across five IMS modules - `ims_auth`, `ims_icscf`, `ims_registrar_scscf`, `ims_charging`, and `ims_ocs` - fails to validate that Diameter AVP data buffers contain at least 4 bytes before reading, allowing a remote attacker with low-privilege Diameter interface access to trigger the flaw via a crafted malformed message. Publicly available exploit code exists per GitHub issue #4816, and the vendor has confirmed that the 5.5.0 branch is end-of-life and will receive no further security updates, compounding risk for operators running that release.
Revoked API token enforcement is absent in QuantumNous new-api up to 1.0.0-rc.15, allowing a holder of a disabled token to query read-only endpoints such as /api/usage/token/ and retrieve usage log data. The root cause (CWE-613, Insufficient Session Expiration) lies in the TokenAuthReadOnly middleware in middleware/auth.go, which skipped the disabled-token status check entirely before the patch. A public POC is available; no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the narrow, low-impact attack surface.
Improper access control in caoqianming's django-vue-admin 1.0 allows any authenticated low-privilege user to manipulate the `file_id` parameter in the `/api/file/` API endpoint, bypassing per-resource authorization checks to access or tamper with files belonging to other users. The vendor did not respond to responsible disclosure, leaving no official patch available. A publicly available proof-of-concept exploit (CVSS E:P) hosted on Google Drive substantially lowers the barrier to exploitation for any attacker with a valid account.
Improper access controls in Doccano's Bulk-Delete Endpoint allow low-privileged authenticated users to delete category type labels across projects beyond their authorized scope, affecting all versions through 1.8.5. The vulnerability resides in the LabelList function at the /v1/projects/1/category-types REST API endpoint, where per-project authorization is not enforced during bulk-delete operations. A publicly available proof-of-concept exploit exists, and no vendor patch has been issued following disclosure; the vendor was unresponsive to coordinated disclosure.
Unrestricted file upload in diem-project/diem through version 5.1.3 exposes the Widget Editor to remote authenticated attackers who can upload arbitrary file types - including executable PHP scripts - via the media form handler dmWidgetContentBaseMediaForm.php. If uploaded files reside in a web-accessible directory without server-enforced execution restrictions, this vulnerability escalates from a file-write primitive to full remote code execution. A public proof-of-concept is available through a GitHub issue; the project has not responded to the disclosure and no patch has been released.
SQL injection in Soarkey StudentManagement (学生信息管理系统) allows authenticated remote attackers to read from or manipulate the backing database by supplying malicious input to the `cno` parameter of the `CourseDao.course_ranking()` method. All versions up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e are affected with no vendor patch available, as the project maintainer has not responded to the disclosure. Publicly available exploit code exists via GitHub issue #33, though no CISA KEV listing is present.
Improper access control in Doccano's Project Example Detail endpoint allows authenticated low-privilege users to access, modify, or otherwise interact with project annotation data beyond their authorization scope. Versions up to 1.8.5 of both the Open Source Annotation Tools and Auto Labeling Pipeline Module components are confirmed affected. A publicly available proof-of-concept exploit exists; no vendor patch has been released and the vendor did not respond to responsible disclosure, leaving deployments exposed with no official remediation path.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers to manipulate database queries via the unsanitized `ID` parameter in `/pages/inv_edit.php`. Exploitation requires a valid application account (PR:L per CVSS 4.0 vector), and a public proof-of-concept is available on GitHub, lowering the exploitation bar for any user with credentials. The vulnerability is not currently listed in CISA KEV, and the CVSS 4.0 score of 5.3 (Medium) reflects the authentication prerequisite limiting broader impact.
Reflected XSS in TechStore 1.0 contact_display endpoint allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by embedding a malicious payload in the `id` URL parameter, which the application echoes verbatim into the rendered HTML. The CVSS Scope:Changed metric confirms cross-origin browser-level impact, enabling session theft, credential harvesting, or DOM manipulation against any user who clicks a crafted link. No active exploitation is confirmed via CISA KEV; a public proof-of-concept exists on GitHub at the referenced gist, and EPSS at 0.16% (6th percentile) reflects low current exploitation activity.