Local File Inclusion in the Divi Ajax Filter WordPress plugin (all versions through 5.1.2) lets remote unauthenticated attackers include and execute arbitrary .php files on the server via the 'custom_loop_template' parameter. Reported by Wordfence and rated CVSS 9.8, it enables access-control bypass, sensitive-data disclosure, and - where an attacker can plant a .php file (e.g. through an upload) - remote code execution. No public exploit has been identified at time of analysis and the plugin is not in CISA KEV.
Unauthenticated remote code execution in Voltronic Power SNMP Web Pro 1.1 lets remote attackers gain root on the device by POSTing a crafted tar archive to the upload.cgi firmware-update endpoint. Because the archive is extracted into a privileged directory and its contents executed as root without any credential check, a single request yields full system compromise. Publicly available exploit code exists (VulnCheck advisory plus a GitHub PoC); this is not yet listed in CISA KEV.
Local privilege escalation in Acunetix 25.11.251107123 for Windows enables low-privileged local users to execute arbitrary code as SYSTEM by exploiting CWE-427 (Uncontrolled Search Path Element) in the wvsc.exe Web Vulnerability Scanning Engine. The SYSTEM-level wvsc.exe process searches for OpenSSL-related files at a hardcoded directory path that does not exist by default; an attacker creates the missing directory and plants a malicious file, which the service subsequently loads and executes, yielding full SYSTEM-level control. A public proof-of-concept is available via the Full Disclosure mailing list and corroborated by a VulnCheck advisory, making this trivially reproducible by any local user on affected Windows installations.
Arbitrary physical memory write via a hard-coded cryptographic key in the shared Windows kernel driver DirectIo64.sys affects PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016). An attacker with local low-privilege access can extract the 8-byte key embedded as a hardcoded literal in the distributed binary, compute valid MD5 authentication tags for arbitrary IOCTL write requests, and additionally use the driver's own bit-clear IOCTL to permanently disable all MAC verification, size checks, and Vendor ID checks - enabling unrestricted writes to arbitrary physical memory locations. A publicly available proof-of-concept exploit exists on GitHub; no confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the published PoC significantly lowers the exploitation bar.
Full physical memory disclosure in PassMark's shared kernel driver DirectIo64.sys affects PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) on Windows. A low-privileged local attacker can issue a single IOCTL call supplying an attacker-controlled output path, causing the driver to enumerate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a complete RAM image to disk in SYSTEM context and bypassing user-mode ACLs. Exposed data includes LSASS working-set memory, per-process heap contents, and in-use cryptographic keying material from all running processes. A public proof-of-concept is available at GitHub and no active exploitation (KEV) has been confirmed at time of analysis.
Privilege escalation in PassMark's shared DirectIo64.sys kernel driver, bundled with PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allows any low-privileged local user to gain complete hardware-level control over the host. The driver exposes IOCTLs without validating the target device, register offset, or value, enabling arbitrary PCI configuration space reads and writes. An attacker can leverage this to enable Bus Master DMA on any PCI device, remap Base Address Registers to attacker-controlled physical memory addresses, or halt storage controller I/O - all without kernel exploits. A public proof-of-concept is available; no active exploitation (CISA KEV) confirmed at time of analysis.
Unprivileged local users can issue privileged hardware IOCTLs through PassMark's DirectIo64.sys kernel driver across three PassMark products - PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) - because the driver's device object is created without a security descriptor, allowing Windows to apply a permissive default ACL. Any standard Windows user account can open a handle to the device and invoke kernel-level hardware operations regardless of their privilege or integrity level, effectively bypassing Windows privilege boundaries. A public proof-of-concept is available on GitHub, and vendor patches have been released for all three affected products.
Physical memory disclosure and arbitrary SYSTEM-context file write in PassMark PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016) are caused by the shared DirectIo64.sys kernel driver accepting a single IOCTL with no caller-identity validation. Any unprivileged local Windows user can invoke the handler to dump all physical memory in PAGEDU64 crash-dump format to an attacker-chosen path, with the write executed in SYSTEM context - enabling cross-process memory extraction, credential harvesting, and writes to otherwise-inaccessible filesystem locations. Publicly available exploit code exists (GitHub repository confirmed by VulnCheck); no active exploitation has been confirmed in CISA KEV at time of analysis.
