OS command injection in D-Link DNS-340L and DNS-345 NAS devices exposes authenticated administrators to arbitrary system command execution via the Virtual Volume Handler CGI endpoint across firmware versions 1.01B04, 1.03B06, 1.04.B02, and 1.05b04. The `/cgi-bin/virtual_vol.cgi` component passes CGI parameters `f_sharename`, `f_target`, and `f_name` unsanitized into OS-level calls, granting attackers full shell access on the underlying firmware. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis, leaving all listed firmware versions unmitigated.
Command injection in RedPort Optimizer wXa-203, wXa-213, and wXa-223 devices (firmware through 20260704) allows low-privileged remote attackers to execute arbitrary OS commands via the System Clock management endpoint. The vulnerable `exec()` call in `/xgatev1/system/datetime.php` accepts unsanitized user input, enabling shell metacharacter injection. A public proof-of-concept exploit has been disclosed via Feishu, the vendor did not respond to responsible disclosure, and no patch has been released, leaving operators without an official remediation path.
OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows remote authenticated attackers to execute arbitrary operating system commands by manipulating the `f_ups_ip` argument passed to `/cgi-bin/usb_device.cgi`. The vulnerability arises from unsanitized user-controlled input being passed directly to an OS shell call (CWE-78) within the CGI handler responsible for USB/UPS device configuration. A public proof-of-concept exploit has been disclosed; no patch has been identified at time of analysis. EPSS data was not provided, but the combination of a network-accessible vector, publicly available exploit, and widespread SMB/home-lab deployment of these NAS models elevates real-world risk.
Stack-based buffer overflow in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 enables remote code execution through the device's web management CGI interface. The setUploadSetting handler fails to validate the length of the FileName parameter before copying it onto the stack, allowing an attacker with low-privilege access to overwrite control data and execute arbitrary code on the router. A public proof-of-concept has been disclosed on GitHub, materially increasing exploitation risk even in the absence of a confirmed vendor patch.
SSRF protection bypass in elFinder's URL upload feature allows remote attackers to reach internal HTTP services by exploiting a DNS rebinding race condition in `php/elFinder.class.php` prior to version 2.1.70. The server stores the internal service's HTTP response body as an uploaded file that is subsequently readable through the elFinder interface, making this a non-blind SSRF - a more impactful variant than typical SSRF. A public proof-of-concept is available via the GHSA advisory; no active exploitation has been confirmed in the CISA KEV at time of analysis.
OS command injection in D-Link DNS-340L and DNS-345 NAS appliances (firmware through 20260717) allows authenticated network attackers to execute arbitrary operating system commands by supplying shell metacharacters in the alias, username, password, or volume_location arguments of the iSCSI management endpoint /cgi-bin/iscsi_mgr.cgi. A public proof-of-concept exploit has been disclosed, materially lowering the bar for opportunistic exploitation against devices with default or weak credentials. No CISA KEV listing has been identified, but the accessible attack surface and available POC make this a priority remediation item for any deployment with this NAS model exposed to untrusted networks.
OS command injection in D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 NAS devices allows a low-privileged remote attacker to execute arbitrary operating system commands via the `upIsoRootPath` argument in `/cgi-bin/isomount_mgr.cgi`. All firmware versions through 20260717 are confirmed affected across all four models. A public proof-of-concept exploit is available, materially lowering the bar for exploitation, and no vendor patch has been identified - consistent with D-Link's history of leaving legacy NAS firmware unpatched.
Integer overflow in MSI Dragon Center's NTIOLib_X64.sys kernel-mode driver (versions up to 2.0.155.0) allows local low-privileged users to corrupt kernel memory via crafted count or elementSize arguments passed to the MmioWritePath MMIO Write Path Handler. Exploitation can yield full SYSTEM-level privilege escalation on the target host. A public proof-of-concept is available, the vendor did not respond to coordinated disclosure, and no official patch has been released.
OS command injection in D-Link DNS-327L and DNS-340L NAS devices (all firmware versions through 20260717) allows a remote authenticated attacker to execute arbitrary operating system commands by supplying crafted input to the f_dev parameter of the /cgi-bin/ve_mgr.cgi endpoint. A proof-of-concept exploit is publicly available, materially lowering the barrier for post-authentication abuse. Full OS-level compromise - including persistent backdoor installation and wholesale data exfiltration from attached storage - is achievable; this CVE is not currently listed in CISA KEV, so widespread active exploitation has not been confirmed.
