Path traversal in Vitest's interceptorPlugin exposes local files on any development server with a network-accessible HMR WebSocket. The `vitest:interceptor:register` handler in `packages/mocker/src/node/interceptorPlugin.ts` accepts redirect mock registrations over Vite's unauthenticated HMR socket without calling `isFileLoadingAllowed()`, allowing a remote unauthenticated attacker who can reach the dev server to submit opaque-scheme URLs (e.g., `traversal:../../../etc/passwd`) whose `..` segments survive `URL.pathname` parsing and resolve outside the project root via `path.join()`. The plugin's `load` hook then returns `readFile(mock.redirect, 'utf-8')` as JavaScript module source, disclosing any file readable by the dev-server process. No public exploit or CISA KEV listing has been identified, but the GitHub fix PR includes a complete, working e2e test that serves as a functional PoC.
Cache poisoning and stored XSS in Hono (all versions before 4.13.5) stem from the framework's query helpers treating a literal `#?` sequence as a query string, creating a parser discrepancy between the application and every other layer - browsers, reverse proxies, WAFs, access logs, and validation middleware - that correctly ignores fragments. The Cache Middleware compounded this by stripping fragments when building cache keys, so a response shaped by fragment-injected parameters gets stored and served to subsequent users under a key that omits those parameters entirely. No public exploit code has been identified at time of analysis, and exploitation is gated by the requirement that the runtime and intermediary pass raw `#` characters through to the application.
Information disclosure in HPE AOS-CX exposes sensitive API endpoint data to a remote unauthenticated attacker who can achieve a man-in-the-middle position on the network path. Intercepted data could include credentials, session tokens, or configuration material usable to further compromise the affected switch or pivot into managed network infrastructure. This CVE is part of a broader HPE advisory (hpesbnw05134) covering at least four additional AOS-CX vulnerabilities; no public exploit code and no CISA KEV listing have been identified.
HTTP Request Smuggling in Elasticsearch allows a network attacker to intercept confidential HTTP responses intended for other authenticated users when Elasticsearch is deployed behind certain proxy configurations. The vulnerability (CWE-444, CAPEC-33) arises from inconsistent HTTP request boundary interpretation between the intermediary proxy and Elasticsearch, enabling response queue poisoning that leaks data across user sessions. Vendor-released patches 8.19.20, 9.4.5, and 9.5.1 are available per ESA-2026-141; no public exploit code or CISA KEV listing has been identified at time of analysis.
Persistent record-level denial of service in the ash Elixir resource framework (versions 3.6.3-3.32.1) lets any actor who can write a non-version-7 UUID into an Ash.Type.UUIDv7 attribute permanently break all subsequent reads of that database row. The root cause is a validation asymmetry introduced in v3.6.3: cast_input/2 was tightened to reject non-v7 16-byte binaries, but cast_stored/2 continued delegating to cast_input/2, so a stored non-v7 binary now returns :error on every read. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; vendor-released patch v3.32.2 is available.
Integer overflow in Ash Framework's vector encoding corrupts stored vectors in any Elixir application using Ash versions 2.14.13 through 3.32.1, enabling persistent denial of service against affected database records. The dimension count for a vector submitted with more than 65,535 elements silently wraps modulo 65,536 in a 16-bit header field, causing every subsequent read of the corrupted record to raise an exception. Applications that expose vector ingestion to untrusted users are at risk of permanent per-record data loss; no public exploit has been identified at time of analysis.
CPU exhaustion in Ash Framework's string type constraint handler allows denial of service against Elixir applications that use Ash string attribute validation with both length and regex match constraints. The `Ash.Type.String.apply_constraints/2` function evaluated the `:match` regex unconditionally, even when a length constraint had already failed, allowing attacker-controlled input of arbitrary size to reach the regex engine directly. Against backtracking patterns this produces catastrophic exponential evaluation time; against linear patterns, CPU cost scales with input size, enabling sustained per-request service degradation. No public exploit has been identified at time of analysis.