Infinite-loop denial-of-service in smol-toml (npm, squirrelchat) before version 1.7.1 allows remote unauthenticated attackers to permanently hang any Node.js service that parses attacker-controlled TOML. The trigger is a crafted value inside a TOML array or inline table followed by a comment character with no trailing newline - when this input reaches the parser, skipUntil() in src/util.ts receives -1 from indexOfNewline() and resets the cursor to position zero instead of terminating, spinning indefinitely and consuming all processing capacity. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.2 and the trivially constructible trigger make this straightforward to weaponize against any exposed TOML-parsing endpoint.
Fail-open password validation in Chew, Kean Ho's Actualizer v1.2.0 installer allows a build host with an incompatible mkpasswd implementation to produce Debian images with empty root and alpha account password fields. The installer script Shell/debian-minbase-install.sh invokes mkpasswd to generate yescrypt hashes but never validates whether the output is a valid yescrypt hash or even non-empty, proceeding unconditionally when mkpasswd silently fails. Deployed images built under this condition may permit passwordless authentication to the root and alpha accounts, depending on the PAM configuration of the target system. No public exploit is required; the flaw is self-triggering under a specific but plausible build-host misconfiguration. Vendor-released patch is available in v1.2.1.
Cross-workspace IDOR authorization bypass in AppFlowy-Cloud 0.9.64 allows authenticated users to read, modify, or delete documents and database rows belonging to other users' workspaces. The Casbin-based access control layer in `libs/access-control/src/casbin/collab.rs` validates a user's membership in their own workspace but fails to confirm that the requested collab object actually belongs to that workspace, enabling object ID substitution attacks across the HTTP API. No public exploit code has been identified at time of analysis, though the flaw is fully documented in a public GitHub issue.
Privilege escalation to root/SYSTEM in IXON VPN Client before 1.4.7 lets an attacker inject arbitrary configuration directives via a CRLF (improper neutralization, CWE-93) flaw: the client's local configuration interface accepts changes without authenticating or verifying the requester's origin, writes those values to a file, and a privileged subprocess later consumes them. By embedding line-ending sequences the attacker smuggles additional directives that run with elevated privileges. Because the malicious config persists across client restarts and OS reboots while the VPN keeps functioning normally, the compromise is stealthy with no user-visible change. No public exploit identified at time of analysis; no CISA KEV listing.
Privilege escalation with arbitrary code execution in the Hummingbird Performance WordPress plugin (versions 3.15.0 through before 3.21.2) allows any site-level administrator on a WordPress multisite network to access and modify a network-wide configuration setting that should be gated to super admins, achieving code execution across all sites on the network. The vulnerability stems from missing capability enforcement (CWE-94) on a sensitive network-scope action. A publicly available proof-of-concept exists, and the vendor has released a patched version (3.21.2) addressing the access control gap.
Broken object-level authorization in the Classified Listing WordPress plugin (versions 5.3.0 through pre-6.1.1) allows any authenticated subscriber-level user to permanently delete media attachments from, or attach arbitrary files to, listings owned by other users by invoking the plugin's AI image-editing AJAX action with a victim's listing ID. The handler performs no ownership or capability verification before acting on the supplied identifier (CWE-639), meaning the lowest default WordPress role is sufficient to tamper with any listing on the platform. A publicly available proof-of-concept exists per WPScan; no active exploitation has been confirmed in the CISA KEV catalog at time of analysis.
Local privilege escalation to kernel in PassMark PerformanceTest, BurnInTest, and OSForensics allows a low-privileged local user to achieve arbitrary physical memory bit-clearing via an exposed, unvalidated IOCTL in the shared DirectIo64.sys kernel driver. By supplying a crafted 64-bit physical address and bit index to the driver, an attacker can invoke MmMapIoSpace to map and modify kernel code pages or page table entries, yielding full system compromise. A public proof-of-concept is available and patches have been released by PassMark across all three affected product lines.
