Stored XSS in the Divi WordPress theme's Social Media Follow module allows authenticated Contributor-level users to inject arbitrary scripts via the `skype_url` shortcode attribute, executing against any site visitor who interacts with the poisoned element. The flaw stems from a three-part sanitization failure: the field is excluded from the URL-option whitelist, the renderer explicitly bypasses `esc_url()` for Skype URLs, and the fallback `sanitize_text_field()` preserves quote characters enabling single-quoted HTML attribute breakout. Versions up to and including 4.27.6 are affected; a fix was released in 4.27.7. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in GutenKit Page Builder (versions ≤2.4.4) allows authenticated Contributor-level WordPress users to inject persistent JavaScript via the 'postBodyCss' parameter, which executes in victim browsers whenever an affected page is visited. The vulnerability stems from insufficient sanitization of CSS body input before storage and inadequate output escaping on render, earning a CVSS 6.4 with scope-change (S:C) reflecting the browser-context boundary crossing. No public exploit or KEV listing is confirmed at time of analysis, but Contributor-level access is commonly available on multi-author WordPress sites, making this a realistic intra-site privilege escalation vector.
Path traversal in parsedmarc 9.0.6 through 11.0.0 allows a network attacker who can send email to a monitored mailbox to write attacker-controlled files outside the intended samples directory. The flaw lives in save_output(), which names forensic failure report samples after the email Subject header but falls back to the raw unsanitized Subject when sanitization yields an empty string - which occurs whenever the Subject consists entirely of path separators or dots such as '../../../'. The attacker-supplied email body is then written as a dot-prefixed .eml file to an ancestor directory of the configured samples path. No public exploit identified at time of analysis; exploitation additionally requires the --output flag to be enabled.
Query injection in n8n's Elasticsearch and Google Cloud Firestore workflow nodes allows a low-privileged authenticated user to escalate a single-document lookup into a full-collection read by injecting quote and brace characters into expression values. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. The CVSS 4.0 vector scores this at 6.3 with high subsequent-system confidentiality impact, reflecting that the vulnerable system itself is not directly compromised but the connected Elasticsearch or Firestore data stores can be fully exposed. No public exploit code or active exploitation has been identified at time of analysis.
Heap buffer out-of-bounds write in the MongoDB C Driver's BSON-to-JSON conversion helpers allows an unauthenticated party who supplies document content to corrupt a small number of bytes past the end of a heap-allocated buffer. The overflow is triggered specifically when a binary BSON field is being encoded and the caller has configured a maximum output length that causes the conversion to be cut short. Impact is limited to a low-integrity write of a few bytes adjacent to the buffer - no confidentiality loss and no confirmed availability impact - but heap corruption in native C applications can have unpredictable downstream effects depending on allocator layout. No public exploit code and no CISA KEV listing exist at time of analysis.
Authenticated OS command injection in CRMEB up to version 6.0.0 allows a backend administrator to execute arbitrary operating system commands by submitting malicious PHP code through the Custom Scheduled Task Feature's customCode parameter, which is passed directly to PHP's eval() function at /adminapi/system/crontab/save. The vendor characterizes this as intentional debug-only functionality, but the isSafePhpCode blacklist filter provides no meaningful containment against determined abuse. A public proof-of-concept exploit is available on GitHub, lowering the barrier to exploitation for any attacker who has obtained admin credentials.
Silent data corruption in MongoDB C Driver's BSON JSON parsing component allows unauthenticated network attackers to cause applications to silently store truncated or dropped numeric fields. CWE-681 (incorrect conversion between numeric types) triggers when an oversized text-encoded numeric value is parsed: the driver returns a success result while the resulting BSON silently shortens or omits the field entirely. Applications depending on this library for accurate numeric representation - without independent input validation - may persist corrupt data without any indication of failure, creating exploitable logical inconsistencies. No public exploit code or active exploitation has been identified at time of analysis.