Memory exhaustion in Ash Framework's runtime filter engine allows an attacker controlling filter inputs to crash an Elixir node by submitting a query that spans multiple to-many relationships against large in-memory datasets. The vulnerable `flatten_relationships/2` function in `lib/ash/filter/runtime.ex` (versions 1.29.0-rc0 through 3.32.2) eagerly materializes the full Cartesian product of related rows before evaluating any predicate, producing O(M^K) intermediate records for K relationships with M rows each. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 3.32.2.
Silent record overwrite in Ash's ETS and Mnesia data layers allows any actor who can supply a primary key on a create action to replace an existing record without triggering update action authorization policies. Versions 0.4.0 through 3.32.1 are affected; only deployments using the ETS or Mnesia data layer - not SQL-backed layers - are vulnerable. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the integrity impact is high for applications that expose user-controlled primary key creation.
Record-level authorization bypass in Ash (ash-project) versions 3.4.44 through 3.32.1 silently leaks denied records to any actor when resources use access_type :runtime read policies. A logic error in Ash.Policy.Authorizer.check_result/1 causes the empty-scenario branch - reached when all policy paths for a record are impossible and the record must be forbidden - to instead keep and return the record as authorized. No public exploit has been identified at time of analysis; the vendor confirmed the issue and released a fix in version 3.32.2.
Incorrect authorization in ash-project/ash (Elixir data framework) versions 3.13.2 through 3.32.1 causes relationship scoping filters that reference parent() expressions to silently widen when the parent field cannot be resolved. The function resolve_parent_in_filter/3 defaulted the unresolvable expression to nil rather than failing, converting a guard such as org_id == parent(org_id) into an org_id IS NULL match, or activating the unrestricted branch of is_nil(parent(org_id)) or org_id == parent(org_id), thereby returning records the scope was designed to exclude. No public exploit has been identified at time of analysis; a vendor-released patch is available in ash 3.32.2.
Authorization policy bypass in Ash (Elixir framework) versions 3.29.0-3.32.1 permits any application actor to modify records protected by resource policies when using the atomic update path. The root cause is that `Ash.Actions.Update.UpdateMany` selected the atomic strategy under `authorize?: true` without invoking the authorization layer, causing the resulting SQL MERGE to update all primary-key-matched rows without applying policy filters. No public exploit code has been identified at time of analysis, but the published patch commit and GHSA advisory provide sufficient detail to reconstruct the bypass; the fix is vendor-confirmed in version 3.32.2.
Unauthenticated remote exploitation of the discoverWan function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes WAN configuration data through a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The CWE-284 (Improper Access Control) root cause means the CGI handler performs no authentication check before executing WAN discovery logic, returning configuration details to any network-reachable caller. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network exposure on consumer router hardware makes this a meaningful reconnaissance risk.
Unauthenticated firmware-flash triggering in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows network-accessible attackers to initiate a firmware re-flash cycle by sending crafted MQTT messages to the cs_broker component targeting the meshSlaveUpgfw handler, without any credentials. The root cause is a missing access-control check in the mesh slave upgrade function, enabling any caller on the MQTT network segment to invoke privileged firmware operations. No public exploit code has been identified and CISA SSVC rates exploitation as none with no current KEV listing, but the unauthenticated network vector represents a meaningful operational risk.
Unauthenticated integrity manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to overwrite the master device's stored slave inventory records by sending crafted MQTT messages to the cs_broker component. The sendStaticInfoToMaster function performs no authentication or authorization check before processing incoming updates, exposing the internal device-management protocol to arbitrary writes. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in LibreNMS through 26.2.0 enables attackers to inject persistent malicious JavaScript via SNMP-sourced data fields - including BGP peer descriptions, VRF names, process data, and SLA tags - that execute in the context of authenticated administrators browsing legacy PHP routing and device pages. The dual attack path (device management access within LibreNMS, or network-level enrollment of a rogue SNMP device) means exploitation is not strictly confined to privileged insider accounts. Successful exploitation yields session credential theft and CSRF token exfiltration, giving the attacker effective administrative control over the monitoring platform. No public exploit has been identified at time of analysis.
