Missing authentication on the DownloadPublic endpoint in sdcb chats through version 1.12.0 exposes signed file downloads to unauthenticated remote access, representing a CWE-306 failure in the .NET FileController. The flaw is network-exploitable but carries a CVSS 4.0 score of 2.9 due to high attack complexity and limited confidentiality impact. A proof-of-concept exploit has been publicly released, and the vendor has not responded to disclosure, leaving no official patch available.
Session cookie exposure in sambitraj's Student-Management-System allows attackers to steal session tokens via client-side JavaScript due to the absence of the HttpOnly flag in the `session_start` function. All commits up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5 are affected, and no vendor patch exists as the maintainer has not responded to the responsible disclosure. A publicly available proof-of-concept exists, though exploitation requires high attack complexity and a co-present XSS vector to materialize as a session hijack.
Command injection in TOTOLINK NR1800X firmware 9.1.0u.6681_B20230703 allows network-accessible attackers with low-privilege credentials to execute arbitrary OS commands by manipulating the 'ussd' parameter in the setUssd function exposed via /cgi-bin/cstecgi.cgi. A proof-of-concept exploit has been publicly released on GitHub, lowering the skill threshold for exploitation. On embedded router firmware, CGI processes typically run with root or near-root privileges, meaning successful exploitation likely yields full device control - a substantially higher real-world impact than the provided CVSS 4.0 score of 2.1 suggests.
Heap-based buffer overflow in FLVMeta versions up to 1.2.2 allows remote attackers to trigger a crash via a crafted FLV file that manipulates the length argument passed to amf_string_new() during AMF string processing. A public proof-of-concept exists, but the CVSS 4.0 score of 2.1 reflects the strictly limited impact - low-severity availability disruption only, with no confidentiality or integrity consequences. The project maintainer has publicly disputed that the reported bugs are practically exploitable, further tempering the real-world risk assessment.
Reflected cross-site scripting in yaojingang GEOFlow through version 2.1.0 allows remote, unauthenticated attackers to inject arbitrary JavaScript via the Search argument in the JSON-LD Theme Handler (app/Http/Controllers/Site/HomeController.php). Exploitation requires passive user interaction - a victim must follow a crafted link - limiting the attack to phishing and session-hijacking scenarios. A public proof-of-concept has been disclosed via GitHub issue #60, and vendor-released patch v2.1.1 is available.
Arbitrary file deletion in SeaCMS up to version 13.6 is achievable by authenticated remote users through the Avatar Upload component's password-change handler, where the `oldpic` parameter is passed unsanitized to PHP's `unlink()` function. A publicly available proof-of-concept exploit hosted on GitHub demonstrates the technique against the `/member.php?action=chgpwdsubmit` endpoint, lowering the barrier for exploitation to any account holder. While the CVSS 4.0 score of 2.1 reflects limited impact - file deletion only, no data exfiltration - deletion of configuration, credential, or application files could cascade into more severe outcomes than the base score implies; no public exploit identified at time of analysis has been confirmed as actively exploited (CISA KEV).
Path traversal in SeaCMS up to version 13.6 enables authenticated remote attackers to delete arbitrary files by injecting directory traversal sequences into the `itype` or `vid` parameters of the Comment Cache deletion endpoint `/member.php?action=del_pl`. A public proof-of-concept exploit is documented in a GitHub security advisory, lowering the barrier to exploitation. While not confirmed in CISA KEV, the combination of network reachability, low privilege requirement, and public POC elevates practical risk for exposed SeaCMS deployments beyond what the medium CVSS score alone suggests.
Use-after-free in Systerel S2OPC OPC UA stack up to version 1.7.3 allows remote low-privileged attackers to crash the OPC UA server by supplying a crafted EventFilter argument to the subscription monitored-item handler, resulting in a denial of service against industrial communication endpoints. No confirmed active exploitation (not in CISA KEV), though a proof-of-concept is publicly available per the referenced GitLab work item, materially lowering the exploitation barrier. In OT/ICS environments, even a VA:L crash impact can carry significant operational consequences by halting process monitoring or control communications.