Privilege escalation and kernel DoS in PassMark's shared DirectIo64.sys kernel driver affect PerformanceTest (before 11.1 build 1012), BurnInTest (before 11.1 build 1000), and OSForensics (before 11.1 build 1016), allowing a local low-privileged attacker to read arbitrary Model-Specific Registers or write zero to any MSR via IOCTLs with an insufficient blocklist. Writing zero to the system call handler MSR (e.g., IA32_LSTAR) causes an immediate unrecoverable kernel panic on the next system call, while reading security-sensitive MSRs (such as those storing kernel base addresses) enables KASLR bypass to support privilege escalation chains. A public proof-of-concept is available via GitHub, and vendor patches have been released; no KEV listing at time of analysis.
Arbitrary file read in the Pods WordPress plugin before 3.3.9.2 allows users holding the Author role or higher to exfiltrate any file accessible to the web server process, including sensitive files outside the web root such as wp-config.php or system credentials. The flaw stems from the plugin's display callback resolver accepting unrestricted PHP callable targets without allowlisting. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available. The attack surface is limited to installations operating in restricted display-callback mode, which is the automatic default for WordPress sites whose initial Pods installation predated version 3.1.
Privilege escalation in Inductive Automation Ignition 8.1.53 and earlier allows any authenticated user who can execute gateway scripts to create SCADA/HMI projects without restriction, because the Gateway 'Create Project Role(s)' setting shipped with a blank default - effectively disabling the access control gate entirely. In industrial control system (ICS) environments, unauthorized project creation is operationally significant: projects define the logic, tags, and screens that interact with physical process equipment. Ignition 8.1.54 closes the gap by restricting project creation to Designer sessions, removing reliance on the misconfigured role setting. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Missing authorization enforcement in Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior allows low-privilege authenticated users to access restricted endpoints and extract system credentials, device configurations, and raw flash memory contents. Disclosed by CISA ICS-CERT under advisory ICSA-26-246-08, this affects an OT-class DC power monitoring appliance where credential extraction could enable full device takeover. No active exploitation or public proof-of-concept has been identified at time of analysis, but the straightforward exploitation path and ICS context elevate real-world risk.
Cross-site request forgery in Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior allows a remote unauthenticated attacker to perform unauthorized state-changing operations on an industrial DC power monitoring device by tricking an authenticated administrator into visiting a malicious webpage. Reported via CISA ICS-CERT advisory ICSA-26-246-08, the vulnerability is rooted in a missing anti-CSRF mechanism in the device web interface; a firmware upgrade to v2.4.2 is available. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the OT deployment context elevates operational consequence.
Cross-workspace data exfiltration in AppFlowy-Cloud through 0.9.64 allows authenticated users to read documents and databases from workspaces they are not members of. The `establish_ws_connection_v2` WebSocket handler in `src/api/ws.rs` omits workspace membership validation, permitting any valid session to bind to arbitrary workspace contexts. By subsequently transmitting sync Manifest messages containing victim object identifiers, an attacker retrieves full collaboration document and database state without any victim interaction required. No public exploit identified at time of analysis, though the VulnCheck advisory and referenced GitHub issue provide sufficient technical detail to reconstruct the attack.
Unauthenticated remote root compromise of ASUS Control Center (Enterprise/ACC) is possible by chaining a missing-authentication flaw, an SSRF, and hard-coded credentials: an attacker retrieves the product's encryption key over a plain HTTP request, which causes a local service to enable SSH on port 2222, then logs in with built-in credentials to gain a root shell. From that shell an attacker can read, write, and delete all ACC data and remotely control every managed server, PC, and workstation in the environment. ASUS assigns CVSS 4.0 base 10.0; no public exploit identified at time of analysis.
Unauthenticated remote code execution in PowerJob Worker 5.1.2 (and likely earlier) stems from the /worker/deployContainer HTTP endpoint being reachable on the default transport port with no authentication, letting a remote attacker deploy and run an arbitrary container/module and thereby execute code on the worker host. PowerJob is a widely-forked open-source Java distributed job-scheduling framework, and the worker component is the execution plane that runs scheduled tasks. A public gist referenced alongside the advisory appears to contain proof-of-concept material, though the entry is not listed in CISA KEV.