Privilege escalation in HPE AOS-CX's API endpoint allows an authenticated low-privilege operator to access sensitive system information that should be restricted to higher-privilege roles, provided a required user action is completed. The CVSS vector (PR:L/UI:R/C:H/I:N/A:N) confirms this manifests as an information disclosure escalation rather than full privilege takeover - a low-privilege operator reads confidential data normally gated behind elevated roles. This CVE is part of the same HPE advisory (hpesbnw05134) as CVE-2026-73749 (unauthenticated RCE, CVSS 9.8), CVE-2026-73766 (admin command injection, CVSS 7.2), CVE-2026-73778 (default-credential auth bypass, CVSS 8.1), and CVE-2026-73782 (adjacent format-string RCE, CVSS 8.8); no public exploit has been identified at time of analysis.
Incomplete denylist in jackson-databind's DefaultBaseTypeLimitingValidator allows attacker-controlled object instantiation when an application annotates a field or class with @JsonTypeInfo using java.lang.Comparable as the declared base type and no custom PolymorphicTypeValidator is registered. Because Comparable is implemented by an enormous fraction of JDK classes, an attacker supplying crafted JSON can force the deserializer to instantiate essentially any Comparable-implementing class, with java.io.File construction for an arbitrary path demonstrated as the primary primitive. No public exploit achieving code execution has been identified, no CISA KEV entry exists, and the vulnerability is not confirmed as actively exploited.
Local information disclosure in HPE Networking Fabric Composer exposes sensitive operating-system-level data to authenticated low-privilege operator users with local system access. The CVSS Scope:Changed metric reflects that the leaked data crosses from the Fabric Composer application boundary into the underlying host OS, and HPE warns the recovered information could enable further unauthorized access to the affected system and interconnected infrastructure. No public exploit is identified at time of analysis; exploitation requires both a valid low-privilege credential and local system access, materially constraining the realistic threat population.
Improper privilege management in Cleo Harmony's JWT Refresh Token Handler allows remote unauthenticated attackers to manipulate the Bearer argument on the /api/connections API endpoint, resulting in unauthorized access to connection data and potential privilege escalation. Affected versions span all releases up to and including 5.8.1.10, with a public exploit already available (E:P per CVSS 4.0 supplemental). No active exploitation confirmed in CISA KEV, but the combination of network accessibility, zero-privilege requirement, and public proof-of-concept materially elevates real-world risk.
Pointer validation routines were systematically commented out across multiple TEE syscall handlers in Samsung's mTower open-source TEE implementation, leaving Trusted Application-supplied pointer arguments entirely unvalidated before dereference in the secure world. All mTower deployments on ARMv8-M hardware prior to commit 102d3dc75cf8e58e68e4bea54ae3c803992c91be are exposed to a denial-of-service condition whereby a malicious or buggy Trusted Application can crash the TEE by supplying address-space-wrapping pointer ranges to service calls in tee_svc.c and tee_svc_cryp.c. No public exploit has been identified at time of analysis and no CISA KEV listing exists.
Untrusted pointer dereference in Samsung mTower's Secure world entry point allows a Non-Secure world caller to supply pointer values referencing Secure RAM, causing the TEE kernel to dereference those addresses on behalf of the attacker and potentially exposing or corrupting cryptographic material and other Secure world state. All mTower deployments before commit 06994e303637512e39062f3e037c222e8448e57e on ARM Cortex-M TrustZone hardware are affected, spanning both the session-open and invoke-command paths. No public exploit code has been identified and the vulnerability is absent from CISA KEV; however, the security boundary violated - Normal World to Secure World - represents a fundamental TrustZone integrity failure with real confidentiality and integrity consequences that the provided CVSS score significantly understates.