Remote code execution in elFinder prior to 2.1.70 allows an authenticated user with ZIP upload permission to bypass the uploadDeny MIME-type block for PHP-executable extensions. The root cause is that checkExtractItems() calls mimetypeInternalDetect() without normalizing the result through mimeTypeNormalize(), so .phtml, .phar, .php5, and .php3 extensions are not recognized as text/x-php during extraction, letting allowPutMime() approve files that direct upload would reject. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact is full server-side code execution if the web server processes these extensions as PHP.
Scoped path traversal in pnpm allows arbitrary filesystem overwrites during package installation, defeating the --ignore-scripts safety flag entirely. Affected are pnpm v10 before 10.34.5 and v11 before 11.11.0: the package manager's name validation in pickPackage.ts rejects slash characters only for unscoped package names, permitting a scoped name such as @evil/../../../home/user/.bashrc to pass unchecked into raw path joins across three resolver modules and extract package content to any attacker-controlled path. No public exploit has been identified at time of analysis, though GitHub-confirmed patches with regression tests are available.
Out-of-bounds write in D-Link DSM-G600 firmware 1.01 exposes the device to remote memory corruption via a malformed multipart request to the /load_file.cgi endpoint. A low-privileged, network-adjacent or internet-accessible attacker can trigger CWE-787 in the Multipart Handler, potentially achieving arbitrary code execution with full confidentiality, integrity, and availability impact on the device. A public proof-of-concept exploit has been disclosed; no vendor patch has been identified, consistent with D-Link's typical end-of-life posture for legacy NAS hardware.
Sandbox bypass in nodemailer <= 9.0.0 exposes arbitrary file read and full-response SSRF to any authenticated application user whose input reaches the message-level `raw` option. The `disableFileAccess` and `disableUrlAccess` flags - intended to sandbox untrusted message data - are correctly threaded through all other content node builders but are silently omitted when a `MimeNode` is constructed for a `raw` message in `lib/mail-composer/index.js:34-35`, leaving the raw path completely unrestricted. Exfiltrated file contents or HTTP response bodies are delivered as the actual RFC822 message via every supported transport (SMTP, SES, sendmail, stream, JSON) to an attacker-controlled recipient. A local PoC is confirmed per GHSA-p6gq-j5cr-w38f; no KEV listing and no EPSS data are available.
Missing authorization controls in the Ebyte NA111-M industrial wireless module firmware allow a low-privileged authenticated user to access and modify administrative configuration functions that should be restricted to privileged accounts. The device fails to enforce privilege separation between limited-user and administrator roles, meaning any authenticated operator-level account can alter security-sensitive settings and affect device confidentiality, integrity, and availability. The attack is network-accessible with no user interaction required (CVSS 4.0: 8.7), posing a practical risk in OT/ICS environments; no public exploit has been identified at time of analysis.
Credential exposure in Ebyte NE2-D11 firmware allows an unauthenticated adjacent-network attacker to recover administrative credentials from exported configuration files. The device exports sensitive configuration data - including credentials - without adequate protection (CWE-312: Cleartext Storage of Sensitive Information), meaning any attacker positioned on the local network who can access or intercept an exported configuration file gains valid credentials. Compromised credentials enable direct device access and, where the same credentials are reused, lateral movement to similarly configured Ebyte deployments. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in ash_ai (versions 0.1.0 through pre-1.0.0) allows unauthenticated network attackers to execute arbitrary Elixir code on the server by submitting EEx template payloads through prompt action arguments. The AshAi.Actions.Prompt module incorrectly passed function-supplied prompt content - which is frequently assembled from user-controlled action arguments - through EEx.eval_string/2 before forwarding to the AI model, meaning payloads like <%= System.cmd("id", []) %> execute server-side with application process privileges. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-authentication, single-request exploitation path gives this a higher operational priority than the EPSS percentile alone suggests.
Server-side request forgery in @pdfme/common before 5.5.10 allows attackers who control the basePdf template field to force SSR-context servers to issue arbitrary HTTP requests to internal endpoints without any URL validation. The unvalidated fetch() call in getB64BasePdf - reachable from the generator, UI hooks, and UI helper entry points - enables exfiltration from cloud instance metadata services (e.g., AWS IMDS at 169.254.169.254), blind network reconnaissance, and lateral pivot to internal APIs. A detailed proof-of-concept is embedded in GHSA-pgx6-7jcq-2qff; no CISA KEV listing is present at time of analysis.