Reflected cross-site scripting in SeaCMS up to version 13.6 allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session via the `errtxt` parameter of `/err.php`. Exploitation requires social engineering to deliver a crafted URL to a target user; no privileges or prior authentication are needed. A public proof-of-concept exploit exists on GitHub, raising the likelihood of opportunistic abuse against sites running unpatched SeaCMS installations.
Stored cross-site scripting in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to inject persistent JavaScript via the last_name parameter of /register.php during user registration. When an administrator or privileged user subsequently views the registered user list, the stored payload executes in their browser context, enabling session hijacking or credential theft. A public proof-of-concept is available on GitHub; the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited real-world scope.
Information disclosure in vidIQ Vision for YouTube Extension 3.199.0 on Chrome exposes YouTube video frame captures to any web page able to send crafted postMessage events. The extension's window.addEventListener handler processes incoming messages without validating the sender origin, allowing a remotely-hosted malicious page to exfiltrate frame capture data by manipulating the vidiqEvent argument. No patch is available - the vendor has explicitly stated they do not accept vulnerability submissions and operate no bug bounty program - and a public proof-of-concept exploit is available on GitHub.
Out-of-bounds read in Kamailio's IMS AVP handler exposes telecom infrastructure to remote memory disclosure and potential service disruption. The `get_4bytes()` function across five IMS modules - `ims_auth`, `ims_icscf`, `ims_registrar_scscf`, `ims_charging`, and `ims_ocs` - fails to validate that Diameter AVP data buffers contain at least 4 bytes before reading, allowing a remote attacker with low-privilege Diameter interface access to trigger the flaw via a crafted malformed message. Publicly available exploit code exists per GitHub issue #4816, and the vendor has confirmed that the 5.5.0 branch is end-of-life and will receive no further security updates, compounding risk for operators running that release.
Revoked API token enforcement is absent in QuantumNous new-api up to 1.0.0-rc.15, allowing a holder of a disabled token to query read-only endpoints such as /api/usage/token/ and retrieve usage log data. The root cause (CWE-613, Insufficient Session Expiration) lies in the TokenAuthReadOnly middleware in middleware/auth.go, which skipped the disabled-token status check entirely before the patch. A public POC is available; no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the narrow, low-impact attack surface.
Improper access control in caoqianming's django-vue-admin 1.0 allows any authenticated low-privilege user to manipulate the `file_id` parameter in the `/api/file/` API endpoint, bypassing per-resource authorization checks to access or tamper with files belonging to other users. The vendor did not respond to responsible disclosure, leaving no official patch available. A publicly available proof-of-concept exploit (CVSS E:P) hosted on Google Drive substantially lowers the barrier to exploitation for any attacker with a valid account.
Improper access controls in Doccano's Bulk-Delete Endpoint allow low-privileged authenticated users to delete category type labels across projects beyond their authorized scope, affecting all versions through 1.8.5. The vulnerability resides in the LabelList function at the /v1/projects/1/category-types REST API endpoint, where per-project authorization is not enforced during bulk-delete operations. A publicly available proof-of-concept exploit exists, and no vendor patch has been issued following disclosure; the vendor was unresponsive to coordinated disclosure.
Unrestricted file upload in diem-project/diem through version 5.1.3 exposes the Widget Editor to remote authenticated attackers who can upload arbitrary file types - including executable PHP scripts - via the media form handler dmWidgetContentBaseMediaForm.php. If uploaded files reside in a web-accessible directory without server-enforced execution restrictions, this vulnerability escalates from a file-write primitive to full remote code execution. A public proof-of-concept is available through a GitHub issue; the project has not responded to the disclosure and no patch has been released.
SQL injection in Soarkey StudentManagement (学生信息管理系统) allows authenticated remote attackers to read from or manipulate the backing database by supplying malicious input to the `cno` parameter of the `CourseDao.course_ranking()` method. All versions up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e are affected with no vendor patch available, as the project maintainer has not responded to the disclosure. Publicly available exploit code exists via GitHub issue #33, though no CISA KEV listing is present.