NULL pointer dereference in Samsung mTower's TEE kernel allows a Non-Secure caller to crash the secure world by supplying an invalid, zero, or stale session ID to the ioctl invoke path. The flaw exists in tee_ioctl_invoke() (entry_std.c) and tee_ta_invoke_command() (tee_ta_manager.c), where find_session() returns NULL without a guard before dereferencing sess->ctx, causing a secure-world fault. All mTower versions prior to commit afef59aa6f55c5d5ebf9b14bc020bf1c2c37489a are affected; no public exploit has been identified at time of analysis.
Open redirect in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to craft URLs that transparently forward authenticated users to attacker-controlled destinations. The flaw targets network administrators who interact with the management console, creating a reliable phishing vector for credential harvesting against privileged accounts. No public exploit has been identified at time of analysis, and neither EPSS data nor KEV listing was provided, but the absence of authentication requirements and low attack complexity make opportunistic delivery of crafted links straightforward.
Use-after-free in Firefox's Audio/Video component exposes users running Firefox prior to version 155 and affected ESR branches to potential heap memory disclosure and limited data modification when processing attacker-controlled media. The vulnerability is network-reachable but requires user interaction - visiting a malicious or compromised page that triggers media playback - and carries a CVSS score of 5.4 reflecting bounded C:L/I:L impact with no availability loss. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment classifies exploitation status as none and the vulnerability as non-automatable.
Use-after-free in Firefox's Audio/Video media pipeline allows unauthenticated remote attackers - requiring only user interaction - to read or modify limited browser memory content. Affected releases span Firefox stable prior to 155 and both ESR tracks prior to 140.15 and 153.2, covered by three separate Mozilla security advisories (MFSA2026-82, MFSA2026-84, MFSA2026-85). No public exploit code exists at time of analysis and SSVC exploitation status is 'none,' though the CWE-416 class carries inherent escalation risk beyond the partial impact Mozilla scored.
Use-after-free in Firefox's JavaScript garbage collector (GC) component exposes users to partial memory disclosure and corruption when visiting attacker-controlled web pages. Both the standard release line (Firefox 155) and the extended support release (Firefox ESR 153.2) are patched. No public exploit or active exploitation is confirmed; SSVC exploitation status is none and the vulnerability is absent from CISA KEV.
HPE Networking Fabric Composer's API authentication controls can be circumvented by an already-authenticated low-privilege operator, allowing that user to retain access even after administrative revocation. This is an access-persistence flaw rather than an initial-access bypass - a direct insider-threat concern in environments that rely on Fabric Composer's own revocation mechanisms for offboarding or role changes. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free memory corruption in Firefox's DOM Core and HTML component allows a remote attacker to achieve limited confidentiality and integrity impact against users running unpatched Firefox versions by directing them to a crafted webpage. All Firefox releases prior to version 155, ESR 140.15, and ESR 153.2 are affected; Mozilla has shipped fixes across all three release channels. No public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Firefox's DOM Core & HTML component allows network-reachable attackers to achieve limited memory disclosure and DOM integrity impact against users running Firefox below version 155 or Firefox ESR below 153.2. Exploitation requires user interaction - a victim must visit or be redirected to attacker-controlled content - but no authentication or elevated privileges are needed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Mozilla has released patched versions addressing the flaw.
Authenticated privilege escalation in HPE Networking Fabric Composer's API allows low-privilege operator users to read limited information and make limited configuration changes beyond their authorized scope. The flaw affects all tracked versions per CPE data and requires only a valid low-privilege account to exploit - no special configuration or user interaction is needed. No public exploit code and no CISA KEV listing are present at time of analysis, keeping real-world risk moderate despite network accessibility.
Incorrect authorization in Kibana's Security Solution allows a low-privileged authenticated user to exceed their read-only role by enumerating and modifying Entity Store maintainer task states, silently disabling Entity Analytics upkeep for the affected space. The affected user requires only Security Solution read access-no write or admin privileges-yet can manipulate internal scheduling tasks that keep entity data current for threat detection. No public exploit has been identified and this is not in CISA KEV; the CVSS 5.4 (Medium) score reflects real-world scope: no data confidentiality impact, but integrity and availability of analytics maintenance are undermined.
