Hard-coded SFTP credentials embedded in SmartIT Desktop Manager (by Lightstar) allow unauthenticated remote attackers to extract credentials from application source code and authenticate directly to the SmartIT Agent's SFTP service, enabling arbitrary file system browsing on the victim host. The vulnerability is CVSS 4.0-scored at 6.9 with no-privilege, network-accessible exploitation, though real-world impact is limited to read-only directory traversal rather than full compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition in jofpin trape 2.0 allows remote unauthenticated attackers to manipulate telemetry data via the vId argument in core/user.py's Telemetry Endpoint, yielding low-impact confidentiality, integrity, and availability compromise. Exploitation is rated high complexity (AC:H) due to the timing requirements inherent in race condition attacks, and the CVSS 4.0 base score is 2.9. A public proof-of-concept exists as a GitHub issue report (#408); the project maintainer has not responded to the disclosure.
Webhook signature verification bypass in LobeChat 2.2.1 allows unauthenticated remote attackers to inject forged inbound messages into bot conversations by exploiting missing or skippable signature checks in the QQ and Feishu platform adapters. The QQ adapter performs no Ed25519 verification whatsoever, while the Feishu adapter's static-token check is entirely skipped in default deployments where no token is configured. An attacker who knows the webhook URL can spoof arbitrary sender identities and message content, causing the bot owner's agent to process fully attacker-controlled input as a trusted platform event. No public exploit code is identified at time of analysis; CVSS 4.0 scores the issue at 6.9, reflecting moderate confidentiality and integrity impact with no availability consequence.
Privilege escalation through the DirectIo64.sys kernel driver affects three PassMark products - PerformanceTest before build 1012, BurnInTest before build 1000, and OSForensics before build 1016 - allowing any local Windows user with low privileges to issue arbitrary x86 IN/OUT instructions to hardware I/O ports via exposed IOCTLs that lack allowlist or port-range validation. From a standard user account an attacker can write to PS/2 controller, CPU reset, CMOS configuration, and interrupt controller ports, triggering an immediate forced system reset or persistent hardware-level manipulation. A public technical disclosure repository (github.com/floppywiggler/directio64-disclosure) and accompanying blog post exist; no CISA KEV listing is present and no EPSS score was provided.
Missing authorization on image comment endpoints in Slink before 1.12.3 exposes comment threads to unauthenticated network callers. Any caller who can supply a valid image ID can issue GET /api/image/{imageId}/comments or open a server-sent-events subscription and receive the full comment thread and live updates without presenting any credentials. The patch (v1.12.3) retroactively adds a Symfony AuthorizationCheckerInterface voter to both the GetCommentsByImageHandler query handler and CreateCommentHandler, introducing owner, public-guest, and collection-share access checks that were entirely absent before. No public exploit has been identified at time of analysis.
Invitation links in SolidInvoice prior to version 3.0.1 never expire because UserInvitation entities carry no expiry timestamp, leaving any emailed invitation token permanently valid. An attacker who obtains a past invitation link - through email forwarding, archiving, or account compromise - can use it at any future point to join a company's SolidInvoice account or silently enroll a compromised email address as a member. No public exploit has been identified at time of analysis; vendor-released patch 3.0.1 addresses the issue.
Out-of-bounds read in Turso through 0.8.0-pre.8 crashes any application that opens a crafted database file, causing denial of service. The table-leaf page reader in `core/storage/pager.rs` accepts the cell-count field from a SQLite page header at face value without validating it against the actual page payload bounds; supplying an inflated count causes an index-out-of-bounds panic in Rust, aborting the host process. No public exploit has been identified and the vulnerability is not listed in CISA KEV; real-world exposure is limited to applications with a file-ingestion pathway that accepts externally supplied database files.
IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 005 embeds hard-coded credentials - passwords or cryptographic keys - used for internal authentication, outbound component communication, or internal data encryption. A high-privileged local attacker who discovers and extracts these static credentials could leverage them to access protected internal services, decrypt stored security event data, or authenticate to downstream components without per-user authorization. IBM has issued a patch via advisory 7285277; no public exploit code or CISA KEV listing exists at time of analysis.