Improper access control in Doccano's Project Example Detail endpoint allows authenticated low-privilege users to access, modify, or otherwise interact with project annotation data beyond their authorization scope. Versions up to 1.8.5 of both the Open Source Annotation Tools and Auto Labeling Pipeline Module components are confirmed affected. A publicly available proof-of-concept exploit exists; no vendor patch has been released and the vendor did not respond to responsible disclosure, leaving deployments exposed with no official remediation path.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers to manipulate database queries via the unsanitized `ID` parameter in `/pages/inv_edit.php`. Exploitation requires a valid application account (PR:L per CVSS 4.0 vector), and a public proof-of-concept is available on GitHub, lowering the exploitation bar for any user with credentials. The vulnerability is not currently listed in CISA KEV, and the CVSS 4.0 score of 5.3 (Medium) reflects the authentication prerequisite limiting broader impact.
TubeBuddy for YouTube Chrome extension versions up to 5.8.4 by BEN Group exposes users to authentication token overwrite via an insufficiently verified redirect URL handler. The `TBGlobal.GetToken` function in `tubebuddymaster1.js` fails to validate the authenticity of data supplied through the `t`, `c`, and `r` URL parameters (CWE-345), enabling a remote attacker to overwrite the victim's stored authentication token. A public proof-of-concept exploit exists; no KEV listing has been confirmed.
Server-side request forgery in sdcb chats up to version 1.12.0 allows authenticated remote users to cause the application server to issue arbitrary HTTP requests to attacker-controlled targets via the fetch-tools endpoint in McpController. The vulnerable code path is in src/BE/web/Controllers/Users/Mcps/McpController.cs and accepts user-supplied URLs without adequate validation. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to coordinated disclosure, leaving no official patch.
Null pointer dereference in FLVMeta up to 1.2.2 causes a process crash when parsing a malformed AMF object from a crafted FLV file, resulting in denial of service. The flaw resides in `amf_object_get` (and the parallel `amf_object_set`) in `src/amf.c`, where a chained double dereference `node->next->next` executes without first confirming `node->next` is non-NULL. A public SEGV proof-of-concept exists, though the project maintainer disputes the security relevance, stating no exploitation path beyond a crash has been demonstrated. No CISA KEV listing; no public exploit identified at time of analysis beyond the crash reproducer.
Tenant isolation is broken in dibo-software diboot 3.8.0, where the `/api/iam/tenant/resource` endpoint fails to enforce access controls on the user-supplied `tenantId` argument. A low-privileged authenticated user can substitute an arbitrary tenant identifier to access or modify resource assignments belonging to other tenants - a classic authorization bypass in a multi-tenant IAM context. A public proof-of-concept exploit has been disclosed; the vendor did not respond to responsible disclosure, leaving no official patch available.
Authorization bypass in dibo-software diboot 3.8.0 exposes the AI Session Endpoint (/api/ai-session/) to insecure direct object reference (IDOR) exploitation, allowing low-privilege authenticated users to access or manipulate AI session resources belonging to other users. The flaw stems from CWE-639 (Authorization Bypass Through User-Controlled Key), where the application fails to verify that the requesting user is authorized to act on the referenced session identifier. A public exploit has been disclosed, and the vendor did not respond to early notification - no patch is available at time of analysis.
Origin validation failure in Toggl Track Extension 4.11.16's postMessage handler allows any malicious webpage to inject forged session-state messages into the extension without authentication. The exploit has been publicly disclosed on GitHub, demonstrating that an attacker can manipulate a victim's time-tracking session state simply by luring them to an attacker-controlled page. No vendor patch exists and the vendor did not respond to coordinated disclosure, leaving users with no official remediation path.
Cross-site scripting in Typora's embedded Mermaid rendering engine allows remote attackers to inject and execute arbitrary JavaScript by manipulating the `classDef` or `style` arguments within Mermaid diagram syntax. Affected versions include all Typora releases up to 1.13.8 and 1.14.6; a publicly available proof-of-concept exploit exists on GitHub. Exploitation requires passive user interaction (opening or previewing a crafted file), and no authentication is needed from the attacker, making social-engineering delivery via shared documents or email a realistic threat vector. No active exploitation is confirmed in CISA KEV at time of analysis.
