Improper TLS certificate validation in IBM Netezza Software 11.3.0.3 through Interim Fix 002 leaves encrypted connections susceptible to man-in-the-middle interception, allowing an unauthenticated network adversary to obtain sensitive information in transit. The flaw is classified under CWE-295, meaning the software either skips certificate chain verification, hostname matching, or revocation checks - permitting a fraudulent certificate to be silently accepted. IBM has released a patch via its support portal; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog.
Buffer overread in OpenVPN's Windows service component (`openvpnserv`) through version 2.7.6 exposes adjacent service process memory or crashes the service when NRPT domain entries containing Internationalized Domain Names (IDN) with UTF-8 encoding trigger an incorrect buffer size calculation (CWE-131). The flaw is Windows-specific and confined to split-DNS configurations that include non-ASCII domain names; Linux and macOS deployments are unaffected. The issue was discovered by BreachX Zero Day Labs and fixed in OpenVPN v2.7.7, co-released with four other security patches. No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper TLS certificate validation in IBM Netezza Software 11.3.0.3 through Interim Fix 002 (CWE-297) exposes encrypted database communications to interception via man-in-the-middle attacks. A network-adjacent or on-path attacker who can position themselves between Netezza clients and the server can intercept or manipulate traffic because the software fails to properly validate TLS certificates - likely failing to check hostname binding. No public exploit has been identified at time of analysis, and a vendor patch is available. EPSS data was not provided, but the network-accessible attack surface warrants prompt patching in any environment transmitting sensitive data.
Numeric truncation in the MongoDB C++ Driver's BSON library JSON parsing interface allows an attacker who controls text fed to that interface to read process memory beyond the input buffer, cause silent acceptance of a truncated document fragment as complete, or terminate the host process. Affected systems are any C++ applications embedding the driver that parse externally-controlled JSON; MongoDB server connectivity, credentials, and non-default configuration are explicitly not required. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.9 reflects both the constraint of requiring very large input documents and the local library-consumer trust boundary.
Key-ID (kid) bypass in the jwcrypto Python JOSE library allows an attacker who holds any valid key within a JWK set to forge a General JSON Serialization JWS that satisfies verification for a different kid, effectively impersonating another tenant, user, or service. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 7-10, Red Hat OpenShift AI (RHOAI), and Red Hat OpenStack Platform 16.2, wherever jwcrypto performs JWS signature verification with kid-based authorization. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score is not provided, but the integrity impact is high for multi-tenant architectures.
Integer wraparound in the MongoDB C Driver BSON library's JSON parser allows an unauthenticated party supplying a sufficiently large JSON document to crash any linked application on 32-bit-size builds. The overflow produces an undersized heap allocation that is freed, while a subsequent copy operation continues writing through the now-dangling pointer - a use-after-free sequence that terminates the host process. No public exploit code or active exploitation has been identified; impact is confined to denial of service, and the attack is constrained to 32-bit size builds of the library.
Process termination via out-of-bounds memory read affects the MongoDB C++ Driver's BSON document builder, caused by a numeric type conversion error (CWE-681) that misinterprets a field name length when an application supplies an extremely large, non-null-terminated field name in a specific form. All versions of the C++ Driver are indicated as in scope per the wildcard CPE. No public exploit code and no CISA KEV listing exist at time of analysis; MongoDB's own Jira (CXX-3548) is the sole public tracking reference, and no fixed release version has been disclosed in the available data.
Reflected cross-site scripting in the Kriesi Enfold WordPress theme through version 8.0 allows unauthenticated remote attackers to inject arbitrary JavaScript into the browsers of victims who click a crafted URL. The S:C scope change in the CVSS vector confirms the script executes in the victim's browser context, enabling session theft, credential harvesting, or forced actions under the victim's identity. No public exploit or active exploitation confirmed at time of analysis; reported by Patchstack.