File upload restriction bypass in Helix Ultimate (Joomla extension by joomshaper.com) versions prior to 2.2.10 allows high-privileged authenticated users to upload arbitrary non-image files - including PHP webshells - by disguising them with raster image file extensions. The extension's upload handler validated only file extension and basic size parameters, not actual file content, enabling disguised executable files to be stored on the web server. No active exploitation or public proof-of-concept has been identified at time of analysis, but successful exploitation yields full server-side code execution with scope change impact.
Path traversal in Eclipse Theia 1.73.0-1.74.x AI Agent Mode allows arbitrary file writes outside the workspace with backend OS user privileges through model-supplied paths that bypass workspace-containment checks. The affected tools - writeFileContent, suggestFileContent, and associated replacement and state helpers - accept relative paths such as ../.bashrc, absolute paths, or tilde-expanded paths like ~/.ssh/authorized_keys without boundary validation. Because path arguments derive from LLM output, an indirect prompt injection attack embedded in developer-loaded content can steer writes to host-executed files and escalate to backend code execution; Agent Mode applies writes silently with no confirmation dialog. No public exploit code or CISA KEV listing exists at time of analysis, though the prompt-injection attack surface is realistic in cloud IDE deployments.
Server-side template injection in the Qute template engine's ReflectionValueResolver allows authenticated remote attackers with the ability to influence template content to bypass Java sandbox restrictions and execute arbitrary OS commands on the server. Affected Red Hat products include Red Hat Build of Quarkus, Red Hat Build of Apache Camel 4 for Quarkus 3, and the JBoss EAP Expansion Pack. No public exploit code or CISA KEV entry has been identified at time of analysis, but the CVSS score of 8.8 and full C/I/A impact make this a high-priority patching target for any Quarkus deployment exposing user-influenced template rendering.
Unauthenticated extension deletion is possible across at least 24 free miniOrange plugin packages for Joomla due to a missing authentication check on extension management functionality. Any network-accessible attacker with no credentials and no user interaction can remove arbitrary installed Joomla extensions, including security-critical ones such as JoomShield or authentication plugins. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote exploitation with zero preconditions.
Privilege escalation in MCPHub prior to version 1.0.29 allows any authenticated low-privilege user to modify system-wide configuration via the PUT /api/system-config endpoint. The handler updateSystemConfig never validates req.user.isAdmin, meaning the app-wide authentication middleware - which only confirms a valid session exists - is the sole barrier, granting any account holder effective administrative control over routing rules and server integrations. No public exploit has been identified at time of analysis, but the attack is trivially reproducible given network access and any valid credential.
Memory corruption via classic buffer overflow in WebKitGTK allows remote attackers to achieve full code execution by delivering malicious web content to a victim user. Affecting Red Hat Enterprise Linux versions 6 through 9, the vulnerability requires no authentication and no special configuration - only that a user process attacker-controlled web content through a WebKitGTK-based application. No public exploit has been identified at time of analysis, but the CVSS 8.8 High rating and full CIA triad impact make this a high-priority patching target across the affected RHEL fleet.
SQL injection in Ankara Hosting's Site Management Panel through version 15062026 enables authenticated remote attackers to manipulate backend database queries with full impact on confidentiality, integrity, and availability. The CVSS score of 8.8 (PR:L) reflects that low-privilege panel credentials are required but attack complexity is minimal once access is obtained. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the Turkish CERT (TR-CERT) has published an advisory.
Remote code execution in OpenSearch's SQL plugin cursor pagination component allows authenticated users holding only basic read/search permissions to execute arbitrary code on the server by supplying a crafted serialized cursor parameter to the plugins/sql endpoint. Affecting all versions of self-hosted OpenSearch and Amazon OpenSearch Service up to the patched releases, this CWE-502 deserialization flaw is particularly dangerous because the low privilege bar means any cluster user - not just administrators - can trigger it. Vendor-released patches exist in OpenSearch 2.19.6 and 3.7.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote attackers can trigger a full MySQL database dump on any WordPress site running Keep Backup Daily before version 2.1.4 by invoking the publicly exposed `kbd_cron_process` parameter with no credentials required. The generated dump file is stored in the publicly accessible uploads directory with a partially predictable filename derived from the database name, a limited random value, and the current Unix timestamp - making retrieval via brute-force enumeration feasible. No active exploitation is confirmed in CISA KEV at time of analysis, but the attack requires no privileges or special tooling, making it an immediate data-exposure priority for affected deployments.