IBM Qiskit SDK versions 2.1.0 through 2.5.1 crash when deserializing a specially crafted QPY (Quantum Python) payload, due to a CWE-502 deserialization flaw that triggers a segmentation fault. Local attackers who can supply malicious QPY data to a deserializing process can cause the application to crash, resulting in denial of service with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and IBM has released a patch via its support portal.
Uncontrolled resource consumption in 2FastLabs agent-squad up to version 1.1.4 allows a low-privileged remote attacker to degrade or deny service by manipulating the streaming agent response workflow through the `AgentSquad.routeRequest` function in `orchestrator.ts`. A public proof-of-concept exploit is available on GitHub, and the project maintainers had not responded to the disclosure at time of analysis, meaning no patch exists. The impact is limited to availability - no confidentiality or integrity compromise is indicated.
Cross-site scripting in Dify 1.13.0 allows unauthenticated remote attackers to inject arbitrary client-side script via the redirect_url argument processed by the router.replace function in the Splash Layout component. Exploitation requires a single user interaction - the victim must follow a crafted link - but no account or prior access to the Dify instance is required. A public proof-of-concept exploit was disclosed on GitHub Gist on or around 2026-07-05; the vendor did not respond to the coordinated disclosure, and no confirmed patch is available at time of analysis.
Reflected XSS in MISP's event attribute filtering query builder allows an unauthenticated attacker to execute arbitrary JavaScript in the security context of any authenticated MISP user who follows a crafted viewEventAttributes URL. The taggedAttributes and galaxyAttachedAttributes URL parameters are serialized via PHP's JsonTool::encode() with JSON_UNESCAPED_SLASHES and embedded raw into a <script> element; an attacker-controlled </script> sequence in either parameter breaks out of the script block and injects arbitrary HTML or JavaScript. Successful exploitation could yield session credential theft, unauthorized data modification, or any other action permitted by the victim's MISP role. No public exploit code or CISA KEV listing has been identified at time of analysis.
Hard-coded RSA private key exposure in the TP-Link Archer AX55 v4 web module allows a LAN-adjacent attacker who captures HTTP login traffic to decrypt the administrator password, since the shared private key is identical across all units of this model and the AES session key is additionally weakened. All Archer AX55 v4 firmware versions appear affected per the CPE wildcard, with a vendor patch now available via TP-Link's firmware portal. No public exploit code has been identified at time of analysis, though the cryptographic flaw is deterministic - once the static key is extracted from firmware, any captured login session can be decrypted offline.
Stored cross-site scripting via markdown HTML processing in Apache Allura through 1.20.0 permits an authenticated attacker to inject persistent malicious scripts that execute in the browsers of other users who view the compromised content - wikis, ticket comments, blog posts, or discussion threads. The vulnerability stems from insufficient sanitization of HTML embedded within markdown-rendered content across the forge platform's collaborative features. The Apache Software Foundation has released version 1.21.0 as the fix; no public exploit code or CISA KEV listing has been identified at time of analysis.
Identity injection in Rancher Manager before 2.15.1 allows a privileged Rancher user to hijack any other user's account by overwriting immutable identity provider fields. The /v3/users update API failed to strip principalIds and username from update payloads, so a user holding the update verb on users.management.cattle.io could inject an external IdP principal they control into any target account. The next time the attacker authenticates via that injected IdP principal, Rancher binds the session to the victim's account and the attacker inherits all its role bindings. No public exploit is identified at time of analysis, and a vendor patch is available in version 2.15.1.
Stored cross-site scripting in Apache Allura allows authenticated repository contributors to inject persistent JavaScript payloads through code repository content, executing in the browsers of any user who subsequently views the affected forge pages. All releases through 1.20.0 of this open-source software forge platform are vulnerable. The Apache Security Team released version 1.21.0 in September 2026 to address this issue, as credited to researcher n0mi1k via the oss-security mailing list; no public exploit code has been identified at time of analysis.