Unauthorized write access to a MongoDB key vault collection allows an attacker to inject maliciously crafted key metadata into libmongocrypt, causing a legitimate authorized application client to issue arbitrary Google Cloud KMS API calls authenticated under the victim client's GCP identity. All versions of libmongocrypt are listed as affected via CPE wildcard (`cpe:2.3:a:mongodb:libmongocrypt:*`), with impact limited to deployments using MongoDB Client-Side Field Level Encryption (CSFLE) or Queryable Encryption configured with a Google Cloud KMS key provider. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Windows openvpnserv path-validation bypass in OpenVPN 2.7_alpha1 through 2.7.6 allows a low-privileged local user to circumvent administrative config-path restrictions by using '/' instead of '\' as a directory separator. Windows path-validation APIs do not recognize '/' as a separator while file-open APIs do, creating a mismatch exploitable to load a user-controlled OpenVPN config file that administrators have explicitly prohibited. Fixed in v2.7.7; no public exploit identified at time of analysis.
Authorization bypass in the light0011 cms PHP application allows unauthenticated remote attackers to circumvent access controls enforced by the Chapter Controller's initialization hook. The vulnerability resides in the `AuthController::_initialize` method within `App/Admin/Controller/ChapterController.class.php`, where the per-request authorization gate fails to enforce access control before handling chapter administration requests. Publicly available exploit code exists (confirmed by CVSS 4.0 E:P modifier), and the project maintainer has not responded to the responsible disclosure report, leaving the flaw unpatched.
Server-Side Request Forgery in the SEOPress WordPress plugin (through version 10.1) allows an authenticated attacker with low privileges to induce the server to make HTTP requests to arbitrary internal or external targets, potentially exposing internal network services and metadata endpoints. The S:C scope change in the CVSS vector confirms the vulnerability crosses trust boundaries - the plugin's server-side requests can reach systems beyond the WordPress host itself. No public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in MISP's dashboard ButtonWidget allowed an authenticated user to persist arbitrary URLs - including `javascript:` scheme values - through the `updateSettings()` whole-layout save endpoint, which lacked the widget-config validation that `updateWidgetSettings()` already enforced. A malicious URL stored via this unguarded path could reach client-side rendering or navigation, potentially executing script in the victim's MISP browser session and enabling actions or data access at that user's privilege level. Practical exploitability was substantially reduced by MISP's existing render-time URL validation, making this a defense-in-depth persistence-layer gap rather than a confirmed end-to-end XSS bypass; no public exploit or active exploitation has been identified.
Heap out-of-bounds read in FreeRDP before 3.31.0 allows a malicious RDP server to trigger adjacent heap memory disclosure and potential client instability by sending a crafted RFX_AVC444_BITMAP_STREAM during AVC444 chroma reconstruction. The root cause is a missing row-index bounds check in `general_ChromaV1ToYUV444` (and its ARM NEON and x86 SSE4.1 counterparts), causing `memcpy` to read past the end of the allocated luma plane when the server specifies specific frame geometry. No public exploit or CISA KEV listing exists at time of analysis; a confirmed fix is available in the 3.31.0 release.
Improper authorization in SpecterOps BloodHound through version 9.5.1 allows authenticated users holding only GraphDBRead permissions to invoke the PATCH /api/v2/domains/{objectID} write endpoint, effectively bypassing the intended write-permission gate. The commit diff confirms the root cause: the route handler called RequirePermissions(permissions.GraphDBRead) where it should have enforced GraphDBWrite, granting read-only users unauthorized ability to modify domain objects in the BloodHound graph database. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS 4.0 score of 5.3 (PR:L) reflects the authentication prerequisite that limits the attack surface to already-authenticated principals.
Workflow names and execution statistics from arbitrary projects are exposed in n8n versions before 2.36.2 due to missing per-project authorization in the Insights API. Any authenticated user holding an insights-scoped credential can supply arbitrary `projectId` parameters to Insights API routes and retrieve analytics data from projects they have no membership in - a classic IDOR (Insecure Direct Object Reference) pattern. No public exploit code has been identified and the CVSS 4.0 score of 5.3 reflects the limited disclosure scope (execution metadata only, no credential or workflow-payload exposure).