Path traversal in IBM Langflow OSS 1.0.0 through 1.10.2 exposes arbitrary server-side files to authenticated remote attackers, yielding high confidentiality impact with no integrity or availability loss. The CWE-22 flaw stems from insufficient restriction of user-supplied pathnames, allowing traversal sequences to escape the intended directory boundary. IBM self-reported and patched this issue; no public exploit or active exploitation has been identified at time of analysis.
Path traversal in IBM Langflow OSS versions 1.0.0 through 1.11.2 enables authenticated remote attackers to read arbitrary files accessible to the Langflow process, potentially exposing configuration data, credentials, or other sensitive server-side content. The CVSS vector (PR:L) confirms that prior authentication is required, moderating real-world risk relative to unauthenticated flaws. IBM has released a patch, the vulnerability is vendor-reported, and no public exploit or active exploitation has been identified at time of analysis.
Sensitive file disclosure in IBM Langflow OSS 1.0.0 through 1.11.2 allows authenticated remote attackers to read arbitrary files on the server by exploiting improper validation of symbolic links. The flaw, classified under CWE-22 (Path Traversal), enables an attacker with valid credentials to escape intended directory boundaries by manipulating symlink resolution, potentially exposing configuration files, credentials, or other sensitive server-side content. IBM has released a patch via their support advisory; no public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file read in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any authenticated user holding only the low-privileged Standard role to retrieve arbitrary files from the device filesystem by manipulating the `file` query string parameter of `/cgi-bin/ugwdownload.cgi`. A public proof-of-concept exploit is available in SilviaMun's vulnerability-research repository on GitHub, significantly lowering the skill threshold for exploitation. No integrity or availability impact is established - this is a confidentiality-only vulnerability with high impact on device-resident sensitive data such as configuration files and credentials.
Heap out-of-bounds read in libtpms during TPM 2.0 state restoration allows an adjacent unauthenticated attacker to crash the swtpm process and deny TPM services to dependent virtual machines. The flaw arises in the state-blob parser: an attacker-controlled oversized skip-block length drives the internal INT32 size counter negative; subsequent bounds checks cast that counter to UINT32, wrapping it to a large positive value and bypassing the check, which then drives the parser to read memory outside the heap buffer. Vendor and upstream commit confirm the impact is denial of service only - no data corruption or information disclosure was confirmed. No public exploit or CISA KEV listing has been identified.
Authorization bypass in JeecgBoot's SystemApiController (versions 3.9.2 and earlier) allows any authenticated user - regardless of role or privilege level - to enumerate the entire user directory through four underpermissioned API endpoints. Missing fine-grained permission checks on queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds, combined with incomplete data desensitization, expose sensitive PII including real names, phone numbers, email addresses, employee numbers, and role definitions for all system users. No public exploit has been identified at time of analysis, though the vulnerability is publicly documented in GitHub issues #9670 and #9674.
Denial of service in IBM i 7.3 through 7.6 is achievable by any remote authenticated low-privilege user via a NULL pointer dereference, causing complete availability loss with no data exposure. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity network exploitation requiring only a valid user account and no user interaction. No public exploit code and no CISA KEV listing have been identified at time of analysis; IBM has released a patch via its support portal.
Path traversal in IBM Langflow OSS versions 1.0.0 through 1.10.2 allows an authenticated low-privileged attacker to read arbitrary files on the underlying server by injecting dot-dot sequences (/../) into crafted URL requests. The CVSS 3.1 score of 6.5 (C:H/I:N/A:N) reflects a read-only disclosure vector with no write or denial-of-service capability, but the confidentiality impact is materially significant given that Langflow deployments commonly store LLM API keys, pipeline configurations, and model secrets on the host filesystem. No public exploit code or CISA KEV listing has been identified; IBM has released a patch via its support portal.
Unauthenticated-equivalent version disclosure in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any authenticated user - including the low-privileged Standard role - to retrieve detailed system fingerprinting data via the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi. The endpoint returns operatingsystem and gatewayversion fields without enforcing role-based access controls, exposing exact firmware and OS version strings that enable targeted follow-on attacks against known vulnerabilities. A proof-of-concept is publicly available on GitHub (SilviaMun/vulnerability-research); no CISA KEV listing is present.