Unauthenticated cross-site scripting in WP Statistics WordPress plugin versions up to and including 14.16.11 allows remote attackers without any account to inject malicious JavaScript that executes in the browser of an authenticated user who visits the affected page. The CVSS scope change (S:C) reflects that injected scripts run in the victim's browser security context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Dify 1.13.0's WebApp Sign-In component allows remote attackers to inject malicious JavaScript by manipulating the redirect_url parameter consumed by the router.replace() function. The attack requires passive victim interaction with a crafted sign-in URL and low attacker privileges, limiting the immediate impact to integrity modification within the browser context. A public proof-of-concept exploit exists, and the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis.
Reflected cross-site scripting in itsourcecode Online Medicine Delivery System 1.0 allows an authenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `location` parameter of the `/index.php?q=orderdetails` endpoint. The attacker must induce a logged-in user to follow a crafted URL, at which point the unsanitized parameter value is reflected directly into the page response. A public proof-of-concept writeup on GitHub confirms exploitability; no KEV designation applies.
Denial of service in Hitachi Energy RTU500 Series CMU firmware allows an unauthenticated remote attacker to crash the IEC 60870-5-104 communication process by flooding the device with General Interrogation (GI) requests at short intervals. The high-load condition triggers a NULL pointer dereference in the last entry of the enhanced message queue, causing a BCI_IEC104 fatal write error, connection interruption, and automatic restart - severing bidirectional telecontrol communication. No public exploit code has been identified at time of analysis, and exploitation requires the ability to sustain elevated request rates against a reachable IEC 104 endpoint.
Authentication bypass in FluentBooking Pro (WordPress plugin) versions 2.2.1 and earlier allows unauthenticated remote attackers to circumvent booking authentication controls and achieve high integrity impact. The vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), carries a network-accessible attack vector with high complexity (AC:H), meaning exploitation requires specific conditions to be met. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 5.9 Medium score reflects the AC:H constraint that limits mass exploitation risk.
Improper TLS certificate validation in IBM Netezza Software 11.3.0.3 through Interim Fix 002 leaves encrypted connections susceptible to man-in-the-middle interception, allowing an unauthenticated network adversary to obtain sensitive information in transit. The flaw is classified under CWE-295, meaning the software either skips certificate chain verification, hostname matching, or revocation checks - permitting a fraudulent certificate to be silently accepted. IBM has released a patch via its support portal; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog.
Buffer overread in OpenVPN's Windows service component (`openvpnserv`) through version 2.7.6 exposes adjacent service process memory or crashes the service when NRPT domain entries containing Internationalized Domain Names (IDN) with UTF-8 encoding trigger an incorrect buffer size calculation (CWE-131). The flaw is Windows-specific and confined to split-DNS configurations that include non-ASCII domain names; Linux and macOS deployments are unaffected. The issue was discovered by BreachX Zero Day Labs and fixed in OpenVPN v2.7.7, co-released with four other security patches. No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper TLS certificate validation in IBM Netezza Software 11.3.0.3 through Interim Fix 002 (CWE-297) exposes encrypted database communications to interception via man-in-the-middle attacks. A network-adjacent or on-path attacker who can position themselves between Netezza clients and the server can intercept or manipulate traffic because the software fails to properly validate TLS certificates - likely failing to check hostname binding. No public exploit has been identified at time of analysis, and a vendor patch is available. EPSS data was not provided, but the network-accessible attack surface warrants prompt patching in any environment transmitting sensitive data.
Numeric truncation in the MongoDB C++ Driver's BSON library JSON parsing interface allows an attacker who controls text fed to that interface to read process memory beyond the input buffer, cause silent acceptance of a truncated document fragment as complete, or terminate the host process. Affected systems are any C++ applications embedding the driver that parse externally-controlled JSON; MongoDB server connectivity, credentials, and non-default configuration are explicitly not required. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.9 reflects both the constraint of requiring very large input documents and the local library-consumer trust boundary.
Key-ID (kid) bypass in the jwcrypto Python JOSE library allows an attacker who holds any valid key within a JWK set to forge a General JSON Serialization JWS that satisfies verification for a different kid, effectively impersonating another tenant, user, or service. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 7-10, Red Hat OpenShift AI (RHOAI), and Red Hat OpenStack Platform 16.2, wherever jwcrypto performs JWS signature verification with kid-based authorization. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score is not provided, but the integrity impact is high for multi-tenant architectures.