Remote code execution and full site takeover affect the AI Website Builder WordPress plugin (GitHub build 1.0.0), whose REST API routes perform no authorisation or nonce validation. Unauthenticated attackers can install and activate arbitrary plugins and themes, import content from a URL they control, write an arbitrary file into wp-content/uploads, and delete site content and media - any of the code-installation paths yields RCE, and the arbitrary uploads file write is directly RCE on hosts that serve PHP from the uploads directory. No public exploit identified at time of analysis, but the trivial unauthenticated network attack surface (CVSS 9.8) makes this a critical-priority issue for any site running the affected build.
Unauthenticated path traversal file deletion in the Frontend Admin by DynamiApps WordPress plugin before 3.29.13 allows remote attackers to delete index.php and .htaccess files from the WordPress root directory, rendering the site entirely inoperable. The flaw stems from insufficient validation of a user-controllable directory path parameter prior to file deletion operations, exploitable without any authentication credentials. A publicly available proof-of-concept exists; exploitation is constrained by a non-default form configuration requirement, reflected in the CVSS AC:H scoring.
Improper access control in Ninja Forms WordPress plugin (versions 3.14.0 through 3.15.1) allows any user holding a plugin-specific capability to exploit overly permissive REST API endpoints well beyond their intended scope. An attacker authenticated with that capability can read all stored form submissions and plugin settings, overwrite the plugin's configuration, and create or modify arbitrary WordPress posts and pages - operations ordinarily reserved for site administrators. A publicly available proof-of-concept exists per the WPScan advisory, though exploitation depends on a non-default administrative delegation step; no CISA KEV listing has been identified.
We need answer as JSON only. Need synthesize. Need follow all rules. Need inspect input. CVE-2026-75429. Description: PowerJob versions 4.x through 5.1.2 contain unauthenticated remote code execution vulnerability in /friend/process endpoint of Server-Worker transport layer. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-287 auth bypass. EPSS 0.62 percentile 47. Reported by mitre. CPE cpe:2.3:a:n/a:n/a. Tags Authentication Bypass, RCE, N A. ENVA EUVD. Affected versions EUVD ["n/a n/a"]. References GitHub PowerJob, docker compose, gist, NVD, PoC repo, vuldb. Need produce fields. Let's ensure all plain string except data_quality_flags array. Product_name: PowerJob. 1-3 words. Summary: original synthesis, not copy. Say "Unauthenticated remote code execution in PowerJob 4.x through 5.1.2 allows remote attackers to execute arbitrary code via the /friend/process endpoint in the Server-Worker transport layer." Mention active exploitation? KEV not provided? Input no KEV status. Need use only KEV status if explicitly. No KEV. POC? References include GitHub repo "CVE-2026-75429_PowerJob_friend_process_RCE" likely POC exists. Input doesn't have POC field but reference indicates public PoC. We can say publicly available exploit code exists based on reference? The rule says if POC=YES in input, but input doesn't label POC. We can use references to infer POC exists? Risk assessment uses POC availability. Need be careful. We can say "a public exploit/POC repository is referenced" maybe. Summary should mention if POC exists and EPSS. EPSS 0.62% low. Also "no public exploit identified"? But reference title suggests exploit. Use "public exploit code is referenced" as inference. But "Exploitation status — use ONLY these phrases": if KEV=YES confirmed actively exploited; if POC=YES but no KEV: publicly available exploit code exists; if neither: no public exploit identified at time of analysis. We don't have POC=YES field but has ref. Is there an input POC? No. But multi-source int
Remote code execution in DocsGPT 0.15.0 and earlier arises from its custom-prompt feature, which passes user-supplied prompt content into Jinja template rendering with no sanitization or sandboxing. An unauthenticated attacker can submit crafted template expressions to achieve server-side template injection (SSTI) that escalates to full RCE on the host running the chatbot backend. VulDB has published an entry and a public writeup/PoC repository exists, though the flaw is not listed in CISA KEV and SSVC records exploitation status as 'none'.
SQL injection in IBM Operational Decision Manager (versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, and 9.6.0.0) lets a remote unauthenticated attacker inject arbitrary SQL statements and abuse database write functionality to drop a web shell into the application web root, escalating a data-access flaw into full remote code execution. The CVSS 9.8 rating reflects unauthenticated network reach with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, but the attack primitive (SQLi-to-webshell) is well understood and reliably weaponizable.
