Infinite loop denial of service in pypdf prior to 6.16.0 allows any attacker who can supply a crafted PDF to a pypdf-based write pipeline to permanently hang the processing worker. The root cause is in TreeObject.insert_child within pypdf/generic/_data_structures.py, which traverses /Next links without cycle detection; a PDF whose tree nodes form a circular reference (A→B→C→A) causes unbounded traversal. No public exploitation has been confirmed and no CISA KEV entry exists, but a functional proof-of-concept is embedded in the upstream fix PR (#3964).
TOTP app-based MFA in Filament 4.0.0-4.12.5 and 5.0.0-5.7.5 can be bypassed by replaying any previously-issued authenticator app code still within the configured clock-skew window, even after the legitimate account holder has authenticated with a newer code from the same window. The flaw is a cache-key design error: used-code state was keyed on md5(secret + code) rather than md5(secret) alone, making each distinct valid code within the window independently reusable once rather than collectively consuming the accepted timestep as RFC 6238 requires. An attacker holding the target's password and one intercepted TOTP code has approximately four minutes to authenticate and fully bypass MFA. No public exploit has been identified at time of analysis; email-based MFA is explicitly unaffected.
Web cache poisoning in WP Fastest Cache WordPress plugin before 1.5.1 enables unauthenticated attackers to inject content into the site-wide page cache by exploiting its failure to include tracking-related query parameters in cache key construction. Because the plugin caches responses to URLs containing these parameters under the canonical clean-URL key, an attacker-controlled page render is stored and subsequently served to every visitor of the legitimate URL. A publicly available proof-of-concept exploit exists; no active exploitation confirmed in CISA KEV at time of analysis.
XML injection via EntityReference in xmldom enables attacker-controlled XML markup to escape entity-reference boundaries when the serialized output is reparsed downstream. Applications using @xmldom/xmldom prior to 0.8.15 or 0.9.12, or any version of the legacy xmldom package (which has no fix), are affected if they explicitly call Document.createEntityReference() with attacker-supplied input and serialize the result via XMLSerializer.serializeToString(). No active exploitation is confirmed and no public exploit has been identified; the attack requires an uncommon and explicit application code pattern that the xmldom parser itself never exercises internally.
Timing side-channel exposure in phpseclib's pure-PHP X25519 scalar multiplication allows a local observer to recover a reused 251-bit clamped private key. Data-dependent conditional modular reductions in PrimeField/Integer.php cause per-step timing and libgmp call-count variation during the Montgomery ladder, leaking scalar bits when the same private key is used across multiple operations. Only applications using a long-lived or reused X25519 private key on the pure-PHP code path are at risk; phpseclib's standard SSH ephemeral key exchange is explicitly unaffected. Vendor-released patches exist in versions 3.0.57 and 4.0.1; no public exploit has been identified at time of analysis.
Unauthenticated arbitrary file upload in Casdoor's /api/upload-resource endpoint (controllers/resource.go) exposes all versions through 4.0.0 to remote file-write with no authentication required. The CWE-306 flaw means any network-reachable attacker can deposit attacker-controlled content into the platform's resource storage without credentials or user interaction. A public proof-of-concept has been disclosed by researcher geo-chen; the vendor deleted the GitHub issue without comment and did not respond to coordinated disclosure email, leaving patch status unconfirmed.
OTP validation bypass in Releasit COD Form & Upsells v1 allows unauthenticated remote attackers to circumvent the Cash-on-Delivery phone verification step by manipulating client-side enforcement logic instead of relying on a server-side check. Affected Shopify merchants running v1 are exposed to fraudulent order placement without valid OTP confirmation. A public proof-of-concept exploit has been published on GitHub; no CISA KEV listing exists at time of analysis.
SQL injection in Chanjet CRM's jxf_dump_table.php endpoint allows remote unauthenticated attackers to manipulate the gblOrgID parameter and execute arbitrary SQL against the backend database. All Chanjet CRM releases through build 20260707 are affected, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no special conditions or credentials are required. A public proof-of-concept is available on GitHub, elevating practical risk above the moderate 6.9 base score; no patch exists because the vendor did not respond to coordinated disclosure.
