Missing post-ownership authorization in Directorist WordPress plugin before 8.9 allows any authenticated subscriber-level user to overwrite image metadata on posts belonging to other users. The plugin fails to verify that the uploading user owns the target post before writing file references to its metadata, enabling cross-user content tampering limited to image attachment references. No public exploit confirmed via CISA KEV, but WPScan has published a proof-of-concept, and a vendor patch is available at version 8.9.
Race condition in jofpin trape 2.0 allows remote unauthenticated attackers to manipulate telemetry data via the vId argument in core/user.py's Telemetry Endpoint, yielding low-impact confidentiality, integrity, and availability compromise. Exploitation is rated high complexity (AC:H) due to the timing requirements inherent in race condition attacks, and the CVSS 4.0 base score is 2.9. A public proof-of-concept exists as a GitHub issue report (#408); the project maintainer has not responded to the disclosure.
Path traversal in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to escape the intended export directory by supplying crafted directory traversal sequences in the `file_name` argument of the `QuestionnaireService.runDataExportNow` function, enabling unauthorized file read and write operations on the server. A public proof-of-concept exploit is available via Google Drive, lowering the barrier to exploitation. The vendor did not respond to the researcher's disclosure, and no patch has been released.
Cross-site scripting in light0011 CMS allows remote attackers to inject arbitrary JavaScript into chapter content pages by manipulating the `content` argument processed through PHP's `htmlspecialchars_decode()` function in the chapter template. The misuse of this function-which decodes HTML entities rather than encoding them-means user-supplied chapter content is rendered as raw HTML in victims' browsers. A public proof-of-concept is available via GitHub issue #8, and the project maintainer has not responded to the coordinated disclosure.
Denial of service in Eleveo Quality Management 9.7.0 allows authenticated remote attackers to crash or degrade the Conversation Handler component by supplying a malformed or oversized 'labels' argument to the /enc-fwk-data/api/v3/conversations/<ID>/events API endpoint. The vendor did not respond to pre-disclosure contact, meaning no official patch exists at time of analysis. A public proof-of-concept exploit has been released, raising the practical risk for organizations running this version in contact-center environments.
Improper access control in Dolibarr's Legacy File Manager connector allows any authenticated user - regardless of assigned module permissions - to access and interact with the medias directory. Affected versions span up to 21.0.4, 22.0.5, and 23.0.3. A public exploit exists via GitHub issue #38963, and the patch commit (ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec) confirms that the vulnerable file (htdocs/core/filemanagerdol/connectors/php/config.inc.php) entirely lacked an authorization gate, meaning even zero-privilege authenticated accounts could reach the file manager. No active exploitation (CISA KEV) has been confirmed.
Improper privilege management in StackStorm st2 up to 3.9.0 allows authenticated low-privilege users to bypass user-scoping restrictions on the action executions API by manipulating the `user` query parameter. The root cause is that `assert_user_is_admin_if_user_query_param_is_provided` in `st2api/st2api/controllers/v1/actionexecutions.py` performs no enforcement when the default NoOp RBAC backend is active - meaning every default StackStorm installation without explicit RBAC configuration is vulnerable. A public proof-of-concept exists via GitHub issue #6379, and the vendor has not yet responded to the disclosure; no patch is available at time of analysis.
Mass assignment (CWE-915) in Eleveo Quality Management 9.7.0 allows low-privileged authenticated attackers to inject arbitrary values into the `createdBy` attribute of conversation event records via the REST API endpoint `/enc-fwk-data/api/v3/conversations/<ID>/events`. By supplying unsanitized user-controlled input that the Conversation Handler binds directly to internal object attributes, an attacker can forge or alter audit trail metadata - misattributing quality management events to other users or obscuring their own activity. A public proof-of-concept exploit has been disclosed on Google Drive; the vendor did not respond to coordinated disclosure and no patch has been released.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/inv_del.php`, enabling database enumeration, data extraction, and record modification. The application is an educational PHP project from itsourcecode.com with minimal production exposure, and a public proof-of-concept exploit has been published on GitHub. No vendor-released patch has been identified at time of analysis.
Improper privilege management in StackStorm st2's API Key Handler allows authenticated remote attackers to manipulate the `api_key_api.user` argument in `st2api/st2api/controllers/v1/auth.py`, enabling unauthorized privilege escalation within the automation platform. All versions through 3.9.0 are affected per the CPE data, and a publicly available proof-of-concept exploit exists (GitHub issue #6380). No vendor patch has been released; the StackStorm project has not responded to the responsible disclosure report.
SQL injection in code-projects Online Shopping System 1.0 allows authenticated administrators to manipulate database queries via the `mobile` parameter in admin/adduser.php. The vulnerable call passes unsanitized user input directly to mysqli_query(), enabling an admin-level attacker to read, modify, or delete database contents. A public proof-of-concept exploit has been published on GitHub; no vendor patch has been identified.
Cross-site scripting in Eleveo Quality Management 9.7.0 allows authenticated low-privileged users to inject malicious scripts into the Conversation Review component, which then execute in the browsers of other users who subsequently view the affected content. A public proof-of-concept exploit has been disclosed via Google Drive, and the vendor did not respond to responsible disclosure outreach, leaving no vendor-issued patch available at time of analysis. No active exploitation has been confirmed by CISA KEV.
Stored or reflected cross-site scripting in Eleveo Call Recording Software 9.7.0 allows an authenticated low-privilege user to inject arbitrary client-side script via the name or username parameter of the /callrec/roleAddAction.do endpoint. When a victim user - likely an administrator viewing role management pages - loads the affected page, the injected payload executes in their browser context. A public proof-of-concept exploit exists on Google Drive; the vendor did not respond to responsible disclosure, so no patch has been issued.
HTTP response splitting and downstream desynchronization in undici's retry interceptor allows an attacker-controlled upstream server to cause downstream HTTP/1.1 clients to misinterpret response boundaries. Affected releases are undici before 6.28.1, 7.0.0 through 7.29.0, and 8.0.0 through 8.10.1. When a proxying application relays the malformed response without normalizing framing, excess bytes appended by the retry interceptor can be parsed by a downstream HTTP/1.1 peer as the start of a subsequent response, enabling response injection or session desynchronization attacks.
Improper access control in an SQL stored procedure within IBM Db2 Mirror for i 7.4, 7.5, and 7.6 permits an authenticated low-privileged attacker to permanently delete historical flight-recorder archives, destroying diagnostic audit data critical for replication troubleshooting and post-incident review. The root cause is CWE-285 (Improper Authorization) - the procedure executes a destructive operation without verifying that the invoking principal holds the necessary authority. No public exploit has been identified at time of analysis, and IBM has released a patch via support advisory node/7285904.
Race condition in freegpt-webui's Jailbreak Mode allows remote attackers to trigger low-level availability disruption by exploiting improper synchronization in the `getJailbreak` function of `server/config.py`. The affected project is end-of-life and unmaintained, with no versioned releases due to its rolling-release model. Public exploit code exists via a referenced GitHub gist, though exploitation demands high attack complexity and produces only minor service disruption - no confidentiality or integrity impact is possible.
Out-of-bounds GPU memory access in Imagination Technologies Graphics DDK allows kernel-level code executing inside a Guest VM to read from, and potentially write to, GPU memory regions outside its allocated virtualized address space via a TOCTOU race condition in GPU firmware validation. Affected versions span multiple DDK release trains including 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, 25.1-25.3 RTM, and 26.1 RTM1 as enumerated in EUVD-2026-70858. No public exploit code has been identified at time of analysis, and the 0.11% EPSS score places this in the first percentile for exploitation probability, indicating no observed active exploitation.