Analysis complete. The JSON synthesis is above. Key findings for **CVE-2026-78745** (Weyon/HiDPT HiDPTAndroid on Hi3751V350): - **Vulnerability**: Unauthenticated RCE via a network-reachable ADB daemon (adbd) with authorization bypassed/disabled — CWE-284, an exposed privileged debug interface, not a memory bug. - **Signals cross-referenced**: CVSS 9.8 is technically defensible on affected devices, but EPSS is low (0.42%, 35th pct), it's not in KEV, and a public PoC exists (`n0c71v3x/CVE-2026-78745`). Real-world exposure is bounded by whether adbd is reachable beyond the LAN — consumer TVs typically sit behind NAT. - **Metadata problems flagged**: wrong "Google" vendor tag (Android-based ≠ Google product), "N A" placeholder tag, and an `n/a:n/a` CPE. No prompt-injection note was present in this input (it was clean). Saved to memory as `cve-2026-78745.md` with an index entry.
Done. The analysis is above as the JSON object. Key points of the synthesis: - **Same FreeIPMI 1.6.19 cluster** as CVEs 85504/85507/85508 already tracked — all client-side stack overflows (CWE-121) triggered by a malicious/compromised BMC returning oversized responses. - **CVSS 9.8 is overstated**: this is a client-side/rogue-BMC flaw, not an internet-facing service. I assessed it down to `AC:H/UI:R` (needs attacker control of a BMC plus an operator/job initiating the FRU read). - **Metadata is clean** — vendor tag, CPE, and CWE all correct, and no embedded injection note this time — so `data_quality_flags` is `[]`. - Fix confirmed as 1.6.19; no EPSS/KEV/POC signal, so exploitation status is unknown. Memory updated with the new CVE note and index entry.
Stack-based buffer overflow in GNU FreeIPMI's ipmi-oem tool (before 1.6.19) affects the _output_dell_system_info_cmc_ipv6_info routine reached through the 'dell get-system-info cmc-ipv6-info' subcommand. Because the flaw lies in code that parses the response returned by a Dell CMC/BMC, an attacker who controls (or can MITM) the IPMI device an operator queries can corrupt the client's stack and potentially execute code on the management host. This is one of several FreeIPMI OEM-parser overflows fixed together in 1.6.19 (disclosed on oss-security 2026-08-28); no public exploit identified at time of analysis.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (all versions before 1.6.19) can corrupt memory in the client host when the 'dell get-system-info cmc-info' subcommand parses a CMC info response, potentially leading to code execution in the context of the operator running the tool. The flaw lives in the response-handling routine _output_dell_system_info_cmc_info (ipmi-oem/ipmi-oem-dell.c), so it is triggered by the data returned from the queried BMC/CMC rather than by an inbound network request. No public exploit identified at time of analysis, and it is not in CISA KEV; EPSS data was not provided.
Stack-based buffer overflow in FreeIPMI's ipmi-oem utility (versions before 1.6.19) lets a malicious or compromised Dell iDRAC BMC corrupt the memory of the client host running the 'dell get-system-info idrac-info' subcommand, potentially achieving code execution in the context of the operator (often root). The flaw sits in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c, which copies attacker-influenced OEM response data into a fixed-size stack buffer without bounds checking. No public exploit identified at time of analysis; disclosed via oss-security and fixed in FreeIPMI 1.6.19.
Stack-based buffer overflow in GNU FreeIPMI before 1.6.19 lets a malicious or compromised Fujitsu iRMC BMC corrupt client memory when the FreeIPMI tooling parses malformed Fujitsu SEL 'long text' responses in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text. Successful exploitation can crash the client or execute arbitrary code in the context of the process reading the System Event Log (typically ipmi-sel or libfreeipmi consumers). No public exploit is identified at time of analysis, and the flaw is fixed in FreeIPMI 1.6.19.
Authentication bypass in IBM i (the operating system for IBM Power servers, formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to gain unauthorized access by supplying malformed or manipulated authentication parameters that the system fails to validate correctly. Rated CVSS 9.8, the flaw grants full compromise of confidentiality, integrity, and availability without prior credentials. No public exploit identified at time of analysis, and EPSS is low (0.32%, 24th percentile), indicating no observed mass exploitation despite the critical score.