Stored XSS in sanitize-html versions 1.9.0 through 2.17.6 allows authenticated low-privileged users to inject executable JavaScript via SVG SMIL animation elements that survive the library's scheme-policy sanitization. The sanitizer validates the `values` attribute as a single flat URL, missing that `attributeName="href"` gives `values` URI-list semantics under SVG SMIL; a payload of `#safe;javascript:alert(1)` passes the scheme check on its leading fragment while the `javascript:` entry survives intact. When a victim clicks the rendered link, the browser resolves the later entry and executes script in the application's origin. A working proof-of-concept is publicly disclosed in the GHSA advisory; no CISA KEV listing at time of analysis.
Header-value interpretation conflict in the Ruby mail gem (mikel/mail) before 2.9.1 allows remote attackers to craft malformed RFC 2047 encoded-words that cause Mail::Utilities.q_value_decode and b_value_decode to produce decoded From, To, and Reply-To values that differ materially from the raw wire values seen by human reviewers or downstream parsers. Because the old implementation used String#match with an overly greedy charset capture (.+? crossing ? delimiters) rather than a global gsub with a constrained character class, a single crafted encoded-word could swallow surrounding text, enabling apparent sender spoofing, phishing, and authorization-check bypass in any Ruby application relying on these decoded values for trust decisions. No public exploit or KEV listing is present at time of analysis, and the fix is confirmed in version 2.9.1.
Unauthenticated REST endpoint access in the KiviCare WordPress plugin (before 4.5.5) exposes both a clinic's full patient roster and, critically, the configured payment gateway secret key to any unauthenticated remote attacker. The vulnerability stems from missing authorization checks on specific REST API routes, requiring no credentials or user interaction to exploit. A publicly available proof-of-concept is documented by WPScan, materially lowering the bar for exploitation across any WordPress site running an unpatched version of this clinic management plugin.
Quadratic CPU exhaustion in sqlparse's reindentation path allows denial of service against any Python application that passes attacker-controlled SQL to sqlparse.format() with reindent=True. The ReindentFilter._get_offset() method formerly rebuilt the full statement prefix from the token tree's root on every call, resulting in O(N²) CPU growth when processing parenthesized tuple lists - such as large IN (...) or INSERT INTO ... VALUES (...) expressions. A ~12 KB crafted SQL payload can pin a CPU worker for seconds, enabling request delays, throughput reduction, or worker starvation in any service that exposes this formatting path. No public exploit has been identified at time of analysis, and the fix is available in sqlparse 0.6.0.
Shortcode injection in MW WP Form WordPress plugin (versions before 5.1.5) allows unauthenticated remote attackers to execute any WordPress shortcode registered on the target site. The plugin fails to neutralize shortcode syntax in user-submitted form values before passing those values through WordPress's shortcode processing engine. A publicly available proof-of-concept exists (via WPScan), though exploitation is gated by a non-default site configuration requirement, which suppresses real-world risk despite the network-accessible attack vector.
Resource exhaustion in pypdf prior to 6.16.1 allows an attacker who can supply a crafted PDF to cause denial of service by triggering unbounded traversal in `_get_outline` within `pypdf/_doc_common.py`. Any application that processes untrusted PDF files and accesses document outlines is exposed - the traversal lacked global entry-count and nesting-depth limits, enabling crafted PDFs with large numbers of bookmark entries or deeply nested reused paths to consume excessive CPU and memory. No public exploit has been identified at time of analysis, and a patched release (6.16.1) is available.
Availability degradation in Erlang/OTP stdlib's URI parser allows any remote, unauthenticated attacker to stall an Erlang process for hundreds of milliseconds by supplying a URI whose port field contains an arbitrarily long run of digits. The function uri_string:parse/1 - the documented, standard interface for URI parsing in OTP - routes all authority forms through get_port/1, which calls binary_to_integer/1 with no length bound; a syntactically valid port of approximately 1.26 million digits converts successfully, burning CPU on arbitrary-precision arithmetic without raising an error. Affected OTP versions span releases 21.0 through the 27.x, 28.x, and 29.x trains; vendor-released patches are available, and no public exploit or active exploitation has been confirmed at time of analysis.