Stored cross-site scripting in pulpcore's content serving layer allows authenticated users with file upload permissions to execute arbitrary JavaScript in the browsers of other users. When pulpcore uses local filesystem storage, uploaded files are served with their original MIME types (e.g., text/html, image/svg+xml) and without a Content-Disposition: attachment header, causing browsers to render the files inline within the host application's origin instead of prompting a download. This flaw affects Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4 and 5; no public exploit code or confirmed active exploitation is identified at time of analysis.
jackson-databind's NioPathDeserializer passes attacker-controlled URI strings from untrusted JSON through an unrestricted URI scheme resolution pipeline, allowing selection and invocation of arbitrary registered FileSystemProvider implementations at deserialization time. Affected versions span com.fasterxml.jackson.core:jackson-databind 2.8.0 through the pre-2.18.10/2.21.6/2.22.2 ranges and tools.jackson.core:jackson-databind 3.0.0 through the pre-3.1.6/3.2.2 ranges. With only JDK built-in providers present the immediate impact is a limited availability concern; with third-party FileSystemProviders such as S3 or HDFS adapters on the classpath, attackers can trigger side-effecting provider operations via crafted JSON fields. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
Authorization bypass in the Cozy Blocks WordPress plugin (all versions through 2.2.17) exposes WooCommerce product metadata intentionally hidden from the public - including names, prices, stock status, and image URLs of draft, pending, private, and catalog-hidden products - to unauthenticated visitors. The root cause is that multiple block renderers unconditionally emit a sidebarNonce into public page HTML regardless of visitor authentication state, allowing anyone to harvest a valid nonce and satisfy the AJAX handler's sole authorization check. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation mechanics are trivially simple given that the credential is embedded in publicly readable HTML.
Heap-exhaustion denial-of-service in Hono web framework before 4.13.5 allows unauthenticated network attackers to crash the JavaScript server process by submitting form requests with deeply nested or numerous dot-separated field names when dot-notation parsing is explicitly enabled. The `parseBody()` function expands dot-separated keys into nested JavaScript objects without any bound on nesting depth or total intermediate object count, allowing a normal-sized request body to produce an object graph orders of magnitude larger and exhaust the runtime heap. Exploitation causes server process termination and service outage until manual restart; no public exploit is identified at time of analysis.
Denial-of-service conditions in HPE AOS-CX's command line interface allow a low-privileged authenticated user with network access to disrupt normal system operation. Part of the broader HPE advisory hpesbnw05134 addressing multiple AOS-CX vulnerabilities, this issue targets the CLI layer - accessible over SSH - but requires high attack complexity to successfully trigger. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed.
Unauthenticated file read in HPE Networking Fabric Composer's web-based management interface exposes a subset of system files to remote attackers without requiring any credentials. The vulnerability is confined to files within a specific affected directory rather than offering arbitrary filesystem access, yielding a limited confidentiality impact consistent with the CVSS 5.3 (C:L) score. No active exploitation (KEV) or public proof-of-concept has been identified at time of analysis, and no EPSS signal is provided in available intelligence.
Broken access control in Snipe-IT before v8.7.0 allows authenticated users holding only the `assets.edit` permission to restore soft-deleted assets via the bulk restore endpoint, directly reversing administrator deletions they are not authorized to undo. The `POST /hardware/bulkrestore` handler in `BulkAssetsController` incorrectly gated on `authorize('update', Asset::class)` rather than `authorize('delete', Asset::class)`, the check used by every other restore path in the codebase. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified, but the attack surface is any authenticated edit-permission holder in an affected deployment.