Integer wraparound in the MongoDB C Driver BSON library's JSON parser allows an unauthenticated party supplying a sufficiently large JSON document to crash any linked application on 32-bit-size builds. The overflow produces an undersized heap allocation that is freed, while a subsequent copy operation continues writing through the now-dangling pointer - a use-after-free sequence that terminates the host process. No public exploit code or active exploitation has been identified; impact is confined to denial of service, and the attack is constrained to 32-bit size builds of the library.
Process termination via out-of-bounds memory read affects the MongoDB C++ Driver's BSON document builder, caused by a numeric type conversion error (CWE-681) that misinterprets a field name length when an application supplies an extremely large, non-null-terminated field name in a specific form. All versions of the C++ Driver are indicated as in scope per the wildcard CPE. No public exploit code and no CISA KEV listing exist at time of analysis; MongoDB's own Jira (CXX-3548) is the sole public tracking reference, and no fixed release version has been disclosed in the available data.
Reflected cross-site scripting in the Kriesi Enfold WordPress theme through version 8.0 allows unauthenticated remote attackers to inject arbitrary JavaScript into the browsers of victims who click a crafted URL. The S:C scope change in the CVSS vector confirms the script executes in the victim's browser context, enabling session theft, credential harvesting, or forced actions under the victim's identity. No public exploit or active exploitation confirmed at time of analysis; reported by Patchstack.
Unauthorized write access to a MongoDB key vault collection allows an attacker to inject maliciously crafted key metadata into libmongocrypt, causing a legitimate authorized application client to issue arbitrary Google Cloud KMS API calls authenticated under the victim client's GCP identity. All versions of libmongocrypt are listed as affected via CPE wildcard (`cpe:2.3:a:mongodb:libmongocrypt:*`), with impact limited to deployments using MongoDB Client-Side Field Level Encryption (CSFLE) or Queryable Encryption configured with a Google Cloud KMS key provider. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Windows openvpnserv path-validation bypass in OpenVPN 2.7_alpha1 through 2.7.6 allows a low-privileged local user to circumvent administrative config-path restrictions by using '/' instead of '\' as a directory separator. Windows path-validation APIs do not recognize '/' as a separator while file-open APIs do, creating a mismatch exploitable to load a user-controlled OpenVPN config file that administrators have explicitly prohibited. Fixed in v2.7.7; no public exploit identified at time of analysis.
Authorization bypass in the light0011 cms PHP application allows unauthenticated remote attackers to circumvent access controls enforced by the Chapter Controller's initialization hook. The vulnerability resides in the `AuthController::_initialize` method within `App/Admin/Controller/ChapterController.class.php`, where the per-request authorization gate fails to enforce access control before handling chapter administration requests. Publicly available exploit code exists (confirmed by CVSS 4.0 E:P modifier), and the project maintainer has not responded to the responsible disclosure report, leaving the flaw unpatched.
Server-Side Request Forgery in the SEOPress WordPress plugin (through version 10.1) allows an authenticated attacker with low privileges to induce the server to make HTTP requests to arbitrary internal or external targets, potentially exposing internal network services and metadata endpoints. The S:C scope change in the CVSS vector confirms the vulnerability crosses trust boundaries - the plugin's server-side requests can reach systems beyond the WordPress host itself. No public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in MISP's dashboard ButtonWidget allowed an authenticated user to persist arbitrary URLs - including `javascript:` scheme values - through the `updateSettings()` whole-layout save endpoint, which lacked the widget-config validation that `updateWidgetSettings()` already enforced. A malicious URL stored via this unguarded path could reach client-side rendering or navigation, potentially executing script in the victim's MISP browser session and enabling actions or data access at that user's privilege level. Practical exploitability was substantially reduced by MISP's existing render-time URL validation, making this a defense-in-depth persistence-layer gap rather than a confirmed end-to-end XSS bypass; no public exploit or active exploitation has been identified.