Path traversal in WWBN AVideo's unauthenticated `get_api_login_code` API endpoint enables remote attackers to delete arbitrary `.log` files and enumerate filesystem paths by injecting directory traversal sequences into the `code` parameter. All versions covered by CPE `cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*` are affected, with exploitation requiring no authentication or user interaction. The primary security consequence is destruction of audit trails and access logs, which undermines incident detection and forensic response capabilities; no public exploit code has been identified at time of analysis.
Silent acceptance of malformed XML end tags in xmldom's DOMParser allows crafted input to bypass parse-before-trust well-formedness gates in security-sensitive Node.js applications. The flaw affects @xmldom/xmldom prior to 0.8.15 and 0.9.12, as well as all versions of the legacy xmldom package (0.6.0 and earlier), for which no patch exists. No public exploit has been identified at time of analysis, but the parser differential is exploitable in any pipeline - SAML processors, XML signature verifiers, API validators - that treats a clean xmldom parse as a validity certificate.
Server-side request forgery in Kyverno's Service Call feature (versions before v1.13.4) allows any cluster user holding ClusterPolicy creation rights to exfiltrate arbitrary Kubernetes resource data - including Secrets - by directing policy apiCall requests to an attacker-controlled external server. The vulnerability stems from a missing URL validation that permits the apiCall/service block, documented for in-cluster services, to resolve and POST data to internet-accessible endpoints. Publicly available exploit code exists in the form of a working PoC ClusterPolicy published in the GHSA advisory; no active exploitation is confirmed via CISA KEV.
Unauthenticated HMAC token forgery in WWBN AVideo through commit 9c39d8c8 exposes a cryptographic oracle via encryptPass.json.php, allowing any remote attacker to compute valid authentication tokens using only the publicly known site base URL as the HMAC key. The endpoint accepts arbitrary plaintext passwords and returns AVideo-formatted encrypted hashes, functioning as an unrestricted hash oracle that enables offline precomputation attacks - particularly dangerous when combined with a separately stolen AVideo credential database. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in WWBN AVideo through 30.0 exposes sensitive configuration data via the MobileManager plugin's getConfiguration endpoint. Any remote attacker can issue a GET request to plugin/MobileManager/getConfiguration.json.php without credentials and receive TLS private key file paths, socket configuration details, platform version, and debug flags. While the direct confidentiality impact is limited (file paths and config metadata rather than key material itself), the leaked data provides meaningful reconnaissance for follow-on attacks targeting the installation. No public exploit or CISA KEV listing is identified at time of analysis.
Server-side request forgery in Kyverno's APICall feature (all versions before 1.16.2) enables any user holding namespace-level Policy creation rights to weaponize Kyverno's cluster-wide, high-privilege ServiceAccount as a confused deputy - directing it to issue HTTP requests to arbitrary internal endpoints including cloud IMDS at 169.254.169.254. Responses, potentially containing other tenants' database passwords, API keys, and cloud IAM role credentials, are surfaced in the PolicyReport and are readable by the attacking tenant, completely collapsing multi-tenant isolation. No public exploit has been identified at time of analysis, though the attack path is straightforward and the impact in shared Kubernetes clusters is severe.
Server-side request forgery in Wyoming before 1.10.2 allows unauthenticated network-accessible attackers to redirect outbound connections from the server to arbitrary attacker-chosen hosts. The HTTP API accepted an unvalidated `uri` query parameter across multiple endpoints - including `/api/info`, `/api/speech-to-text`, and `/api/text-to-speech` - enabling full override of the server-configured backend URI with arbitrary `tcp://` or `unix://` targets. No public exploit has been identified at time of analysis, but the attack requires only a crafted HTTP request with no authentication.
Path traversal in appium-mcp-server through 0.1.61 allows any caller of the write_file or write_files_batch MCP tools to overwrite arbitrary files on the host system by supplying absolute paths or parent-directory sequences (../) that escape the intended PROJECT_ROOT boundary. The server user's full filesystem write permissions are exposed, enabling an attacker to corrupt shell profiles, inject cron jobs, or overwrite application configuration files. No public exploit has been identified at time of analysis, but the vulnerability is trivially exploitable given the absence of any path validation logic in the affected tools.
