Rate limiting in AVideo's API is completely nullified when requests include a bot User-Agent header, exposing all eight rate-protected operations - most critically the login endpoint - to unlimited brute-force attempts from a single IP address. An unauthenticated remote attacker who sets any bot User-Agent string can bypass the application's only credential-stuffing defense and attempt unlimited password guesses against any account. No active exploitation (CISA KEV) or public proof-of-concept code has been identified at time of analysis.
Insufficient per-object authorization in the Kirki WordPress plugin before 6.3.0 allows users with administrator-granted content-level page builder access to alter the state of collaboration comments left by any user, including on pages those users cannot themselves open. The root cause is CWE-639 (Authorization Through User-Controlled Key / IDOR): the comment-state endpoint accepts a user-supplied comment identifier without verifying whether the requesting user holds authorization over that specific comment object. Despite a publicly available PoC from WPScan, EPSS sits at 0.13% (3rd percentile) and the vulnerability is not in the CISA KEV catalog, indicating negligible opportunistic exploitation risk.
Reflected XSS in the Unlimited Elements For Elementor WordPress plugin (all versions through 2.0.17) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload in the `formData[id]` parameter. The plugin registers a front-end AJAX handler on the public WordPress `wp` action with no nonce, capability, or referer check; the attacker-controlled parameter value is interpolated verbatim into an exception message and echoed in the HTTP response without output escaping, and when the content-type resolves to text/html the browser parses and executes the injected markup. No public exploit has been identified at the time of analysis, though the unauthenticated network vector and low attack complexity make social-engineering delivery straightforward against WordPress sites running this plugin.
Reflected XSS in Beaver Builder Plugin (Starter Version) for WordPress (all versions ≤2.11.0.1) permits unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `no_results_message` parameter in the `node_preview` endpoint. Successful exploitation requires tricking a victim into clicking a crafted URL, after which the injected script executes in the victim's browser with access to session cookies, page DOM, and any credentials present in that context. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in libxml2's XML regular expression parser exposes all versions before 2.15.4 to a limited availability impact when processing malformed character group patterns. The NXT(index) macro in xmlregexp.c performed a direct array dereference without verifying the index stays within the parsed string's length, allowing a specially crafted regexp pattern to read one byte past the allocated buffer. The vendor-released fix in v2.15.4 adds a bounds guard returning 0 for out-of-bounds accesses; no public exploit is identified at time of analysis.
Unbounded string storage in Ash Framework versions 0.10.0 through 3.32.x allows unauthenticated attackers to bypass max_length and min_length constraints by submitting Unicode strings whose grapheme count is small but whose codepoint and byte footprint is arbitrarily large. Ash's constraint logic calls Elixir's String.length/1, which counts graphemes; a single base character followed by millions of combining accent codepoints is one grapheme but megabytes of data, satisfying max_length: 2 while writing the entire payload to storage. When the backing store is a PostgreSQL text column, ETS table, or Mnesia table, the oversized value is persisted without limit, enabling storage exhaustion. No public exploit code or CISA KEV listing exists at the time of analysis.
Infinite-loop denial of service in libpcap's BPF interpreter allows a local low-privileged attacker to hang any process that evaluates a crafted BPF filter program via pcap_offline_filter(). The 'ja L' (jump always) instruction stores its target offset as a signed integer, enabling backward jumps that implement looping, but the interpreter imposed no cap on iterations, so a self-referential or backward-looping filter causes unbounded CPU consumption. The upstream fix (commit ff3c83475a) introduces a MAX_BACKWARD_JUMPS limit of 64 per packet and adds validator rejection of self-jumps; no active exploitation or public exploit code has been identified at time of analysis.
Division by zero in libpcap's BPF interpreter can crash any application using the library when processing a crafted filter program containing 'div #k' or 'mod #k' ALU instructions with k=0. The flaw, reported by The Tcpdump Group, affects all versions of libpcap (cpe:2.3:a:the_tcpdump_group:libpcap) and requires a locally-supplied malicious BPF filter - typically via an application that accepts user-controlled filter expressions and calls pcap_offline_filter(). No public exploit or active exploitation has been identified; the vendor has released a patch via GitHub commit.
Process termination via crafted BPF filter in libpcap allows a local attacker with low privileges to crash any application linked against the library by supplying a filter program containing an invalid BPF opcode. The BPF interpreter in bpf_filter.c calls abort() on encountering an unrecognized opcode - a reachable assertion (CWE-617) that converts a defensive check into a denial-of-service vector. No public exploit or active exploitation has been identified; the Tcpdump Group has released a patch replacing abort() with a safe return 0.
Out-of-bounds memory reads in libpcap's userland BPF interpreter allow a local attacker who can supply a crafted filter program to drive the interpreter's program counter past the end of the filter buffer, reading up to 32 GiB of surrounding process memory on 64-bit systems or the entire address space on 32-bit systems. All libpcap versions tracked under CPE cpe:2.3:a:the_tcpdump_group:libpcap are affected; The Tcpdump Group has published a fix via commit d3f358d3. No active exploitation has been confirmed and no public exploit exists; the vulnerability is restricted to uncommon application patterns that pass raw BPF bytecode directly to the interpreter without prior validation.