Session invalidation without authorization in Peppermint through 0.5.5 allows any authenticated user to forcibly terminate the active sessions of any other account - including administrators - by supplying a victim's user ID to the GET /api/v1/auth/user/:id/logout endpoint, which performs no ownership check. The flaw (CWE-639) is traceable to the logout handler in apps/api/src/controllers/auth.ts and is documented in GitHub issue #529. No public exploit confirmed at time of analysis, and CVSS 4.0 scores this at 5.3, reflecting the limited direct impact (session termination only, no data exposure).
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote authenticated customers to manipulate the backend database via the `proid` parameter in the `addwishlist` function at `/customer/controller.php?action=addwish`. Any valid customer-level session can submit a crafted POST request to extract or modify database contents, including potentially customer PII, credentials, and order records. No KEV listing exists; CVSS 4.0 scores this 5.3 (Medium), reflecting the authentication barrier (PR:L) and limited per-component impact ratings.
Server-side request forgery in n8n before 2.34.1 allows authenticated low-privileged users to bypass SSRF protection in Code and Function nodes by simultaneously supplying a safe uri parameter and a malicious url parameter to the legacy request helper function. Because the SSRF validation inspects only uri while the HTTP client dispatches using url when both are present, the safety check is rendered ineffective and internal network addresses become reachable. No public exploit or active exploitation has been identified at time of analysis, but the bypass technique is straightforward for any user with Code or Function node authoring rights.
Authenticated low-privileged users in MISP can receive OnDemand correlation results that reference attributes and events they are not authorized to access, bypassing the platform's distribution, sharing-group, organization, and event-level access controls. The flaw resided in `OnDemandCorrelationBehavior.php`, where `__collectCorrelations()` matched attributes by value alone and never filtered results against the requesting user's ACL - meaning any authenticated user could learn that a specific indicator value (IP address, hash, domain) appears in a restricted event belonging to another organization or sharing group. No public exploit has been identified at time of analysis; a vendor patch is confirmed as commit f51342f30 in the MISP GitHub repository.
Fleet controller's Helm template preprocessing exposes cluster metadata and internal DNS topology to any user with write access to a GitRepo-tracked repository, via a server-side request forgery path that abuses name resolution. Affected releases span all active branches from 0.12.0 through 0.16.0, with patched builds released across each branch. The DNS-based exfiltration channel is notable because it can remain effective in environments where outbound TCP/UDP egress is otherwise restricted, making standard network perimeter controls insufficient as a compensating measure.
Unauthenticated information disclosure in SureForms (WordPress form-builder plugin by Brainstorm Force) versions through 2.12.5 allows remote attackers to access restricted data by manipulating user-controlled object identifiers. The root cause is CWE-639 - Authorization Bypass Through User-Controlled Key - a classic IDOR pattern in which the plugin returns object-level data without verifying that the caller has rights to the requested record. Reported by Patchstack; no active exploitation or public proof-of-concept has been identified at time of analysis.
Server-side request forgery in NousResearch hermes-agent 0.18.0 allows authenticated remote attackers to issue arbitrary HTTP requests from the application server by supplying a crafted URL to the fetchLinkTitle function in the Link Title Fetch component (apps/desktop/src/app/artifacts/index.tsx). The CVSS 4.0 vector (PR:L, VC:L/VI:L/VA:L) indicates limited but real impact: an attacker with valid credentials could probe internal network services, cloud metadata endpoints, or otherwise unreachable hosts. No public exploit code and no vendor patch have been identified; the vendor did not respond to coordinated disclosure.
Missing authorization on Oppia's AdminRoleHandler GET endpoint (through v3.5.2) exposes privileged account enumeration to any registered user. The endpoint in core/controllers/admin.py is decorated with open_access instead of an admin-only access control decorator, allowing authenticated non-admin users to query filter_criterion parameters and retrieve usernames holding specific roles, banned-user flags, and managed topic identifiers. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the organizational structure disclosure it enables facilitates targeted follow-on attacks against administrative accounts.