Missing authorization on Devtron's webhook API token endpoint allows any authenticated user - regardless of privilege level - to retrieve plaintext super-admin JWT tokens, yielding full platform control. The GET /orchestrator/api-token/webhook endpoint in versions through 2.2.0 performs no authorization check beyond validating that a session exists, meaning a low-privilege operator account is sufficient to extract credentials that grant unrestricted administrative access. No patch version has been confirmed in the available references, and no public exploit or CISA KEV listing has been identified at time of analysis.
Policy evaluation bypass in @hulumi/policies before 1.3.2 permits unauthenticated remote attackers to submit forged SecureBucket parent evidence, causing the validator to incorrectly classify unsafe bucket configurations as compliant and bypass associated security controls. The flaw (internally tracked as HULUMI-H1) exists because the validator did not correlate submitted evidence against the expected component-to-resource relationship, allowing fabricated evidence to satisfy policy checks. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 1.3.2.
Incomplete CloudTrail event-selector tampering detection in @hulumi/baseline before 1.3.2 (CWE-778: Insufficient Logging) creates blind spots in AWS audit trail monitoring, allowing threat actors who have already modified CloudTrail event selectors to evade detection by the library's checks. The affected npm package misses specific forms of event-selector manipulation, reducing coverage for changes to audit logging configuration - a technique commonly used to suppress evidence of adversarial cloud activity. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the risk is real for security teams relying on this package as a primary CloudTrail integrity control.
Path traversal in Dokploy's Traefik configuration handler exposes all versions through 0.29.7 to arbitrary file read and write by low-privileged authenticated remote users. The vulnerable function `writeTraefikConfigInPath` in the Settings component fails to sanitize the `path` argument before writing Traefik proxy configuration, enabling attackers to escape the intended directory and interact with sensitive files on the host filesystem. A public exploit is available and the vendor did not respond to responsible disclosure, leaving no official patch in place.
XML external entity injection across three document parsers in YaCy Search Server through version 1.941 enables unauthenticated network attackers to exfiltrate arbitrary local file contents via the search crawler. When the YaCy crawler fetches attacker-controlled SVG, FreeMind, or OpenSearch XML documents containing malicious DOCTYPE SYSTEM entity declarations, the unprotected SAX parsers resolve those entities and write the referenced file contents directly into the searchable index. No public exploit code or active exploitation has been confirmed at time of analysis, but a patch commit is available upstream and the XXE technique is trivially reproducible.
Authentication bypass in Pangolin before 1.22.0 allows any attacker holding a single valid share link - for any resource, in any organization - to authenticate against arbitrary protected resources by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that causes the token verification call to omit the expected resource identifier. All configured authentication layers are bypassed simultaneously, including SSO, resource passwords, PIN codes, email allowlists, and header authentication. CVSS 4.0 scores this 8.6 (High); no public exploit or CISA KEV listing has been identified at time of analysis, but the low exploitation bar - one share link from any resource - makes this a realistic threat in multi-tenant or multi-organization deployments.
Arbitrary code execution in Hulumi before v1.3.2 is possible through a CWE-426 untrusted search path flaw in the threat-model helper script resolution. When workspace-controlled files shadow the intended helper script, any subsequent local skill execution loads the attacker-placed file instead, running arbitrary code under the victim user's context. No KEV listing or public exploit has been identified, but the low-complexity local attack vector makes this a credible risk in shared or CI-driven development environments.
Stored XSS in the Helix Ultimate Joomla extension (versions before 2.2.10) allows authenticated administrators to plant persistent malicious JavaScript through MegaMenu layout configuration fields, which subsequently executes in the browsers of all site visitors who load affected pages. Column and item configuration values within the MegaMenu layout JSON were persisted and rendered without complete contextual escaping, enabling injection of arbitrary HTML and script payloads. The vendor has released version 2.2.10 with stricter sanitization via Joomla's InputFilter and PHP's htmlspecialchars; no public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Zip Slip path traversal in Wallos's database restore endpoint allows an authenticated administrator to write arbitrary files - including PHP webshells - directly into the application webroot. The flaw exists in POST /endpoints/db/restore.php, where ZipArchive::extractTo() processes ZIP entries without sanitizing ../ sequences, enabling directory escape before any extension-based filtering runs. An admin who uploads a crafted ZIP with an entry like logos/../../endpoints/shell.php achieves remote code execution on the server. No public exploit or CISA KEV listing has been identified at time of analysis; however, the technique is well-understood and the attack is low-complexity once admin credentials are held.