Path traversal in yaojingang GEOFlow's Image Library Cleanup component allows remote authenticated administrators to delete arbitrary server files by supplying crafted directory-traversal sequences in the `file_path` argument to the PHP `unlink()` function within `ImageLibraryController.php`. All versions up to 2.1.0 are affected (CPE: cpe:2.3:a:yaojingang:geoflow:*:*:*:*:*:*:*:*), with a publicly available proof-of-concept on GitHub issue #60. No CISA KEV listing exists, and the admin-only requirement (PR:H per CVSS 4.0) constrains real-world impact, but the public POC makes patching urgent for any exposed instance.
Code injection in yaojingang GEOFlow versions up to 2.1.0 allows a remote superadmin to execute arbitrary PHP on the server by submitting a malicious Blade template payload to the preview function of the Superadmin Theme Editor (SiteThemeEditorController.php). A publicly available proof-of-concept exploit has been disclosed via GitHub issue #60, and the attack requires no user interaction beyond the attacker's own authenticated session. Vendor-released patch version 2.1.1 resolves the issue; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Server-side request forgery in yaojingang GEOFlow up to 2.1.0 allows high-privileged authenticated attackers to make the application server issue arbitrary outbound HTTP requests by supplying a crafted value to the endpoint_url argument of DistributionController.isValidHttpEndpoint in GenericHttpEndpointResolver.php. The vulnerability carries a very low CVSS 4.0 score of 2.0 due to the PR:H requirement, limiting realistic attacker population to those already holding elevated application credentials. A public exploit has been disclosed via GitHub issue #60, though no active exploitation has been confirmed by CISA KEV.
Stored cross-site scripting in code-projects Employee Leave Managing System 1.0 allows an authenticated low-privilege employee to inject persistent malicious script via the Name parameter in the Employee Profile Update endpoint (/EmpManageSys/editaction.php). When a privileged user such as an HR administrator subsequently views the tampered employee profile, the payload executes in their browser, enabling session hijacking or unauthorized administrative actions. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists, so confirmed in-the-wild exploitation is not established at time of analysis.
OS command injection in Edimax BR-6214K firmware 1.40 allows an authenticated administrator to execute arbitrary commands on the router's underlying embedded OS by supplying shell metacharacters in the `pingstr` argument of the `asp_setPing` web endpoint. A public proof-of-concept exploit has been released on GitHub, and the vendor has not responded to disclosure nor issued a patch. Despite the low CVSS 4.0 score of 2.0 - driven entirely by the PR:H authentication requirement - successful exploitation yields root-level command execution on the device, making the practical impact significantly higher than the score suggests for any attacker who already possesses admin credentials.
OS command injection in Edimax BR-6214K firmware version 1.40 allows a remote authenticated administrator to execute arbitrary operating system commands by supplying a crafted value to the ateFunc parameter of the wlanMP.asp endpoint, which passes it unsanitized to a system() call. A public proof-of-concept exploit is available on GitHub, lowering the skill barrier for post-authentication exploitation. No vendor patch exists and the vendor did not respond to disclosure; no CISA KEV listing means active exploitation has not been confirmed by US government sources, though the unpatched status combined with public PoC availability elevates near-term risk.
Cleartext password storage in sambitraj's Student Management System exposes user credentials to privileged attackers who can access the database or application backend. The flaw resides in aca.sql within the Password Handler component, where passwords are persisted without hashing or encryption. A proof-of-concept has been publicly disclosed via a GitHub issue, though exploitation requires high-privilege access, keeping real-world risk low despite the sensitive nature of the exposed data.
OS command injection in the Diem CMS Administrative Console (diem-project/diem ≤ 5.1.3) allows authenticated administrators to execute arbitrary operating system commands on the host server via the unsanitized `dm_command` argument of the `executeCommand` function in `dmAdminPlugin/modules/dmConsole/actions/actions.class.php`. Publicly available exploit code exists via GitHub issue #447, and the project maintainers have not responded to the responsible disclosure report. The vulnerability is not in CISA KEV, but the unpatched status combined with available exploit code elevates urgency for any organization still running this abandoned software.