Stored cross-site scripting in MOOS core-moos through 10.4.0 allows any MOOS publisher to inject script payloads into the MOOSDB HTTP monitoring interface. Because MOOS clients are inherently unauthenticated by protocol design, attackers with network access to a MOOS community can set variable names, values, source process names, or community names to contain HTML/script markup that is rendered unescaped in the operator's browser. The fix (PR #78) adds a comprehensive HTMLEscape() function covering all attacker-controlled database fields, plus a restrictive Content-Security-Policy header as a secondary control.
Broken object-level authorization in the LearnPress WordPress LMS plugin before 4.4.6 allows authenticated Instructor-role users to inject quiz answers into questions owned by other instructors. The answer-insertion endpoint accepts arbitrary question identifiers without verifying ownership, enabling persistent cross-instructor content tampering. No public exploit is identified and the vulnerability is not listed in CISA KEV; a patched version (4.4.6) is available.
Missing authorization checks in Ultimate Maps by Supsystic WordPress plugin (versions through 1.5.3) allow unauthenticated network attackers to perform restricted write-class operations by exploiting incorrectly configured access control security levels. Reported by Patchstack via audit, this is a CWE-862 broken access control weakness where plugin endpoints lack proper capability checks before executing state-changing actions. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in AVideo's userLogin.php allows unauthenticated network attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted cancelUri parameter. The isSafeRedirectURL validation function restricts only the URL protocol, leaving HTML metacharacters unchecked; a relative URL containing embedded quotes and event handlers bypasses the check entirely and is reflected verbatim into the href attribute of the Cancel button. Exploitation requires a victim to interact with the Cancel button after following a malicious link, placing this in the phishing-dependent reflected-XSS risk class.
Reflected XSS in AVideo's videoEmbeded.php allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers by delivering a crafted embed URL. The `link` GET parameter is echoed verbatim inside an HTML comment with no escaping, so injecting the sequence `-->` closes the comment context and enables arbitrary script injection. No active exploitation has been confirmed per CISA KEV, but the zero-friction delivery model - a victim clicking a malicious embed link - makes this a realistic phishing-chain enabler against authenticated AVideo users.
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. The vendor CPE attributes this to Nexcess (cpe:2.3:a:nexcess:bookit). No public exploit code or CISA KEV listing has been identified at time of analysis.
Heap out-of-bounds read in gfs2-utils enables memory disclosure and potential crashes when parsing crafted GFS2 filesystem images. The `ea_num_ptrs` field embedded in on-disk extended attribute metadata is consumed without validating it against the available buffer boundary, allowing an attacker who controls a filesystem image to trigger a heap over-read. Affected across Red Hat Enterprise Linux 7, 8, and 9; no public exploit is identified at time of analysis, and the local, user-interaction-dependent attack vector substantially limits practical exploitation.
Cross-site request forgery in AVideo's removePoster.php endpoint allows network-accessible attackers to permanently delete an authenticated victim's live poster and thumbnail files by tricking them into loading a crafted page. The endpoint accepts state-changing file-deletion operations over HTTP GET while performing neither POST-method enforcement (forbidIfNotPost) nor CSRF token validation (forbidIfInvalidToken), making the attack trivially embeddable in an HTML image tag. No active exploitation or public exploit code has been identified at time of analysis.
Missing authorization in the Unlimited Elements For Elementor WordPress plugin (versions through 2.0.17) exposes restricted functionality to unauthenticated remote callers, resulting in limited confidentiality impact. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no credentials or user interaction are needed, meaning any internet-accessible WordPress installation running the affected plugin version is reachable. No active exploitation has been identified at time of analysis, and no public exploit code is known.
Sensitive data exposure in the KP Agent Ready WordPress plugin (all versions before 1.2.08) causes the plugin to embed sensitive information - likely API keys or credentials for an external agent/chat service - in HTTP responses or frontend JavaScript assets delivered to site visitors. The CVSS 5.3 vector AV:N/AC:L/PR:N/UI:N confirms unauthenticated, low-complexity exploitation accessible to any visitor. No public exploit or active exploitation is identified at time of analysis; vendor-released patch version 1.2.08 is available.
