Server-side request forgery in AVideo's EPG parser allows authenticated uploaders to force the server to fetch arbitrary internal URLs via the epg_link parameter during video upload. Any AVideo instance through commit c91b5975d is affected; the parameter undergoes only syntactic validation at submission time, and the actual server-side HTTP fetch during EPG generation occurs without SSRF protections such as private-IP blocking, allowlisting, or DNS rebinding defenses. No public exploit has been identified at time of analysis, but the attack requires only uploader-level credentials and is straightforward to execute against cloud-hosted or internally-networked deployments.
Token store authorization bypass in Rancher Manager before 2.15.1 allows any authenticated user to enumerate every other user's session tokens by supplying a crafted label selector to the ext.cattle.io/v1 Token API. The owner-scoped filter that restricts results to the calling user's own tokens is silently dropped when the caller supplies a label selector naming a different user, instead of returning an empty result set as intended. Exposed data includes token metadata and salted bearer-token hashes, creating an offline cracking risk. No public exploit is identified at time of analysis; a vendor-released patch is available in v2.15.1.
Out-of-bounds memory read in the Linux kernel's DRM HDMI connector subsystem allows a local, low-privileged user to potentially leak up to 32 bytes of adjacent kernel heap memory or trigger a page fault leading to kernel crash. The flaw exists in a helper function that copies audio infoframe data using the destination buffer size (60 bytes) rather than the source structure size (28 bytes), reading 32 bytes beyond the source allocation. No public exploit code exists, and EPSS sits at the 10th percentile; however, the availability impact is real - the overread can cross a page boundary and cause an access violation.
Out-of-bounds kernel memory read in the Linux kernel DRM log subsystem allows a local low-privileged user to potentially disclose kernel memory contents or crash the system. The flaw resides in drm_log_draw_kmsg_record(), where an unsigned integer underflow on a zero-length message causes an array access at offset UINT_MAX (0xFFFFFFFF) rather than a valid buffer position. No public exploit exists and EPSS sits at 0.20% (10th percentile), indicating low observed exploitation interest, though the kernel DRM panic-display path is reachable on any system with a GPU using the DRM framework.
Unauthenticated stored cross-site scripting in WP QuickLaTeX for WordPress (versions <= 3.8.8) allows a remote unauthenticated attacker to inject malicious scripts into LaTeX-rendered content. When a privileged user such as a site administrator views the affected page, the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. Reported by Patchstack; no public exploit code or active exploitation confirmed at time of analysis.
Cross-site scripting in the Ninja Forms File Uploads Extension for WordPress (versions up to and including 3.3.26) allows unauthenticated remote attackers to inject malicious scripts that execute in the browser of any user who views the affected content. The scope change (S:C) indicates the injected payload runs in the victim's browser context rather than the server, enabling session theft, credential harvesting, or UI redressing against site visitors or administrators. No public exploit code has been identified at time of analysis, though the Patchstack advisory provides sufficient detail for researchers to reproduce the issue.
Unauthenticated cross-site scripting in the Under Construction WordPress plugin (versions ≤ 5.82) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to follow a crafted URL. The scope-change vector (S:C) confirms the payload executes in the browser's security context, enabling session token theft, credential harvesting, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement lowers the bar for abuse significantly.
Cross-site scripting in the Quick Event Manager WordPress plugin (versions ≤ 9.17) allows unauthenticated remote attackers to inject malicious JavaScript into pages rendered for authenticated users. Exploitation requires a victim - typically a logged-in WordPress administrator or editor - to load a page or follow a crafted link carrying the payload, which then executes in their browser context with scope change beyond the plugin itself. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Cross-site scripting in the BP Better Messages WordPress plugin (≤2.15.27) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The CVSS scope-change metric (S:C) indicates the injected payload can escape the plugin's execution context and affect the broader WordPress environment, enabling session hijacking, credential theft, or admin-level CSRF actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in RTMKit (RomethemeKit For Elementor) versions up to and including 2.1.5 allows remote attackers to inject and execute arbitrary JavaScript in victim browsers without any prior authentication. Exploitation requires a victim to visit or interact with a page or crafted URL where the plugin renders unsanitized attacker-controlled input. The CVSS vector (S:C) confirms a scope change to the victim's browser context; no public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in WWBN AVideo through commit c91b5975d allows unauthenticated remote attackers to hijack authenticated streamers' live broadcasts by tricking them into loading a malicious page. The saveLive.php endpoint in the Live plugin omits both POST-method enforcement (forbidIfNotPost) and CSRF token validation (forbidIfInvalidToken), so a crafted image tag silently overwrites the victim's RTMP key, password, and stream title when loaded by a logged-in streamer. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in the WC Ukraine Shipping WordPress plugin versions 1.22.3 and earlier allows subscriber-level authenticated users to access and partially modify shipping and order objects belonging to other customers. Reported by Patchstack and classified CWE-639, the flaw arises from the plugin resolving shipping or order records via user-supplied identifiers without verifying the authenticated session owner is authorized to access that resource. With a CVSS 7.1 score carrying C:H/I:L impact, successful exploitation can expose customer PII, order histories, and shipping records; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated cross-site scripting in the Breadcrumb NavXT WordPress plugin (versions <= 7.5.1) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for visiting users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable, low-complexity exploitation with scope change into the victim's browser context. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated trigger and large install base elevate real-world risk.