Stack-based buffer overflow in IBM i 7.3 through 7.6 allows remote authenticated attackers to cause a denial of service by sending specially crafted network input that exceeds a stack-allocated buffer in a network-accessible component. The vulnerability is gated behind low-privilege authentication (PR:L) and carries no confidentiality or integrity impact, as IBM's advisory scores it CVSS 4.3 with A:L. No public exploit code or active exploitation has been identified; a vendor-released patch is available via the IBM support portal.
Cleartext credential exposure in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any authenticated user - including those with only the low-privileged Standard role - to retrieve OPC-UA server authentication credentials by querying the `opcua-configuration` method of the gateway's JSON API at `/cgi-bin/wwwugw.cgi`. The vulnerability stems from insufficient access control on a sensitive API response, meaning credential data is returned regardless of the requesting user's permission tier. A public researcher repository on GitHub (SilviaMun/vulnerability-research) documents the finding, lowering the exploitation threshold, though no active exploitation has been confirmed by CISA KEV.
XML external entity injection in IBM App Connect Enterprise (versions 12.0.1.0-12.0.12.28 and 13.0.1.0-13.0.8.1) and IBM Integration Bus for z/OS (10.1.0.0-10.1.0.7) enables a remote authenticated attacker to exfiltrate sensitive information from the server via maliciously crafted XML input. The CWE-611 flaw allows the underlying XML parser to resolve attacker-controlled external entity references, potentially exposing local files, environment data, or internal network resources. No active exploitation has been identified at time of analysis, and IBM has released a patch via advisory 7286372.
XML External Entity (XXE) injection in IBM App Connect Enterprise and IBM Integration Bus for z/OS enables authenticated remote attackers to exfiltrate sensitive server-side information. Affected versions span IBM App Connect Enterprise 12.x through 13.x and IBM Integration Bus for z/OS 10.1.x. The vulnerability arises from insufficient restriction of XML external entity processing within the integration platform, and a vendor patch is available via IBM's support portal. No public exploit code or active exploitation has been identified at time of analysis.
Resource exhaustion in IBM MQ Agent CD (v1.0.0-v2.0.1) allows any authenticated console user to monopolize the LLM agent worker pool by submitting arbitrarily large or computationally expensive requests. When multiple such requests are issued concurrently, all available agent workers remain occupied for extended periods - from tens of seconds to over ten minutes each - causing complete unavailability of the AI Agent feature for all other IBM MQ Console users. No public exploit code has been identified at time of analysis, and exploitation requires a valid authenticated session.
Arbitrary file write in IBM Langflow OSS 1.0.0-1.11.2 allows low-privileged authenticated attackers to plant files at any server-writable path via the SaveToFileComponent's unsanitized path handling on the /api/v1/run/{flow_id} endpoint. The root cause is CWE-22 path traversal: user-supplied path values-including absolute paths and traversal sequences such as ../../-are incorporated into local filesystem operations without sufficient sanitization. Successful exploitation enables unauthorized file creation or modification, with potential for further compromise (e.g., overwriting application scripts or configuration) depending on the Langflow process's file-system permissions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary IDE configuration file writes in IBM Langflow OSS 1.0.0 through 1.11.2 are achievable by authenticated remote attackers who spoof the X-Forwarded-For HTTP header to impersonate a localhost connection, bypassing the platform's IP-based restriction on MCP (Model Context Protocol) server configuration installation. The direct impact is unauthorized writes to files such as ~/.cursor/mcp.json, which define MCP server endpoints loaded by AI-integrated IDEs; a malicious entry in these files can redirect the IDE to an attacker-controlled MCP server, enabling downstream code execution within the developer's environment. No public exploit has been identified at time of analysis; a vendor-released patch is available per IBM advisory 7285646.