Memory corruption in LatencyUtils 2.0.3 and earlier allows a local low-privileged user to cause availability disruption by manipulating input to the `LatencyStats.recordDetectedPause` function in the PauseDetector component. A public proof-of-concept has been disclosed via a GitHub issue, and the project maintainers have not responded to the disclosure, leaving the library without an upstream fix. The CVSS 4.0 score of 1.9 and availability-only impact (VA:L) reflect a tightly scoped, low-severity flaw with no confidentiality or integrity consequences and no confirmed active exploitation.
Information disclosure in extension.vn 2FA Authenticator Extension 1.0.0.2 for Chrome exposes stored TOTP secrets via an unvalidated external message listener. The Background Service Worker's `chrome.runtime.onMessageExternal.addListener` handler fails to verify the `sender.id` field, meaning any other locally-installed Chrome extension can send a crafted message and receive TOTP seeds in response. A public proof-of-concept exploit exists; exploitation is constrained to local access with low-privilege conditions per the CVSS 4.0 vector (AV:L/PR:L), and no active exploitation has been confirmed.
Double-free memory corruption in Valkey 9.1.0's Module Timer Subsystem allows a high-privileged remote attacker to crash the server by triggering a self-stopping timer callback pattern. The moduleTimerHandler function in src/module.c frees the timer object both inside the callback (via ValkeyModule_StopTimer) and again after callback return, causing a double-free. A public proof-of-concept has been disclosed via GitHub, though the CVSS 4.0 score of 1.9 reflects that exploitation requires high-privilege module control, severely constraining real-world impact to low-severity availability disruption.
Use-after-free in Valkey 9.1.0's blocked-on-keys subsystem allows a high-privilege authenticated attacker to crash the server by triggering a reentrant client teardown during ready-key iteration. When a key becomes ready and multiple clients are unblocked simultaneously, a reply callback for the first-served client can invoke CLIENT KILL on a successor client, freeing that client's memory while the iterator in `handleClientsBlockedOnKey` still holds a reference to it. A public proof-of-concept exists; the vulnerability is not in CISA KEV, and the high complexity and privilege requirements substantially limit practical exploitation.
Server-Side Request Forgery in Wallos prior to version 5.0.0 allows any authenticated low-privileged user to store an arbitrary SMTP host - including private RFC 1918 addresses and cloud metadata endpoints - in their personal email notification settings without server-side validation. When the scheduled notification cron job fires, the Wallos server opens an outbound TCP connection to the attacker-specified address, giving the attacker a reliable blind SSRF primitive to probe internal network services from the server's network vantage point. No public exploit is identified at time of analysis, and no active exploitation is confirmed by CISA KEV.
HCL Connections exposes sensitive information to unauthorized users through improper handling of request data, classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The vulnerability affects all tracked versions per the wildcard CPE and is exploitable over the network, though high attack complexity (AC:H) and required user interaction (UI:R) substantially constrain real-world exploitability. No public exploit code or active exploitation has been identified at the time of analysis, and the CVSS score of 3.1 reflects the limited confidentiality impact and constrained attack prerequisites.
Race condition in Zephyr RTOS's I3C IBI workqueue subsystem allows a physically-present attacker controlling an I3C peripheral to corrupt kernel memory structures, most realistically causing denial of service. The unsynchronized free-list (sys_slist_t) shared between ISR context and the workqueue handler thread creates a window where a work node can be handed to two consumers simultaneously or a garbage pointer can be dereferenced in a memcpy, producing an out-of-bounds write. No public exploit code has been identified and no CISA KEV listing exists; the patch wrapping all free-list operations in a k_spinlock is confirmed in upstream commit e87e7e2.
Cross-tenant authorization bypass in ToolJet before v3.16.208 allows any authenticated Builder-role user to access and manipulate database tables belonging to unrelated organizations by supplying arbitrary organizationId values in tooljet-db API path parameters. Server-side validation of tenant membership is entirely absent on schema operation endpoints, enabling an attacker to enumerate target organization IDs from public app endpoints and then disclose table schemas, plant rogue tables, corrupt existing schemas, or permanently destroy data across tenant boundaries. No public exploit has been identified at time of analysis, but the underlying IDOR technique is trivially reproducible using standard HTTP tooling.