Unrestricted authentication attempts against Schneider Electric PowerChute™ Serial Shutdown expose user accounts to brute-force compromise when redirect handling is disabled in the application configuration. The absence of any rate-limiting or account-lockout mechanism (CWE-307) allows an attacker to submit unlimited credential-guessing requests over the network until valid credentials are found. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Stored cross-site scripting vulnerabilities in Rockwell Automation's ArmorStart® LT distributed motor controller expose industrial operators to persistent script injection via the device's embedded web management interface. Per the CVSS 4.0 AV:N/PR:N vector, unauthenticated remote attackers can inject malicious scripts that are persisted on the device and execute in the browsers of any operator or engineer who subsequently accesses affected pages - enabling session hijacking, credential theft, or display of falsified operational data. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the ICS context meaningfully elevates practical risk beyond the moderate base score.
Authentication bypass in HPE Networking Fabric Composer exposes enterprise network orchestration environments to unauthenticated administrative takeover by adjacent network actors. The vulnerability resides in the underlying operating system layer of the appliance, allowing an attacker with network adjacency to circumvent authentication controls without credentials, gaining full administrative access. Successful exploitation enables configuration tampering and sensitive data access or manipulation across the orchestration platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
Access control bypass in the HPE AOS-CX API endpoint allows a highly-privileged remote attacker to circumvent the device's configured access control policy and reach management functionality that should be restricted to a higher administrative tier. Affected devices include HPE switches running AOS-CX, as confirmed by HPE in advisory hpesbnw05134, which also covers four other AOS-CX CVEs in the same release. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Authenticated path traversal in HPE AOS-CX's web-based management interface permits a low-privileged authenticated attacker to read arbitrary files from the underlying operating system, potentially exposing credentials, private keys, and device configuration data. The CVSS vector (AV:N/AC:L/PR:L) confirms the vulnerability is remotely exploitable with minimal complexity once valid credentials are obtained. This CVE is part of a broader HPE security advisory (hpesbnw05134) covering multiple AOS-CX vulnerabilities, including higher-severity unauthenticated RCE issues, making credential exposure via this flaw a plausible stepping-stone in a multi-stage attack chain. No public exploit identified at time of analysis.
Privilege abuse in Kibana's machine learning feature allows any user holding read-only ML access to retrieve data from Elasticsearch indices they are not authorized to see. The flaw (CWE-250) occurs because Kibana executes certain ML read operations under an internal service identity rather than forwarding the requesting user's credentials to Elasticsearch, effectively bypassing Elasticsearch's index-level access controls. Elastic self-disclosed the issue in ESA-2026-135 and released fixes across three active release lines; no public exploit code has been identified.
Path traversal in Hono's toSSG() static site generator allows untrusted ssgParams values - such as slugs sourced from a CMS, external API, or user submission - to create or overwrite files outside the configured output directory at build time. Versions 4.12.12 through 4.13.4 are affected; the root cause is an incomplete fix for CVE-2026-39408 that fails to collapse consecutive parent-directory segments (e.g., 'a/b/../../../') in route parameter values, and also mishandles Windows drive-relative and UNC path roots. No public exploit has been identified and the vulnerability is not confirmed in the CISA KEV catalog; a complete patch is available in v4.13.5.
SQL Injection in the Charitable donation plugin for WordPress (versions through 1.8.12.1) allows authenticated attackers with contributor-level access to extract sensitive data from the WordPress database. The vulnerability resides in the `order` shortcode attribute of the `[charitable_donors]` shortcode, which is reachable by contributors via draft or pending post previews - a low-friction entry point requiring no special site permissions beyond the contributor role. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the confidentiality impact is high given that WordPress databases routinely contain PII, donor payment metadata, and user credentials.