Sensitive process information disclosure in IBM i's PASE subsystem allows authenticated network users to access details about processes they lack permission to view. Affected versions span IBM i 7.3 through 7.6, covering a wide range of currently-supported releases. The vulnerability is limited to confidentiality impact; no integrity or availability degradation results. No public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in IBM UrbanCode Deploy and IBM DevOps Deploy exposes sensitive deployment secrets in plaintext to authenticated users who should only see redacted values. The root cause is a character-parsing failure in the redaction engine: when a secure property value begins with certain non-ASCII characters, the masking logic fails to suppress subsequent ASCII secure values embedded within non-secure properties, rendering them visible through the UI and REST API. No active exploitation or public POC has been identified; the CVSS score of 6.5 reflects high confidentiality impact (C:H) gated behind low-privilege authentication (PR:L).
Integer overflow in Corosync's membership commit token processing crashes the daemon on 32-bit cluster nodes, enabling a denial-of-service attack from any adjacent network host. The CWE-190 flaw causes the length validation to be bypassed on 32-bit systems where arithmetic wraps before the bounds check is applied, resulting in an out-of-bounds memory access that kills the Corosync process. Modern 64-bit deployments of the same packages are explicitly not affected, substantially narrowing real-world exposure despite the CVSS 6.5 rating; no public exploit code or CISA KEV listing exists at time of analysis.
Cross-user API history disclosure in SolidInvoice prior to version 3.0.1 allows any authenticated company member to read the API request history of other users' API tokens by manipulating writable Symfony UX LiveComponent props on the DataGrid component. The root cause is an IDOR (CWE-639): the server accepts user-controlled identifiers in LiveComponent prop updates without verifying that the requesting user is authorized to view the referenced token's history. No public exploit code exists and no CISA KEV listing is present; vendor-released patch is available in version 3.0.1.
Integer overflow in IBM i versions 7.3 through 7.6 allows remote authenticated attackers to cause a denial of service condition. The vulnerability (CWE-190) is network-reachable but requires prior authentication, and its impact is limited to partial availability degradation with no confidentiality or integrity consequences. IBM has released a patch, and no public exploit code or CISA KEV listing has been identified at time of analysis.
IBM i versions 7.3 through 7.6 expose authenticated remote attackers to a denial-of-service condition via a memory leak (CWE-401). An attacker with low-privilege credentials can repeatedly trigger the vulnerable code path over the network, causing progressive memory exhaustion that degrades or halts system services. No active exploitation has been identified, and IBM has released a patch via Security Advisory 7285844.
Improper authorization in MBS-Solutions X-Serie Gateway firmware V6_00_05 permits authenticated Standard-role users to directly invoke undocumented CGI methods (ugw-ping, ugw-traceroute) via /cgi-bin/wwwugw.cgi that are intentionally hidden from the web UI. Exploitation leaks sensitive network topology data - hop paths, internal IP ranges, and reachability information - from a device positioned as a gateway, making the disclosure operationally significant. No public exploit code has been confirmed in a KEV context, though a public vulnerability research repository exists on GitHub.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.2 allows authenticated remote attackers to leverage the application server as a proxy to reach internal network resources, exposing sensitive information from systems not directly accessible to the attacker. The CVSS S:C scope-change metric signals that the primary risk extends beyond the vulnerable component itself - cloud-hosted instances are particularly exposed to metadata-service credential theft via endpoints like AWS IMDSv1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
DOM-Based XSS in the WoodMart WordPress theme (all versions before 8.3.8) allows low-privilege authenticated attackers to inject malicious scripts into the browsers of higher-privileged users visiting affected pages. The CVSS scope change (S:C) indicates the injected payload can reach beyond WoodMart's own security boundary into the broader WordPress page context, enabling session theft or privilege escalation. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available in version 8.3.8.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 allows remote authenticated attackers to force the application server to make outbound HTTP requests to arbitrary destinations, enabling reconnaissance of internal network resources and metadata services. The S:C (scope change) in the CVSS vector confirms the vulnerability can reach internal systems beyond the Langflow application boundary - a hallmark of high-impact SSRF. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and IBM has released a patch.