Command injection in the D-Link DIR-825M router (firmware 1.1.8) allows network-adjacent authenticated attackers to execute arbitrary OS-level commands by manipulating the `sysCmd` argument submitted to the `/boafrm/formSysCmd` endpoint, processed by function `sub_456CF4` without sanitization. A public proof-of-concept exploit exists and was published alongside the VulDB disclosure. The provided CVSS 4.0 score of 2.1 appears to severely understate the real impact - command injection in a router's System Command Execution interface typically yields full OS compromise, not low-severity system impact.
Sensitive form parameters leak into server logs, crash reports, and the Phoenix development error page in ash_phoenix versions 1.2.17 through 2.3.24, where AshPhoenix.Form.Auto embeds the complete raw submitted param map verbatim into exception messages when a union sub-form receives an unrecognized _union_type value. Because the exception is raised inside library code rather than Phoenix's controller layer, the standard :filter_parameters configuration cannot redact the exposure-any field co-submitted with the union form field, including passwords and tokens, appears in plaintext in the raised message. No public exploit has been identified at time of analysis, but any user capable of submitting a form with a union field can deliberately trigger the leak regardless of intent.
FilterForm in ash_phoenix (versions 0.6.0-rc.1 through 2.3.24) exposes private relationship data to authenticated users by resolving attacker-controlled filter path parameters through private Ash relationship traversal rather than the public-only gate. By supplying crafted path or field form values targeting non-public relationships, an authenticated attacker converts query result row counts into a boolean oracle over data the resource author explicitly marked private. The CVSS 4.0 score is 2.3 (Low); no active exploitation is identified and no public proof-of-concept exists at time of analysis.
Composite primary key decoding in AshAdmin (ash_admin) versions 0.1.0 through 1.3.0 can be abused by authenticated users to turn any record-lookup URL into an equality oracle over arbitrary resource attributes. By crafting a Base64+ETF-encoded payload substituting a sensitive field name (e.g., api_token, reset_token) for an actual primary key, an attacker can brute-force secret attribute values one equality guess at a time. No public exploit has been identified at time of analysis, and exploitation requires authentication and specific preconditions (CVSS 4.0: 2.3, AT:P).
AshAdmin shipped a compile-time constant string ('ash_admin-Ed55GFnX') as the default CSP nonce for inline script and style tags across all requests in versions 0.10.8 through 1.3.0, rendering nonce-based Content-Security-Policy enforcement completely ineffective for any application using the default configuration. Applications that adopted the documented default and explicitly allow-listed this published constant in their CSP script-src directive would have their CSP protection neutralized by any attacker able to inject HTML into an admin page. No active exploitation or public proof-of-concept has been identified; the CVSS 4.0 score of 2.1 reflects significant compound preconditions required for exploitation.
Improper access control in dibo-software diboot 3.8.0 allows authenticated remote attackers to bypass tenant isolation by manipulating the tenantId parameter in the Tenant Administrator Management API at /admin/. An attacker with low-privileged access to one tenant can read and modify data belonging to other tenants, breaking the multi-tenant security boundary. A public proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving users without an official patch.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the `ID` parameter in `/pages/inv_searchfrm.php`. Publicly available proof-of-concept exploit code exists (CVSS 4.0 supplemental metric E:P), though the product's tutorial and educational origins on itsourcecode.com severely limit any real-world production exposure. The CVSS 4.0 score of 2.1 reflects the authenticated prerequisite and low impact across confidentiality, integrity, and availability.
Cross-site scripting in @pdfme/schemas before 5.5.10 allows an attacker who can supply the Designer's options.labels configuration to execute arbitrary JavaScript in the browser of any user who opens the Designer and selects a multiVariableText field containing no variable placeholders. The vulnerable sink at propPanel.ts:65-71 concatenates i18n-translated strings directly into innerHTML without HTML encoding; while the adjacent color value is allowlist-validated (showing existing security awareness), the label strings were overlooked. No active exploitation is confirmed, but a proof-of-concept is published in the GHSA advisory. The CVSS 4.0 score of 2.1 reflects multiple required preconditions: attacker control over labels configuration, a specific UI trigger state, and passive victim interaction.