WP EasyPay WordPress plugin versions up to and including 4.5.3 allow unauthenticated remote attackers to bypass access controls by manipulating web parameters the plugin treats as server-authoritative and immutable. The flaw (CWE-472) results in a low-level integrity impact - attackers can alter application state without credentials - but carries no confidentiality or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis, consistent with its Medium CVSS score of 5.3.
Insecure Direct Object Reference (IDOR) in CRMEB through 6.0.0 allows any authenticated user to modify arbitrary system inbox messages belonging to other users via the `edit_message` endpoint in `MessageSystemController.php`. The handler accepts user-controlled message IDs without validating that the requesting user owns the targeted message, enabling silent manipulation of victim notifications - including soft-deletion (`is_del`), marking as read (`look`), or reassigning ownership (`uid`). A proof-of-concept is publicly documented in the project's GitHub issue tracker; no vendor-released patch has been identified at time of analysis.
Unrestricted file upload via ZIP extraction in ILIAS MediaPool allows authenticated low-privilege users to bypass extension controls through the subtitle bulk-upload endpoint (`uploadMultipleSubtitleFileObject` backed by `ZipAdapter`), placing arbitrary file types - including PHP scripts - into server directories. Versions 9.x through 9.21, 10.x through 10.9, and 11.x through 11.2 across all active release branches are affected. No public exploit has been identified at time of analysis, but the CWE-434 primitive in a PHP application is a well-understood RCE precursor if extracted files land in a web-executable path.
Uncontrolled resource consumption in NousResearch hermes-agent 0.18.0 allows a remote attacker, with passive user interaction, to trigger excessive memory or resource allocation through the Electron main process via the `resourceBufferFromUrl` function. The impact is limited to low availability degradation (DoS) with no confidentiality or integrity exposure. Critically, the description acknowledges the vulnerable `copyImageFromUrl()` entry point was removed by v2026.8.19, making this effectively self-patched in current builds; the vulnerability is specific to the v2026.8.3 codebase window. No public exploit or active exploitation is identified.
Reflected XSS and open-redirect flaws in J2Store, a Joomla e-commerce extension by j2commerce.com, allow unauthenticated network attackers to inject malicious scripts into victim browsers via the `filter_tag`, `pricefrom`, and `priceto` parameters across all 3.x releases through 3.3.21 and all 4.x releases through 4.1.6. Four task handlers additionally accept base64-encoded redirect URLs without destination-host validation, enabling phishing attacks that abuse the shop's trusted domain to mislead customers into visiting attacker-controlled sites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stack corruption with potential code execution in MOOS core-moos through version 10.4.0 arises from an off-by-one error in CMOOSSerialPort::GetTelegram(), where a NUL terminator is written one byte past the end of a fixed-size stack buffer. An attacker who controls the serial communication line connected to a MOOS-enabled platform can send a full-length telegram to trigger the overwrite, corrupting adjacent stack memory and potentially redirecting execution. A vendor patch is available via GitHub PR #73 and commit befb04df; no public exploit has been identified at time of analysis.
Stored cross-site scripting in pfSense Plus before 26.07 and CE before 2.9.0 allows an authenticated attacker holding the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the schedule description field in /firewall_schedule_edit.php. The description is written to backend storage without HTML sanitization, and when rendered in /firewall_rules.php only single-quote escaping is applied - insufficient to prevent double-quote-based breakout from an HTML attribute context. Any pfSense administrator with the Firewall: Rules privilege who views the rules list while the malicious schedule is attached will silently execute the attacker's payload, enabling session token theft or in-browser privilege escalation within the firewall management interface.