CPU exhaustion via crafted chunked HTTP responses affects the Elixir Mint HTTP client library (versions 1.9.3 through before 1.10.0). The chunk-size hex parser in `lib/mint/http1/parse.ex` accumulates digits into an arbitrary-precision integer using `acc * 16 + digit` with no upper bound on digit count, producing O(N²) cost per parse pass; compounded by a re-parse-from-start design on each socket message, a server that trickles digits forces the client to pay this cost repeatedly. Benchmark data in the advisory confirms ~512,000 hex digits produces over ten seconds of CPU in a single pass, and an intermediary inspecting only headers sees a normal 200 response. No public exploit identified at time of analysis; patch is available in version 1.10.0.
Stack buffer overflow in PJSIP's (pjproject) telnet CLI front-end allows unauthenticated network attackers to crash applications that have explicitly enabled the telnet administration interface. The functions send_err_arg() and send_ambi_arg() in cli_telnet.c wrote an attacker-influenced number of bytes into a fixed 256-byte stack buffer without bounds checking, with the error-position offset derived directly from parsed command input. The vulnerability is limited to application termination (DoS); no public exploit code has been identified at time of analysis, and the upstream fix is available as commit 4472a31.
Uncontrolled memory growth in Softing smartLink HW-PN versions 1.04 through 1.09 allows a low-privileged network-adjacent attacker to trigger a resource leak that propagates high-integrity and low-availability impact to downstream subsequent systems - likely PROFINET-connected industrial devices bridged through the gateway. The vulnerability is classified CWE-401 (Missing Release of Memory after Effective Lifetime), indicating that allocated memory is not freed upon session or object expiration, accumulating over time. No public exploit code has been identified at time of analysis, though the CVSS 4.0 supplemental field marks it automatable (AU:Y), suggesting the trigger condition can be scripted without manual interaction.
Stack-based buffer overflow in PJSIP pjproject's telnet CLI front-end allows remote, unauthenticated attackers to crash the affected application by sending history-recall input sequences (arrow keys) to the `handle_up_down()` function in `cli_telnet.c`. The accumulated redraw data - comprising cursor position, current buffer length, and recalled history entry length - can exceed the fixed-size `PJ_CLI_MAX_CMDBUF` stack buffer, leading to application termination. Exploitation requires the telnet CLI front-end to be explicitly enabled; applications that do not enable this feature are entirely unaffected, and no public exploit or KEV listing has been identified at time of analysis.
Improper access control in the MBS-Solutions X-Serie Gateway firmware V6_00_05 permits an authenticated Standard-role user to write arbitrary content to gateway configuration directories via the ugw-editfile method exposed at /cgi-bin/wwwugw.cgi, bypassing the role-based restrictions that should confine write operations to administrative accounts. Exploitation is bounded by the requirement for a valid Standard-role credential but requires no further privileges, enabling persistent unauthorized modification of files under /uxx/config/ and /ugw/config/ - directories that govern gateway routing, access policies, and operational configuration. No active exploitation has been confirmed; a GitHub-hosted researcher repository linked in the references likely contains technical details but POC weaponization status is unconfirmed from available data.
Authorization bypass in phpMyFAQ before 4.1.8 allows unauthenticated network attackers to submit questions through the question/create API endpoint regardless of guest-restriction settings. The root cause is an incomplete two-setting access control check: isAddingQuestionsAllowed() enforces only the main.enableAskQuestions feature flag while silently ignoring the records.allowQuestionsForGuests restriction, nullifying administrator intent. The practical result is spam injection into the admin moderation queue; no code execution or data exfiltration is achievable through this path alone. No public exploit code has been identified at time of analysis.
Pik Online Portal through version 3.5.1 stores hashes without cryptographic salts (CWE-759), exposing stored credentials to offline cryptanalysis via rainbow table or precomputed dictionary attacks. The CVSS vector (PR:L/UI:R) indicates that a low-privileged attacker who can access hash data - and where some user interaction occurs to trigger or expose the hash - can recover plaintext passwords with high confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis; this was reported by TR-CERT (Turkish national cybersecurity authority).
Cross-site request forgery in MISP allows an unauthenticated remote attacker to trigger unauthorized state changes on behalf of any authenticated user by abusing MISP's REST detection logic. The root flaw is that CSRF and form-security exemptions were granted whenever a request was classified as REST-style - a classification controlled by the HTTP Accept header, which cross-origin pages can freely set to application/json without triggering a CORS preflight. Any authenticated MISP analyst who visits an attacker-controlled page can have events created, modified, published, or deleted against their MISP instance using their own session. No public exploit has been identified at time of analysis, but the technique requires only standard browser APIs and social engineering, placing practical exploitation complexity well below the CVSS surface complexity rating.