Unauthenticated account takeover in the ACPT (Premium) WordPress plugin (versions up to and including 2.0.66) lets remote attackers hijack any account, including administrators. The plugin's submit() handler processes anonymous form submissions without verifying that the submitter is authorized to modify the targeted user, then passes an attacker-controlled user ID to wp_update_user(), allowing the attacker to overwrite that user's email address and password. Reported by Wordfence; no public exploit and no CISA KEV listing at time of analysis, but the CVSS 9.8 rating reflects a trivially weaponizable full-compromise path where a vulnerable form is exposed.
Remote code execution in easyadmin v2.0.2.2 lets attackers with access to the background management interface upload a crafted file of a dangerous type (e.g. a PHP webshell) and execute arbitrary code, gaining server-level privileges. The flaw is a classic unrestricted file upload (CWE-434) in an admin-only feature; the description specifies authenticated access despite the provided CVSS vector marking it as requiring no privileges. EPSS is low (0.24%, 15th percentile) and there is no evidence of active exploitation, though a researcher issue writeup is referenced.
We need answer JSON only. We need synthesize. Let's inspect input. CVE-2026-75171: HubCore v.14.1.1 session cookie handling privilege escalation. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-384 Session Fixation. EPSS 0.22 percentile 13. No KEV. POC? References GitHub vulnerability-research maybe includes POC? It says references [cveorg] GitHub SilviaMun vulnerability-research/tree/main/CVE-2026-75171. That could be POC/research. We need use all. Tags: Privilege Escalation, Session Fixation, N A. CPE n/a. Product HubCore. Need product name "HubCore". Summary original synthesis not copy description. Mention session fixation? Need likely issue: session cookie handling allows privilege escalation via HUBCOREID cookie. Remote attacker unauthenticated? CVSS says PR:N, UI:N. So unauthenticated remote. Need state POC exists? Reference likely public research repo named CVE. We can infer publicly available exploit code? Need cautious: no explicit POC flag. The GitHub link is "vulnerability-research" might contain details/POC. We can say "a public vulnerability research repository for this CVE is referenced" but don't claim public exploit unless know. Field summary should mention if POC exists and EPSS risk. Per rules "If POC=YES but no KEV: publicly available exploit code exists". Input didn't have POC boolean, but reference GitHub SilviaMun/vulnerability-research may be POC. We can mention "a public research repository exists" not "exploit code exists" maybe. But need extraction maybe confidence_notes. Let's parse each field. product_name: "HubCore". Summary: Need 2-3 sentences, original. Start with specific impact verb and product. E.g. "Privilege escalation in HubCore v.14.1.1 permits remote attackers to hijack or forge the HUBCOREID session cookie, gaining elevated privileges. The vulnerability stems from improper session cookie handling (CWE-384) and is rated CVSS 9.8 with network, low complexity, no privileges or user interaction. No CISA KEV activity; EPSS 0.2
Account takeover in slimkit ThinkSNS+ v2.4 allows a remote unauthenticated attacker to hijack arbitrary user accounts by abusing the password-reset flow, where the ResetPasswordController.php component continues to accept verification codes after they should have expired. Because expired codes remain valid (enabling reuse/replay of a code well past its lifetime), an attacker can complete a password reset for a targeted account and gain full control. No public exploit code is confirmed, though a detailed technical writeup exists; EPSS is low (0.21%) and the issue is not on CISA KEV.
Missing authentication on the MQTT broker of CDAC's Trueview 6.0.23.4 lets any remote attacker with network reach to TCP port 1883 open an MQTT session and freely subscribe to or publish on all topics. Because the broker requires no credentials, an attacker can read every message flowing through the system and inject arbitrary messages, undermining the confidentiality and integrity of whatever data and control functions Trueview routes over MQTT. EPSS is low (0.21%, 11th percentile) and SSVC records no observed exploitation, but the flaw is fully automatable with total technical impact; no public exploit code is identified at time of analysis, though a GitHub writeup documents the issue.