Stored cross-site scripting in pfSense Plus and pfSense CE allows an authenticated attacker holding the 'Firewall: Rules: Edit' privilege to inject arbitrary JavaScript via the `descr` parameter in `/firewall_rules_edit.php`. The injected payload is written to the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered unencoded in the firewall log table at `/status_logs_filter.php`, executing in the browser of any administrator holding the 'Status: Logs: Firewall' privilege who views the affected entries. Patches are available in pfSense Plus 26.07 and pfSense CE 2.9.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in pfSense Plus before 26.07 and pfSense CE before 2.9.0 allows an authenticated user holding only the Status: Monitoring privilege to inject arbitrary JavaScript via unsanitized graph configuration POST parameters in /status_monitoring.php. The payload is persisted in the global pfSense XML configuration file and rendered unsanitized into a JavaScript string context, meaning it executes automatically in the browser of every subsequent visitor to the Status: Monitoring page - including full administrators. Vendor-released patches exist in pfSense Plus 26.07 and CE 2.9.0; no public exploit code has been identified at time of analysis.
Command injection in the MongoDB extension for Visual Studio Code allows a remote attacker, via social engineering, to inject arbitrary shell characters into a terminal command composed by the extension when a developer opens its integrated shell feature against an attacker-controlled connection target. The extension fails to neutralize special characters from user-supplied MongoDB connection strings before embedding them in the command line, and the confirmation dialog shown to the developer does not render the injected payload, preventing visual detection. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the multi-step social-engineering requirement is the primary barrier to exploitation.
Stored cross-site scripting in LearnPress WordPress Plugin before 4.4.6 allows authenticated Instructor-role users to inject persistent JavaScript through quiz question answer title fields, with payloads executing in the browsers of any user who views the affected quiz - including administrators. The unescaped HTML sink means stored payloads persist until patched, making every quiz viewer a potential victim regardless of their privilege level. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but the admin-targeting capability meaningfully elevates practical impact beyond the medium CVSS score.
Command injection in Dell SmartFabric OS10 Software (versions prior to 10.5.6.14) allows a remote authenticated administrator to execute arbitrary OS commands on the underlying network operating system. Classified under CWE-77, the flaw requires high privilege and high attack complexity, yielding a vendor-assigned CVSS score of 5.0 - reflecting a substantially elevated bar for exploitation compared to typical network-reachable command injection. No public exploit code or active exploitation has been identified at time of analysis; Dell has released a patched version.
Command injection in Dell SmartFabric OS10 Software (versions prior to 10.5.6.14) allows a remotely-authenticated, high-privileged attacker to execute arbitrary OS commands via the network-accessible management interface. Dell disclosed and patched the issue through advisory DSA-2026-322, with version 10.5.6.14 as the confirmed fix. No public exploit code or active exploitation has been identified; the high-privilege and high-complexity prerequisites substantially constrain the realistic threat surface.
Stack exhaustion in gfs2-utils's metawalk.c metadata walk code allows a local attacker to cause denial of service by supplying a crafted GFS2 filesystem image containing a maliciously large inode height value that drives unbounded alloca() calls. Affected systems include Red Hat Enterprise Linux 7, 8, and 9 with gfs2-utils installed; the CVSS 4.7 medium rating reflects a local, high-complexity, user-interaction-required attack path with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis.
Stack exhaustion in gfs2-utils allows an attacker who can deliver a crafted GFS2 filesystem image to crash fsck.gfs2, gfs2_edit, or savemeta on Red Hat Enterprise Linux 7, 8, and 9. The root cause is unbounded use of alloca() in metawalk.c's hash table traversal, where the allocation size is derived exponentially from the on-disk di_depth field with no upper-bound check, so a sufficiently large di_depth value causes the process stack to be fully consumed. The impact is limited to denial of service of the affected utility; no public exploit has been identified at time of analysis, and EPSS data is not available in the provided intelligence.
CSV injection (CWE-1236) in Hitachi Energy MicroSCADA SYS600 allows attackers who can write arbitrary entries to the Notify service log to embed malicious spreadsheet formulas that execute when a Windows operator exports and opens the log as a CSV file. Impact ranges from cell data manipulation and link insertion to conditional code execution on the operator's workstation, contingent on the target's spreadsheet application security configuration. No active exploitation or public proof-of-concept has been identified; Hitachi Energy has published a security advisory documenting the issue.