Stored XSS in the Events Manager WordPress plugin (versions ≤ 7.3.3) enables persistent JavaScript injection via event attribute values using the '#_ATT{key}' template placeholder, which is stored without sanitization and rendered without output escaping. Authenticated users with Author-level access can exploit this on any site running the plugin without special configuration; when the plugin's anonymous event submission feature is enabled (a non-default setting), unauthenticated attackers can achieve the same result. Payloads execute in the browser of any visitor who views the compromised event page. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authorization bypass in the LearnDash LMS WordPress plugin (versions 4.25.0-5.1.6) allows attackers to enroll arbitrary users in paid courses without completing payment, systematically circumventing the plugin's entire payment verification workflow. The root cause is CWE-862 (Missing Authorization): enrollment action handlers fail to verify that the requesting party has the appropriate permission or has satisfied payment conditions. A patched release (5.1.6.1) is available, and no public exploit has been identified at time of analysis.
Confused deputy SSRF bypass in Sim before 0.8.14 allows authenticated workflow authors to reach internal-only API endpoints by exploiting URL prefix matching without scheme normalization. When an HTTP block in a workflow specifies a path beginning with /api/, the routing layer misclassifies the request as internal, skips SSRF validation, and mints an internal authentication token - granting the attacker access to endpoints such as POST /api/function/execute that are meant to be restricted to the server itself. No public exploit is confirmed at time of analysis, but a researcher disclosure writeup is available on GitHub, and a fix was shipped in PR #7179 targeting v0.8.14.
Missing authorization on the Subsonic startScan endpoint in gonic before v0.22.0 permits any authenticated user - not just administrators - to repeatedly trigger CPU- and I/O-intensive media library filesystem scans. Multi-user gonic instances are the meaningful target: an attacker with a regular account can flood the endpoint to exhaust server resources and deny service to all users. No public exploit code has been identified at time of analysis, and the patch is available in v0.22.0.
Server-side request forgery in Rowboat through 0.9.1 allows any authenticated user to redirect the application server's outbound HTTP client at arbitrary destinations, including cloud instance-metadata endpoints and RFC 1918 internal services, by supplying unvalidated URLs when registering custom MCP servers or webhooks. The missing URL validation exists in two confirmed code paths - the add-custom-mcp-server use-case and agent-tools runtime - as documented in VulnCheck's advisory and GitHub issue #621. No vendor-released patch version is identified in available references, and no public exploit code or CISA KEV listing exists at time of analysis.
Incorrect authorization in APITable's NodePermissionGuard allows authenticated API users to bypass explicit datasheet-level access denials via a fail-open exception path. Holders of valid Fusion API tokens can write attachments to private datasheets they have been explicitly denied access to, because the permission guard defaults to allowing operations rather than rejecting them when node-level permission lookups throw unhandled exceptions. No public exploit code has been identified at time of analysis, though the flaw is publicly documented via GitHub issue #1814 and VulnCheck advisory.
Broken object-level authorization (IDOR) in Plane through 1.4.2 allows authenticated attackers to post comments on arbitrary issues across any workspace by supplying a manipulated issue_id to the public deploy-board comment endpoint. The endpoint at apps/api/plane/space/views/issue.py (lines 258-275) performs no validation that the supplied issue belongs to the project associated with the deploy board, enabling cross-workspace data pollution. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 4.0 base score is 5.3 (Medium).
Broken object-level authorization in BookWyrm through 0.9.1 lets authenticated users favorite or unfavorite followers-only and direct statuses they are not permitted to view. By POSTing a controlled status ID to the /favorite or /unfavorite endpoint, an attacker can create unauthorized social interactions, trigger ActivityPub federation broadcasts that notify the content owner's network, and enumerate private status IDs through response differentiation attacks. No public exploit code has been identified at time of analysis, though a detailed researcher writeup is publicly available via VulnCheck and a GitHub disclosure.
SiYuan's `getAttributeViewKeysByID` endpoint, present in all versions before v3.8.2, allows authenticated publish readers to retrieve full key schemas-including sensitive field names and relation definitions-from private or hidden databases they have no visibility into. The flaw is an authorization bypass (CWE-639/IDOR) where the endpoint validates that a caller holds a publish-reader session but never verifies the caller's access rights against the parent database owning the requested attribute view. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk moderate despite the network-accessible attack vector.
Stored XSS in Grav CMS before 2.0.20 lets low-privileged page editors inject arbitrary JavaScript that executes in every visitor's browser, including administrators, by abusing the Twig content sandbox's allowlisted `addJs`/`addCss` methods on `Grav\Common\Assets`. The asset URL is concatenated directly into `<script src>` and `<link href>` tags in the document head without output escaping, and Grav's built-in XSS scanner cannot detect the payload because `addJs()` mutates the shared Assets service and returns only an object key - no inspectable markup is produced at scan time. Vendor-released patch Grav 2.0.20 is available; no public exploit has been identified at time of analysis.