Sensitive information disclosure in IBM Enterprise Records (a component of IBM Cloud Pak for Business Automation) allows a local attacker to recover protected data due to the use of a broken or risky cryptographic algorithm (CWE-327). Affected versions span CP4BA releases 24.0.0 through 26.0.0 up to specific interim fix levels. No public exploit code has been identified at time of analysis, and IBM has released interim fixes addressing the cryptographic weakness.
Path traversal in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to escape the intended export directory by supplying crafted directory traversal sequences in the `file_name` argument of the `QuestionnaireService.runDataExportNow` function, enabling unauthorized file read and write operations on the server. A public proof-of-concept exploit is available via Google Drive, lowering the barrier to exploitation. The vendor did not respond to the researcher's disclosure, and no patch has been released.
Cross-site scripting in light0011 CMS allows remote attackers to inject arbitrary JavaScript into chapter content pages by manipulating the `content` argument processed through PHP's `htmlspecialchars_decode()` function in the chapter template. The misuse of this function-which decodes HTML entities rather than encoding them-means user-supplied chapter content is rendered as raw HTML in victims' browsers. A public proof-of-concept is available via GitHub issue #8, and the project maintainer has not responded to the coordinated disclosure.
Denial of service in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to crash or degrade the Conversation Handler component by supplying a malformed or oversized 'labels' argument to the /enc-fwk-data/api/v3/conversations/<ID>/events API endpoint. The vendor did not respond to pre-disclosure contact, meaning no official patch exists at time of analysis. A public proof-of-concept exploit has been released, raising the practical risk for organizations running this version in contact-center environments.
Improper access control in Dolibarr's Legacy File Manager connector allows any authenticated user - regardless of assigned module permissions - to access and interact with the medias directory. Affected versions span up to 21.0.4, 22.0.5, and 23.0.3. A public exploit exists via GitHub issue #38963, and the patch commit (ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec) confirms that the vulnerable file (htdocs/core/filemanagerdol/connectors/php/config.inc.php) entirely lacked an authorization gate, meaning even zero-privilege authenticated accounts could reach the file manager. No active exploitation (CISA KEV) has been confirmed.
Improper privilege management in StackStorm st2 up to 3.9.0 allows authenticated low-privilege users to bypass user-scoping restrictions on the action executions API by manipulating the `user` query parameter. The root cause is that `assert_user_is_admin_if_user_query_param_is_provided` in `st2api/st2api/controllers/v1/actionexecutions.py` performs no enforcement when the default NoOp RBAC backend is active - meaning every default StackStorm installation without explicit RBAC configuration is vulnerable. A public proof-of-concept exists via GitHub issue #6379, and the vendor has not yet responded to the disclosure; no patch is available at time of analysis.
Mass assignment (CWE-915) in Eleveo Quality Management 9.7.0 allows low-privileged authenticated attackers to inject arbitrary values into the `createdBy` attribute of conversation event records via the REST API endpoint `/enc-fwk-data/api/v3/conversations/<ID>/events`. By supplying unsanitized user-controlled input that the Conversation Handler binds directly to internal object attributes, an attacker can forge or alter audit trail metadata - misattributing quality management events to other users or obscuring their own activity. A public proof-of-concept exploit has been disclosed on Google Drive; the vendor did not respond to coordinated disclosure and no patch has been released.
Reflected cross-site scripting in HubCore platform 14.1.1 allows unauthenticated remote attackers to inject arbitrary JavaScript via the `language` POST parameter on the `/loginController/doLogin` endpoint, with execution occurring in the victim's browser context. Because the vulnerable endpoint is the public-facing login page - requiring no prior authentication - an attacker who delivers a crafted login link can steal session tokens, impersonate the victim, or redirect users to phishing pages. Publicly available exploit code exists in a researcher's GitHub repository; the vulnerability is not in the CISA KEV catalog and EPSS is low at 0.23%.