Heap out-of-bounds read in FreeRDP before 3.31.0 allows a malicious RDP server to trigger adjacent heap memory disclosure and potential client instability by sending a crafted RFX_AVC444_BITMAP_STREAM during AVC444 chroma reconstruction. The root cause is a missing row-index bounds check in `general_ChromaV1ToYUV444` (and its ARM NEON and x86 SSE4.1 counterparts), causing `memcpy` to read past the end of the allocated luma plane when the server specifies specific frame geometry. No public exploit or CISA KEV listing exists at time of analysis; a confirmed fix is available in the 3.31.0 release.
Improper authorization in SpecterOps BloodHound through version 9.5.1 allows authenticated users holding only GraphDBRead permissions to invoke the PATCH /api/v2/domains/{objectID} write endpoint, effectively bypassing the intended write-permission gate. The commit diff confirms the root cause: the route handler called RequirePermissions(permissions.GraphDBRead) where it should have enforced GraphDBWrite, granting read-only users unauthorized ability to modify domain objects in the BloodHound graph database. No public exploit or CISA KEV listing is identified at time of analysis; the CVSS 4.0 score of 5.3 (PR:L) reflects the authentication prerequisite that limits the attack surface to already-authenticated principals.
Workflow names and execution statistics from arbitrary projects are exposed in n8n versions before 2.36.2 due to missing per-project authorization in the Insights API. Any authenticated user holding an insights-scoped credential can supply arbitrary `projectId` parameters to Insights API routes and retrieve analytics data from projects they have no membership in - a classic IDOR (Insecure Direct Object Reference) pattern. No public exploit code has been identified and the CVSS 4.0 score of 5.3 reflects the limited disclosure scope (execution metadata only, no credential or workflow-payload exposure).
Session invalidation without authorization in Peppermint through 0.5.5 allows any authenticated user to forcibly terminate the active sessions of any other account - including administrators - by supplying a victim's user ID to the GET /api/v1/auth/user/:id/logout endpoint, which performs no ownership check. The flaw (CWE-639) is traceable to the logout handler in apps/api/src/controllers/auth.ts and is documented in GitHub issue #529. No public exploit confirmed at time of analysis, and CVSS 4.0 scores this at 5.3, reflecting the limited direct impact (session termination only, no data exposure).
SQL injection in itsourcecode Online Medicine Delivery System 1.0 allows remote authenticated customers to manipulate the backend database via the `proid` parameter in the `addwishlist` function at `/customer/controller.php?action=addwish`. Any valid customer-level session can submit a crafted POST request to extract or modify database contents, including potentially customer PII, credentials, and order records. No KEV listing exists; CVSS 4.0 scores this 5.3 (Medium), reflecting the authentication barrier (PR:L) and limited per-component impact ratings.
Server-side request forgery in n8n before 2.34.1 allows authenticated low-privileged users to bypass SSRF protection in Code and Function nodes by simultaneously supplying a safe uri parameter and a malicious url parameter to the legacy request helper function. Because the SSRF validation inspects only uri while the HTTP client dispatches using url when both are present, the safety check is rendered ineffective and internal network addresses become reachable. No public exploit or active exploitation has been identified at time of analysis, but the bypass technique is straightforward for any user with Code or Function node authoring rights.
Authenticated low-privileged users in MISP can receive OnDemand correlation results that reference attributes and events they are not authorized to access, bypassing the platform's distribution, sharing-group, organization, and event-level access controls. The flaw resided in `OnDemandCorrelationBehavior.php`, where `__collectCorrelations()` matched attributes by value alone and never filtered results against the requesting user's ACL - meaning any authenticated user could learn that a specific indicator value (IP address, hash, domain) appears in a restricted event belonging to another organization or sharing group. No public exploit has been identified at time of analysis; a vendor patch is confirmed as commit f51342f30 in the MISP GitHub repository.
Fleet controller's Helm template preprocessing exposes cluster metadata and internal DNS topology to any user with write access to a GitRepo-tracked repository, via a server-side request forgery path that abuses name resolution. Affected releases span all active branches from 0.12.0 through 0.16.0, with patched builds released across each branch. The DNS-based exfiltration channel is notable because it can remain effective in environments where outbound TCP/UDP egress is otherwise restricted, making standard network perimeter controls insufficient as a compensating measure.