Blind Server-Side Request Forgery in the Divi WordPress theme (all versions through 4.27.6) allows authenticated Contributor-level users to coerce the web server into making arbitrary outbound HTTP requests, including to private and reserved IP ranges unreachable from the public internet. The root cause is the use of WordPress's unrestricted `wp_remote_get()` instead of the network-safe `wp_safe_remote_get()` in the `et_pb_set_video_oembed_thumbnail_resolution()` function. Although response bodies are withheld (blind SSRF), two side-channel oracles - a status oracle based on the returned URL string and a timing oracle based on response latency - allow limited internal network reconnaissance. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available as of Divi 4.27.7.
Remote memory disclosure in libpcap's rpcap client allows a malicious or compromised rpcap server to cause a connected client to read up to 20 bytes beyond the end of its receive buffer and treat that data as captured packet content. All libpcap versions with rpcap support are affected per CPE cpe:2.3:a:the_tcpdump_group:libpcap:*:*:*:*:*:*:*:*. The root cause is an incorrect boundary check in pcap_read_nocb_remote(): the RPCAP_MSG_PACKET caplen field was validated against the full payload length rather than against the payload length minus the fixed-size RPCAP_MSG_PACKET header, creating a window of up to sizeof(struct rpcap_pkthdr) bytes that could be read beyond the buffer. No public exploit or CISA KEV listing is identified at time of analysis.
Heap buffer over-read in ugrep before 7.6.0 allows a local attacker to crash the utility by supplying a malformed .Z (Unix compress) archive file to its LZW decompressor. The flaw, located in src/zopen.c at approximately line 673, causes the decompressor to read exactly one byte past the end of the allocated heap buffer, resulting in a process crash. The CVSS 4.0 vector confirms the impact is limited to availability at the Low severity level with no confidentiality or integrity exposure; no public exploit has been identified at time of analysis.
Authorization bypass in the Custom Contact Forms WordPress plugin (all versions ≤ 7.16) grants authenticated contributors the ability to permanently force-delete arbitrary posts of any type - including administrator-authored pages and WooCommerce product listings - and write arbitrary ccf_field_* post meta onto any post regardless of ownership. The root cause is that _create_and_map_fields() and _create_and_map_choices() accept arbitrary post IDs in nested fields[].ID and choices[].ID parameters with no capability or post-type validation, leaving those REST API sinks fully unguarded while the developer had already implemented equivalent guards elsewhere in the same controller. No public exploit code exists and the vulnerability is not listed in CISA KEV.
Theme My Login plugin for WordPress (≤7.1.15) on Multisite installations allows authenticated Subscriber-level accounts to bypass the network's `active_signup` registration policy by posting directly to the `gimmeanotherblog` handler, which omits the policy gate enforced by sibling branches and unconditionally invokes `wpmu_create_blog()` with the attacker's user ID. WordPress core then assigns the Administrator role on the resulting subsite, granting full subsite control - including plugin and theme installation - to an otherwise low-privileged user. No public exploit code or CISA KEV listing has been identified; Wordfence reported the issue and a fix is confirmed in version 7.2.0.
Memory exhaustion in libpcap's rpcapd remote capture daemon allows an authenticated remote client to degrade or crash the service by triggering unreleased heap allocations. The daemon allocates up to 65536 bytes per RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message processed in daemon_unpackapplyfilter(), but the bf_insns BPF filter instruction array is never freed on any code path - success or error - under the pre-patch logic. A malicious rpcap client can accelerate memory exhaustion by rapidly submitting filter-update or capture-start requests. No active exploitation is confirmed and no public exploit code exists at time of analysis.
Missing authorization in the Ninja Forms - Save Progress WordPress plugin (versions ≤3.0.30) allows any subscriber-level authenticated user to bulk-delete arbitrary records from the wp_nf3_objects database table via the unprotected bulk_actions function. The handler enforces neither WordPress capability checks nor nonce verification, meaning any logged-in site user can destroy saved form submission data at will. No public exploit has been identified at the time of analysis; CVSS 4.3 reflects the constrained, integrity-only impact gated behind authentication.
NULL pointer dereference in libxml2's xmlRegNewParserCtxt() function crashes any application invoking the XML regular-expression engine under memory-pressure conditions. Versions before 2.15.4 call strlen() on the return value of xmlStrdup() without first verifying the pointer is non-NULL; when strdup() fails due to memory exhaustion, the subsequent strlen(NULL) causes a process crash. No confidentiality or integrity impact is possible - the vulnerability is limited to a local, high-complexity denial-of-service. No public exploit or CISA KEV listing exists; the fix shipped in libxml2 2.15.4.
Hard-coded WPA passphrase in Tenda CP3 version 27.5.57.101 exposes the device's SoftAP (software access point) mode to unauthorized WiFi access by any party who possesses the fixed credential value embedded in custom-x/softap/hostapd. Because the passphrase is statically compiled into the hostapd configuration rather than randomly generated per device, all units running this firmware version share an identical WPA key. A public proof-of-concept has been disclosed per the CVSS 4.0 exploit maturity indicator (E:P), lowering the barrier for adversaries who identify target devices in range.