SQL injection in OASYS sysoa 1.0 lets remote attackers inject arbitrary SQL through the unsanitized 'outtype' parameter of the /outaddresspaging endpoint. The CVSS 3.1 vector (PR:N) indicates no authentication is required, and the advisory claims the flaw can be escalated to arbitrary code execution. A public write-up with proof-of-concept details exists on GitHub, though EPSS estimates only a 0.20% exploitation probability and the CVE is not on CISA KEV - no public exploit is confirmed weaponized in the wild.
Remote code execution in esoTalk v1.0.0g4 arises from configuration comment injection that allows attacker-controlled input reaching ETMemberModel, ETMemberController and ET.class.php to be persisted into a PHP configuration file and subsequently interpreted as code (CWE-94). Documented only in a third-party Notion writeup with no public exploit tool; EPSS is low at 0.19% (9th percentile). No public exploit identified at time of analysis and the CVE is not in CISA KEV.
Session hijacking in the Canva Android App before 2.376.0 lets an attacker-controlled web page interact with the Canva application using the victim's authenticated session because an external origin could be loaded inside a privileged WebView (CWE-940). A threat actor who lures a user into loading a malicious page can send requests to Canva as the user, reading and modifying account data. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Cross-tenant RBAC hijacking in IBM Observability with Instana Agent Operator (Builds 1.0.303-1.0.323) lets an authenticated Kubernetes tenant overwrite or delete another tenant's shared cluster-level RBAC binding. Because cluster-scoped RBAC objects are keyed only by the bare custom-resource name with no namespace disambiguation, a low-privileged tenant who creates a same-named InstanaAgent CR in a namespace they control can silently clobber or revoke a victim tenant's ClusterRoleBinding, destroying that agent's cluster monitoring access. No public exploit identified at time of analysis; a vendor patch is available.
Sensitive database exposure in code-projects Vehicle Management System 1.0 allows unauthenticated remote attackers to download the raw SQL database backup file at /vehicle_management.sql directly over HTTP, leaking the full application database contents. The backup file is stored in or under the web root with no access controls, making it trivially accessible to any internet-connected attacker. A public proof-of-concept is available, and no vendor patch has been identified at time of analysis.
Out-of-bounds read in Valkey's cluster slot-migration RDB loader allows a network-positioned attacker to crash affected servers by supplying a crafted RDB file with a truncated `job_name` field in an `RDB_OPCODE_SLOT_IMPORT` record. Valkey versions up to 9.0.4 and 9.1.0 running in cluster mode are affected; the vulnerable `createSlotImportJob()` function in `src/cluster_migrateslots.c` performs a fixed 40-byte `memcpy` without first validating that the loaded `job_name` is exactly `CLUSTER_NAMELEN` bytes, triggering CWE-125 on undersized input. A public proof-of-concept is available via GitHub issue #4207, and patched releases 9.0.5 and 9.1.1 are confirmed available.
Remote code execution in OpenTalker SadTalker allows attackers to run arbitrary OS commands by supplying audio files whose names contain shell metacharacters, which are interpolated unescaped into ffmpeg command lines during video muxing (CWE-78). Any deployment that accepts attacker-influenced audio uploads and then generates video is affected; the flaw was reported by VulnCheck with an accompanying advisory, though no public exploit code or active exploitation has been identified at time of analysis. The CVSS 4.0 base score of 9.3 reflects unauthenticated network-triggerable full-system compromise.
OS command injection in getomni-ai's zerox 1.1.20 (the node-zerox document-to-markdown library) lets remote attackers execute arbitrary shell commands by supplying a document URL whose file extension contains command-substitution syntax. The unsanitized extension is interpolated into shell commands run by poppler utilities during file download, so injection fires before any document processing. Reported by VulnCheck; no public exploit code is identified at time of analysis and it is not in CISA KEV, though the fix issue is public.
Missing authentication on the admin WebSocket endpoint in trape 1.0.0 and 2.0 exposes operator tracking sessions to unauthenticated remote attackers. The `join_room` function in `core/sockets.py` performs no credential check before admitting a caller to the admin room, meaning any network-reachable party can connect to the socket and observe victim tracking data intended solely for the trape operator. A public exploit exists via a GitHub issue report; the project maintainer has not responded to the disclosure.