Unauthenticated information disclosure in SureForms (WordPress form-builder plugin by Brainstorm Force) versions through 2.12.5 allows remote attackers to access restricted data by manipulating user-controlled object identifiers. The root cause is CWE-639 - Authorization Bypass Through User-Controlled Key - a classic IDOR pattern in which the plugin returns object-level data without verifying that the caller has rights to the requested record. Reported by Patchstack; no active exploitation or public proof-of-concept has been identified at time of analysis.
Server-side request forgery in NousResearch hermes-agent 0.18.0 allows authenticated remote attackers to issue arbitrary HTTP requests from the application server by supplying a crafted URL to the fetchLinkTitle function in the Link Title Fetch component (apps/desktop/src/app/artifacts/index.tsx). The CVSS 4.0 vector (PR:L, VC:L/VI:L/VA:L) indicates limited but real impact: an attacker with valid credentials could probe internal network services, cloud metadata endpoints, or otherwise unreachable hosts. No public exploit code and no vendor patch have been identified; the vendor did not respond to coordinated disclosure.
Missing authorization on Oppia's AdminRoleHandler GET endpoint (through v3.5.2) exposes privileged account enumeration to any registered user. The endpoint in core/controllers/admin.py is decorated with open_access instead of an admin-only access control decorator, allowing authenticated non-admin users to query filter_criterion parameters and retrieve usernames holding specific roles, banned-user flags, and managed topic identifiers. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the organizational structure disclosure it enables facilitates targeted follow-on attacks against administrative accounts.
Stored cross-site scripting in MOOS core-moos through 10.4.0 allows any MOOS publisher to inject script payloads into the MOOSDB HTTP monitoring interface. Because MOOS clients are inherently unauthenticated by protocol design, attackers with network access to a MOOS community can set variable names, values, source process names, or community names to contain HTML/script markup that is rendered unescaped in the operator's browser. The fix (PR #78) adds a comprehensive HTMLEscape() function covering all attacker-controlled database fields, plus a restrictive Content-Security-Policy header as a secondary control.
Broken object-level authorization in the LearnPress WordPress LMS plugin before 4.4.6 allows authenticated Instructor-role users to inject quiz answers into questions owned by other instructors. The answer-insertion endpoint accepts arbitrary question identifiers without verifying ownership, enabling persistent cross-instructor content tampering. No public exploit is identified and the vulnerability is not listed in CISA KEV; a patched version (4.4.6) is available.
Missing authorization checks in Ultimate Maps by Supsystic WordPress plugin (versions through 1.5.3) allow unauthenticated network attackers to perform restricted write-class operations by exploiting incorrectly configured access control security levels. Reported by Patchstack via audit, this is a CWE-862 broken access control weakness where plugin endpoints lack proper capability checks before executing state-changing actions. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in AVideo's userLogin.php allows unauthenticated network attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted cancelUri parameter. The isSafeRedirectURL validation function restricts only the URL protocol, leaving HTML metacharacters unchecked; a relative URL containing embedded quotes and event handlers bypasses the check entirely and is reflected verbatim into the href attribute of the Cancel button. Exploitation requires a victim to interact with the Cancel button after following a malicious link, placing this in the phishing-dependent reflected-XSS risk class.
Reflected XSS in AVideo's videoEmbeded.php allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers by delivering a crafted embed URL. The `link` GET parameter is echoed verbatim inside an HTML comment with no escaping, so injecting the sequence `-->` closes the comment context and enables arbitrary script injection. No active exploitation has been confirmed per CISA KEV, but the zero-friction delivery model - a victim clicking a malicious embed link - makes this a realistic phishing-chain enabler against authenticated AVideo users.
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. The vendor CPE attributes this to Nexcess (cpe:2.3:a:nexcess:bookit). No public exploit code or CISA KEV listing has been identified at time of analysis.