SSRF via admin-configurable OIDC endpoint URLs in Wallos subscription tracker allows an authenticated admin to direct the server to issue arbitrary outbound HTTP requests, including to cloud provider metadata services and internal network hosts. All Wallos releases prior to 4.9.6 are affected; the OIDC callback handler at includes/oidc/handle_oidc_callback.php:18-49 passes admin-supplied token_url and user_info_url directly to curl_init() without the validate_webhook_url_for_ssrf() protection already applied to logo and webhook URL fields. No public exploit has been identified at time of analysis, and a confirmed vendor patch is available in v4.9.6 released 2026-06-22.
SQL injection in the Charitable WordPress donation plugin (versions <= 1.8.12.1) allows authenticated subscriber-level users to query the underlying database beyond the plugin's own data scope, yielding high confidentiality impact with scope change. The vulnerability requires only a low-privilege WordPress account, which on sites permitting public user registration is trivially obtainable. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and network accessibility make this a credible risk for any WordPress site running the affected plugin with open registration.
Local privilege escalation in ieungSoft Ultra RAMDisk Pro 1.82 allows a low-privileged local user to gain SYSTEM or kernel-level control via improper privilege management in the URDSCSI.sys kernel driver (CWE-266). The vendor did not respond to coordinated disclosure, leaving no official patch; a public proof-of-concept exploit exists, confirmed by the CVSS 4.0 E:P metric and a detailed write-up. No active exploitation has been confirmed in CISA KEV, but the low exploitation barrier (low-privilege local access, no interaction, public PoC) makes this a credible post-compromise escalation tool.
Stored XSS in ash_admin's relationship typeahead components allows an attacker with low-privilege record-creation access to execute arbitrary JavaScript in an administrator's browser. Affected are ash_admin versions 0.13.0 through 1.3.1, where the `RelationshipField` and `ManagedRelationshipSelectField` components render database record label fields unescaped via `Phoenix.HTML.raw/1` after applying search-term highlight markup. A crafted label such as `<img src=x onerror=...>` persists in the database and fires whenever an admin's typeahead dropdown displays the matching record, granting the attacker full admin-level privileges over everything AshAdmin exposes. No public exploit code has been identified at time of analysis; a vendor-released patch is available in version 1.3.1.
Arbitrary file write via path traversal in AshAdmin's file upload handler affects versions 0.13.7 through 1.3.0, enabling any authenticated admin user to write attacker-controlled bytes to any filesystem path writable by the BEAM process. The root cause is that browser-supplied filenames are concatenated into upload paths via Elixir's Path.join/1 without stripping directory components, so a crafted filename such as ../../../../var/www/app/priv/static/evil.ex escapes the randomized temp directory. No public exploit has been identified at time of analysis, but the primitive directly enables remote code execution by overwriting application modules, static assets, cron jobs, or SSH authorized_keys files.
Cookie shadowing via unanchored regex in AshAdmin (versions 0.9.1-1.3.0) allows an attacker who controls a sibling subdomain to inject state cookies that rebind an administrator's LiveSocket session to an arbitrary actor, tenant, or authorization mode - effectively bypassing the admin panel's authorization controls. The client-side JavaScript cookie parser used `new RegExp(name + "=([^;]+)")`, which matches any cookie whose name merely ends with the target name, enabling a shadowing cookie (e.g., `xactor_authorizing` over `actor_authorizing`) set from a sibling subdomain with `Domain=.example.com` to silently win. No public exploit or CISA KEV listing exists at time of analysis, but the integrity impact is high for any multi-subdomain deployment.
Server-Side Request Forgery and structured file disclosure in oasdiff-action prior to version 0.0.51 allows unauthenticated remote attackers to make the GitHub Actions runner fetch arbitrary URLs or read filesystem paths by embedding malicious `$ref` entries in an attacker-controlled OpenAPI spec. The vulnerability is directly exploitable via fork pull requests on public repositories, requiring no interaction from maintainers beyond the normal CI workflow execution. No public exploit has been identified, but the fix PRs (128-130) provide a clear technical blueprint of the attack surface.