Privilege escalation in the HPE AOS-CX management API allows authenticated low-privilege operator-level users to modify system settings that should require higher authorization. Reported by HPE under advisory hpesbnw05134en_us - the same bulletin covering CVE-2026-73749, 73766, 73778, and 73782 - the flaw carries a CVSS 3.1 score of 6.5 with network attack vector, low complexity, and high integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Heap buffer overflow in the gvfs AFP (Apple Filing Protocol) backend allows a malicious AFP server to crash the gvfsd-afp process on connecting clients, resulting in denial of service. When a client mounts an AFP share, the DSI (Data Stream Interface) read path accepts a server-supplied length value without validating it against the pre-allocated reply buffer, enabling the server to write past buffer boundaries. This affects RHEL 6 through 10 and requires user interaction to mount a malicious share; no public exploit or CISA KEV listing has been identified at time of analysis.
SQL injection in the Persistent Login WordPress plugin (versions ≤ 3.1.0) allows network-accessible, subscriber-level authenticated attackers to extract sensitive database contents by injecting arbitrary SQL via the wppl_device_id cookie. The flaw - CWE-89 caused by missing input escaping and absent query parameterization in the Login History feature - carries a CVSS 6.5 with high confidentiality impact and no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Multiple denial-of-service vulnerabilities in the HPE Networking Fabric Composer API allow an authenticated low-privilege operator to disrupt management plane availability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network-accessible exploitation requiring only standard operator credentials with no additional user interaction. No public exploit code has been identified at time of analysis, and the HPE advisory hpesbnw05133en_us is the sole authoritative source confirming the issue.
Authenticated low-privilege API access in HPE Networking Fabric Composer allows operator-level users to retrieve sensitive data beyond their authorized scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms any valid operator account can exploit this over the network with no user interaction, obtaining high-confidentiality-impact data such as network topology, service credentials, or configuration details. Per the vendor advisory, the exfiltrated data could serve as a pivot to gain further unauthorized access to network services managed by Fabric Composer. No public exploit or CISA KEV listing is present at time of analysis.
Missing authorization on an internal Kibana APM integration function exposes APM server credentials to any authenticated Kibana user. The affected endpoint was designed for APM or Fleet administrators but lacked the corresponding role-based access control check, allowing lower-privileged authenticated users to retrieve secrets that govern access to the APM backend. No public exploit code or CISA KEV listing exists at time of analysis; however, the straightforward exploitation path and high confidentiality impact from credential exposure make this a meaningful lateral-movement risk in Elastic Stack deployments.
Out-of-bounds read in the HPE AOS-CX network operating system allows adjacent unauthenticated attackers to disclose sensitive OS memory contents by sending a specially crafted packet. The flaw requires no credentials and no user interaction, but is constrained to same-segment network access (AV:A), limiting exposure to attackers who have already achieved a foothold on the target network or VLAN. This is one of several vulnerabilities disclosed in HPE advisory HPESBNW05134, which also covers more severe unauthenticated adjacent RCE issues (CVE-2026-73782, CVSS 8.8) and network-reachable RCE (CVE-2026-73749, CVSS 9.8) in the same product line - those higher-severity siblings should be prioritized alongside this finding. No public exploit has been identified at time of analysis.
Unauthenticated denial-of-service in HPE AOS-CX allows an adjacent-network attacker to crash or disrupt affected switches by sending specially crafted packets, resulting in loss of normal network operations. The vulnerability requires no credentials and no user interaction, making it exploitable by any actor with access to the same Layer-2 or adjacent network segment. No public exploit code or active exploitation has been identified at time of analysis; this is part of a multi-CVE bundle disclosed in HPE bulletin HPESBNW05134, which also covers higher-severity RCE flaws (CVE-2026-73749, CVE-2026-73782) and an auth bypass (CVE-2026-73778) in the same product line.
Privilege escalation in HPE Networking Fabric Composer allows an authenticated operator-level user to modify system settings that the API is intended to restrict to higher-privilege roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network-exploitable with low attack complexity, requiring only a valid operator credential and no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Buffer overflow conditions in an underlying network service of HPE AOS-CX allow unauthenticated attackers on the adjacent network segment to crash the device by sending specially crafted packets, causing a denial-of-service disruption to normal OS operation. This vulnerability is one of several disclosed together under HPE advisory hpesbnw05134, affecting the CX series switch OS. No public exploit code or active exploitation has been identified at time of analysis.