Authenticated SSRF in the Heym workflow engine before v0.0.98 allows any workflow author to reach internal network services by crafting WebSocket Send or WebSocket Trigger nodes with arbitrary target URLs - bypassing the egress guard that was implemented only for HTTP nodes. Attackers can exfiltrate responses from internal services (including cloud-metadata at 169.254.169.254) and transmit crafted payloads to internal WebSocket-capable services. No public exploit has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch is available as v0.0.98.
Stored cross-site scripting in LibreNMS before 26.5.0 allows an attacker who controls any SNMP-monitored network device to inject persistent JavaScript into the LibreNMS web interface via poisoned VRF-related SNMP fields. The injected payload executes in the browser of any LibreNMS user who views VRF display pages, enabling session hijacking, credential theft, or UI redressing. No public exploit has been identified at time of analysis, though the attack surface (SNMP-fed stored XSS with network-facing ingestion) is straightforwardly exploitable for anyone with access to a monitored device.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to manipulate the router's primary station list by sending a crafted MQTT message directly to the cs_broker component. The updatePriStaList function performs no authentication check before processing requests, enabling arbitrary refresh or overwrite of station associations. A proof-of-concept exists per SSVC assessment; the attack is automatable with no user interaction required.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
SQL injection in zhongyu09 OpenChatBI allows authenticated remote attackers to manipulate queries processed by the incomplete `_validate_sql_safety` function within the text2sql pipeline. Versions 0.2.0 through 0.2.2 ship with zero SQL validation; version 0.3.0 introduced a bypassable validator, and v1.0.0b1/main retains the same incomplete logic with an optional - but non-default - stricter mode. The vendor did not respond to coordinated disclosure, leaving no official patch guidance; no public exploit code or CISA KEV listing has been identified at time of analysis.
Administrator account takeover in the Simple Membership plugin for WordPress (versions up to and including 4.8.0) is achievable by unauthenticated remote attackers targeting WordPress Multisite networks with public registration enabled. The plugin's registration flow binds new membership records to existing global WordPress users using only username and email matching - no password or ownership proof - and fails to detect Administrator roles on child sites, allowing attackers to subsequently overwrite the victim's global WordPress password via the profile-edit feature. No public exploit has been identified at time of analysis, but the attack mechanics are low-complexity and the CVSS score of 5.3 severely understates the actual Administrator-level impact.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to trigger the staticInfoSend function by sending a crafted MQTT message to the cs_broker component, causing the device to report its static configuration data to the configured master server. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the updateLanIp function to arbitrary invocation by any attacker who can reach the router's MQTT broker. By publishing a crafted MQTT message to the cs_broker component, a remote unauthenticated attacker can force the device to refresh its LAN address state, enabling network disruption without any credentials. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the zero-authentication requirement materially lowers the exploitation bar.
Cross-site scripting in Cypht webmail's contacts module (all versions before 2.12.2) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious FROM email header. The contacts module's sanitizer strips only the first occurrence of each angle bracket character, so embedding redundant brackets around a script payload bypasses the filter entirely. Exploitation requires two deliberate user actions - opening the crafted email and invoking the Add Local Contacts function - limiting opportunistic mass exploitation; no public exploit has been identified at time of analysis.
Stored cross-site scripting in WWBN AVideo's Live_schedule module allows a low-privileged attacker with streaming permission to persist unsanitized JavaScript via the setTitle() and setDescription() POST endpoints. The injected payload is served to any user - including unauthenticated visitors - who loads remindMe.php, giving the stored payload a wider execution surface than the injection privilege level implies. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects this split: low-privilege write, passive-interaction trigger, and limited per-browser impact.
HQL injection in Schneider Electric NetBotz 5 models 750 and 755 allows an authenticated attacker on the same adjacent network segment to inject malicious Hibernate Query Language statements through the appliance's web service interface or web UI, gaining limited unauthorized read and write access to the NetBotz database. The CVSS 4.0 score of 5.1 reflects a constrained attack surface - both network adjacency and a valid low-privilege account are prerequisites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.