Atom table exhaustion in ash_admin's Phoenix LiveView event handlers allows any authenticated user reaching the admin interface to crash the entire BEAM VM node. Two handlers - AshAdmin.PageLive's set_actor and AshAdmin.Components.Resource.Show's calculate - passed unvalidated client strings directly to Module.concat/1 and String.to_atom/1 respectively, minting a permanent new atom per unique request. Because BEAM atoms are never garbage collected and the table is capped at roughly one million entries, flooding either handler terminates the VM and takes down every Elixir application co-hosted on the node. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; patch version 1.3.1 is available.
TLS certificate verification is disabled by hardcoded `rejectUnauthorized: false` in Nodemailer's internal HTTPS fetch client (lib/fetch/index.js), exposing OAuth2 token exchanges to machine-in-the-middle interception in all versions prior to 8.0.8. Any attacker with a MITM position on the network path between a Nodemailer-based application and its OAuth2 token endpoint can silently capture OAuth client secrets, refresh tokens, and access tokens from connections that appear valid to the application. A reporter-verified proof-of-concept demonstrating the full interception flow against a self-signed HTTPS OAuth endpoint exists; no confirmed active exploitation in CISA KEV at time of analysis.
Path traversal in Kirby CMS's media handler exposes arbitrary .json file existence and potentially image file contents to remote unauthenticated attackers on affected server configurations. The vulnerability exists in two code paths - Media::thumb() in src/Cms/Media.php and the file::version path in src/Filesystem/Asset.php - both of which failed to reject URL-encoded slash characters or literal ../ sequences before resolving paths relative to validated media directories. Fixed in versions 4.9.5 and 5.5.2; no public exploit code has been identified at time of analysis, and CISA KEV listing is absent.
Wallos prior to 4.9.4 exposes its database import endpoint at endpoints/db/import.php with no authentication, allowing a remote unauthenticated attacker to fully replace the application's SQLite database on any fresh or unconfigured instance. The sole guard - a user-table row count of zero - is a setup-state check, not a security control, meaning any newly deployed Wallos instance is vulnerable before the first administrator account is created. No public exploit has been identified at time of analysis, and the issue is patched in v4.9.4 (use v4.9.5, as the v4.9.4 container image is broken).
Server-side request forgery in Wallos prior to version 4.9.6 enables authenticated users to force the server's PHPMailer instance to connect to any attacker-specified host and port by supplying crafted smtpaddress and smtpport values to the test email notification endpoint. The flaw is a coverage gap - every other notification endpoint applies the application's ssrf_helper.php guard, but testemailnotifications.php was omitted. An authenticated attacker can probe internal network services and query cloud metadata APIs such as AWS IMDSv1, potentially harvesting cloud credentials. No public exploit or CISA KEV listing is identified at time of analysis; a vendor patch is available as v4.9.6.
Incomplete patch coverage in Wallos, the self-hosted subscription tracker, leaves a second unauthenticated logo-search endpoint (`endpoints/payments/search.php`) vulnerable to SSRF via HTTP proxy header injection - an oversight from the fix for CVE-2026-33407. Wallos prior to 5.0.0 passes the `HTTP_PROXY`/`HTTPS_PROXY` environment variable directly into cURL's `CURLOPT_PROXY`, allowing any unauthenticated network attacker to force the server's outbound HTTP requests through an attacker-controlled proxy. No active exploitation is confirmed (not in CISA KEV) and no public POC is referenced in available data, but the attack requires no credentials and no special configuration.
Cross-organization data exposure in ToolJet before v3.16.208 allows any authenticated user to read table schemas and row data belonging to other tenant organizations by supplying arbitrary organization IDs in URL parameters to database read routes. The flaw represents a complete collapse of multi-tenant isolation: attackers can enumerate tables, retrieve column definitions, and execute join queries against victim organization data without triggering any authorization error. No public exploit has been identified at time of analysis, but exploitation requires nothing beyond a valid user account and knowledge of basic HTTP request manipulation.
Cross-workspace privilege escalation in ToolJet Database before v3.16.44 enables any authenticated user to read database tables belonging to arbitrary workspaces by supplying victim workspace identifiers in the join_tables endpoint request path. The endpoint grants JOIN_TABLES capability to all authenticated users without validating role membership or workspace affiliation, breaking ToolJet's multi-tenant isolation entirely. No public exploit or CISA KEV listing has been identified, but the CVSS 4.0 score of 8.2 reflects high confidentiality impact across both the vulnerable and subsequent systems in shared deployments.