Uncontrolled resource consumption in Mozilla Firefox's built-in PDF Viewer component allows a remote, unauthenticated attacker to crash or hang the browser by inducing a victim to open a specially crafted PDF file. All Firefox releases prior to version 155 are affected, as confirmed by Mozilla Security Advisories MFSA2026-82 and MFSA2026-86. No public exploit code or CISA KEV listing has been identified, and EPSS at 0.14% (4th percentile) reflects very low real-world exploitation probability.
Sensitive information exposure in HPE Networking Fabric Composer allows an authenticated low-privilege operator user with local access to upstream AFC dependencies to read data outside their authorized scope. The CVSS vector (S:C/C:H) reflects that the confidentiality breach crosses authorization boundaries within the underlying OS layer, not merely within the user's own privilege tier. No public exploit code exists and the vulnerability has not been added to CISA KEV at time of analysis, but the high confidentiality impact and scope change elevate real-world concern for multi-tenant or shared-operator deployments.
NoSQL injection in Kibana exposes unauthorized Elasticsearch data to authenticated low-privilege users who can submit crafted query input. The flaw, classified as CWE-943 (Improper Neutralization of Special Elements in Data Query Logic / CAPEC-676), allows manipulation of backend NoSQL query logic to return records outside the user's authorized data scope. Elastic has released fixed versions 9.4.5 and 9.5.1 per ESA-2026-168; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial of service in Kibana allows an authenticated user holding Streams management privileges to crash the Kibana process by submitting specially crafted compressed content that expands to a disproportionately large volume during server-side processing, exhausting available memory. The host OS terminates the Kibana process, and the service remains unavailable to all users until manually restarted. The advisory ESA-2026-125 identifies fixed versions as 8.19.21, 9.4.6, and 9.5.2; no public exploit or KEV listing has been identified at time of analysis.
Uncaught exception handling in Kibana's Observability AI Assistant allows any low-privileged authenticated user to crash the entire Kibana Node.js process by submitting a specially crafted request, denying service to all users and spaces on that instance until an administrator manually restarts it. The blast radius is instance-wide regardless of the attacker's permission scope, making this disproportionately severe relative to its CVSS 6.5 Medium rating. Elastic confirmed the fix in versions 9.4.5 and 9.5.1 via advisory ESA-2026-115; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unbounded memory allocation in Kibana's Agent Builder feature allows any authenticated user with minimal read-level privileges to crash the Kibana process, denying service to all users of the affected instance. The vulnerability stems from CWE-770 (no resource throttling), meaning a single low-privileged user can trigger full process termination via one crafted request. Elastic has addressed this in Kibana 9.4.6 via security advisory ESA-2026-84; no public exploit or active exploitation has been identified at time of analysis.
Unthrottled resource allocation in Kibana allows an authenticated network user to submit a specially crafted request that drives excessive server-side resource consumption, potentially rendering the Kibana dashboard fully unavailable. Reported by Elastic and addressed in ESA-2026-48, the vulnerability is classified under CWE-770 and maps to the CAPEC-130 excessive allocation attack pattern. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the fix is confirmed in Kibana 8.19.19 and 9.3.5.
Denial of service in Elastic Kibana allows any authenticated low-privilege user to render the analytics interface unavailable by submitting specially crafted requests that trigger unbounded resource consumption (CWE-770, CAPEC-130). All Kibana versions prior to 8.19.17 and 9.3.0 are affected. No public exploit or CISA KEV listing exists at time of analysis; the risk is real but limited to authenticated accounts.
Argument Injection in Dell PowerStore storage appliances allows an authenticated low-privileged user to extract sensitive system information over the network without requiring additional interaction. The vulnerability (CWE-88) arises from improper neutralization of user-controlled input passed as arguments to an internal process, enabling privilege escalation of read access beyond what the account's role should permit. No public exploit code or active exploitation has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible insider and compromised-credential threat.