Unauthenticated cross-site scripting (XSS) in the Calculation For Contact Form 7 WordPress plugin (all versions up to and including 1.0) allows a remote unauthenticated attacker to inject malicious scripts into pages viewed by other users. With no privileges required and a scope change confirmed by the CVSS vector (S:C), a successful exploit executes arbitrary JavaScript in the victim's browser context, enabling session hijacking, credential harvesting, or UI redressing. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes opportunistic targeting straightforward once a vulnerable site is discovered.
Cross-site scripting in the Simple Payment WordPress plugin (versions ≤ 2.5.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, including site administrators. The scope-changed CVSS vector (S:C) indicates the injected script executes outside the plugin's own origin - enabling session hijacking, credential theft, or administrative actions executed on the victim's behalf. No public exploit code or active exploitation has been identified at time of analysis.
Process-terminating denial of service in libmongocrypt's decryption path allows a low-privileged attacker to crash applications using MongoDB Client-Side Field Level Encryption (CSFLE). Tracked as MONGOCRYPT-971, the vulnerability is triggered when an unexpected-size encrypted value reaches the decryption routine, firing a reachable assertion (CWE-617) that abruptly terminates the host process rather than returning a handled error. An attacker who can store crafted encrypted values in a shared MongoDB collection, or influence the encrypted data an application receives, can repeatably crash the targeted application.
Guest checkout address IDOR in J2Store Joomla extension exposes personally identifiable information of guest purchasers to any authenticated site user. The `editAddress()` function's ownership guard only fires when the address row carries a non-empty `user_id`; guest-checkout rows have a null `user_id`, silently bypassing the check. Any registered Joomla account can iterate sequential `address_id` integers to retrieve full name, street address, and phone number for all guest orders across J2Store versions 1.0.0 through 3.3.21, 4.0.0 through 4.0.21, and 4.1.0 through 4.1.6. No public exploit has been identified at time of analysis, but the attack is trivially simple for any authenticated user.
Server-side request forgery in OpenStack Glance before 32.0.1 allows authenticated cloud tenants to probe internal network endpoints by registering HTTP image locations that bypass host-restriction filtering. The location API - both POST /v2/images/{id}/locations and the PATCH API when show_multiple_locations is enabled - validates only the URL scheme and ignores the import_filtering_opts host allow-list that guards the web-download path, permitting requests to addresses such as the cloud metadata service at 169.254.169.254. A low-privileged tenant can then retrieve the server's response by downloading the image, potentially exposing ephemeral instance credentials or bootstrap secrets. No public exploit code has been identified and no CISA KEV listing exists, but the CVSS 4.0 score of 7.0 with SC:H reflects genuine cross-boundary credential exposure risk on affected deployments.
Unauthenticated bootloader command execution in ShizenBox2 (dev-conf) firmware ≤v1.0.10 is achievable by any attacker with physical access to the device. The 'dev-conf' firmware variant from Shizen Connect Inc. fails to enforce authentication on bootloader interfaces (CWE-1263), exposing full device control - including firmware manipulation - without credential verification. Reported through JPCERT/JVN responsible disclosure; no public exploit code identified and no CISA KEV listing at time of analysis.
Stack buffer overflow in gfs2-utils' savemeta function allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The vulnerability stems from using an attacker-controlled `height` field from on-disk inode metadata as a loop bound without validation, overwriting stack memory beyond the buffer's allocated region. Exploitation requires convincing a privileged or standard user to run gfs2-utils tooling against a malicious image, with successful exploitation granting code execution at the privilege level of the running process. No public exploit code or active exploitation has been identified at time of analysis.
Stack buffer overflow in the gfs2_edit utility within gfs2-utils allows arbitrary code execution when a user processes a crafted GFS2 filesystem image. The di_height field from on-disk inode metadata is used as an array index with no bounds validation, enabling a stack overwrite with fully controlled data from an untrusted image. Affected systems include all supported Red Hat Enterprise Linux 7, 8, and 9 installations that ship gfs2-utils; no public exploit or active exploitation has been identified at time of analysis.
Weak credential management in the mapp Audit component of B&R Industrial Automation's mapp Services framework allows network-accessible, unauthenticated attackers to leverage predictable or default credentials to gain unauthorized access with high confidentiality and integrity impact on downstream industrial systems connected through the platform. All mapp Services versions prior to 6.8.0 are affected. No public exploit or CISA KEV listing has been identified at time of analysis, but the OT/ICS deployment context - where integrity compromise can translate to physical process disruption - elevates the practical severity beyond the numeric score.