Pre-authentication remote code execution in N-able N-central before 2026.3.1.14 allows unauthenticated remote attackers to execute arbitrary code on the management server, per the vendor's own security advisory. Rated CVSS 4.0 10.0 with a full-impact vector including scope change, it targets a platform that centrally manages large fleets of downstream endpoints, making it an exceptionally high-value target. No public exploit has been identified at time of analysis, and it is not yet listed in CISA KEV, but the pre-auth, network-reachable nature warrants emergency patching.
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets an attacker inject shell commands through the function sub_2F77E8 in Apis/system.c, part of the Network Configuration Management component. Successful exploitation yields arbitrary command execution on the camera's embedded Linux OS. The CVSS 4.0 vector requires high privileges (PR:H), and no public exploit or active exploitation has been identified at time of analysis.
Remote unauthenticated buffer overflow in Tenda HG10 firmware 300001138 allows network attackers to corrupt memory and likely achieve code execution via the formURL function at /boaform/admin/formURL. Oversized values in the Keywd or urlFQDN parameters are copied into a fixed-size buffer without length validation (CWE-120), with full confidentiality, integrity, and availability impact per the CVSS 4.0 vector. A public proof-of-concept exploit is available on GitHub, raising near-term exploitation risk despite the absence of a CISA KEV listing.
OS command injection in Tenda HG10 GPON router firmware 300001138 allows authenticated network attackers to execute arbitrary shell commands on the device by manipulating the `fmgpon_loid` parameter in the `/boaform/admin/formgponConf` endpoint served by the Boa embedded web server. The `fmgpon_loid` argument (GPON Line OID) is passed unsanitized to a system call (CWE-78), giving an attacker full control over the underlying Linux OS. A public proof-of-concept exploit exists on GitHub, and the CVSS 4.0 E:P supplemental metric confirms exploit code is available.
Account takeover via insecure direct object reference in the SureCart WordPress plugin (versions 4.0.0 through 4.6.2) allows any subscriber-level authenticated user to seize full control of an administrator account. The plugin's customer update endpoint validates that the requester has permission to update customers, but fails to verify that the target customer record belongs to the requesting user - enabling arbitrary cross-user email modification followed by a password reset. A compounding information disclosure flaw leaks customer identifiers and email addresses to all authenticated users, providing the enumeration primitive needed to complete the takeover chain without any additional knowledge. A publicly available proof-of-concept exploit exists, and vendor patch 4.6.3 is available.
Missing validation of the EIP-7702 aa_authorization_list field in ZenHive mpp's Tempo payment sponsorship module allows any unauthenticated remote client to inflate the fee-payer's gas cost by roughly 40x and to have the sponsor pay for persistent EIP-7702 set-code delegations on attacker-controlled Ethereum accounts. Versions 0.2.0 through 0.16.0 are affected; the FeePayerPolicy.measure/3 function validates gas fields, fee budget, validity window, and access list but never inspects the aa_authorization_list, so a client embedding seven throwaway delegation entries drives sponsored gas from approximately 46,575 to over 1,884,087. No public exploit has been identified at time of analysis, and a vendor patch is available in mpp 0.16.1.
Gas-cost inflation and unauthorized access key provisioning in ZenHive mpp (versions 0.2.0 through 0.15.x) allows any unauthenticated remote client to attach a fully signed key_authorization payload to a Tempo 0x76 payment envelope, forcing the fee sponsor to pay for persistent blockchain storage writes the client itself initiated. At the reporter's default test case of one access key with three token spending limits, the sponsor's gas cost rises from roughly 46,587 to roughly 1,808,700 gas - approximately a 39x multiplier - while the client retains a valid access key it paid nothing for. No public exploit has been identified at time of analysis, but the vulnerability is well-specified and trivially reproducible given knowledge of the Tempo protocol.
Path traversal in h3's serveStatic() function on Node.js allows unauthenticated remote attackers to read arbitrary files outside the configured static root directory. The root cause is that h3 uses srvx's FastURL class, which skips WHATWG URL normalization for performance - percent-encoded dot segments (%2e%2e) survive raw into decodeURI(), are decoded to ../, and are passed unsanitized to filesystem callbacks. A detailed proof-of-concept exploit chain is publicly documented in GHSA-wr4h-v87w-p3r7; no active exploitation confirmed in CISA KEV at time of analysis. Fixed in versions 1.15.6 and 2.0.1-rc.15.
Path traversal in Jupyter nbviewer through version 1.0.1 allows unauthenticated remote attackers to read files from sibling directories outside the configured local file root by exploiting a string-prefix comparison flaw in LocalFileHandler.can_show(). The access control check uses Python's startswith() without anchoring on a path separator, so a configured root such as /data/notebooks inadvertently permits access to adjacent directories like /data/notebooks_backup or /data/notebooks-private. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a patch commit is available upstream and the flaw is trivial to exploit manually.
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persistently inject JavaScript into comment fields by bypassing the plugin's HTML entity decoding logic through alternate entity encodings. The malicious payload executes in the browser session of any user - including administrators - who views a page rendering the affected comment, and propagates site-wide when Kirki-managed headers or footers display comment data. A publicly available proof-of-concept exists and the vendor has released a patching fix in version 6.3.0.
Buffer overflow in the Tenda HG10 router (firmware version 300001138) via the `formWanRedirect` function allows a network-authenticated attacker to overwrite control-flow data in the Boa embedded web server process, enabling remote code execution or device crash. The vulnerable endpoint `/boaform/formWanRedirect` fails to validate the length of the `if` argument before copying it into a fixed-size buffer (CWE-120). A public proof-of-concept exploit is available on GitHub, and no vendor-released patch has been identified at time of analysis.
Stored cross-site scripting in the Bold Page Builder WordPress plugin (all versions before 5.9.9) permits any user holding the Contributor role or higher to embed arbitrary JavaScript inside an HTML attribute via an unsanitized shortcode parameter. A publicly available exploit exists per WPScan (EUVD-2026-72064). When a higher-privileged user such as an administrator views a page containing the injected payload, the script executes in their browser, enabling session hijacking, nonce theft, or full administrative takeover of the WordPress installation.
Shortcode injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated remote attackers to execute any shortcode registered on the target WordPress site. The flaw stems from a misordered sanitization pipeline: user-supplied input in a request parameter is HTML-escaped before it is passed to WordPress's shortcode expansion function rather than after, meaning shortcode syntax survives the escape pass intact and is then evaluated server-side. A publicly available proof-of-concept exploit exists via WPScan, making this immediately actionable for attackers against unpatched installs.
Unauthenticated account registration bypass in SureCart WordPress plugin before 4.7.0 allows remote attackers to create WordPress user accounts and obtain authenticated sessions even when the site administrator has explicitly disabled user registration. The plugin fails to consult WordPress's native `users_can_register` site option before processing account creation through its own checkout/registration flow. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available in version 4.7.0. No confirmed active exploitation (CISA KEV) at time of analysis.
OS command injection in the Tenda CP3 IP camera (firmware 27.5.57.101) lets remote attackers execute arbitrary shell commands via the CAutoAddWifi::ThreadProc function of the Kylin component's AutoAddWifi.cpp. The flaw is reachable without authentication over the network and yields full device compromise. No public exploit has been identified at time of analysis, and the report originates from a single source (VulDB).
Unauthenticated account takeover in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.12) lets remote attackers overwrite any user's email address - including an administrator's - and then hijack the account via WordPress's built-in password-reset flow. The flaw stems from a missing capability check in pre_update_value combined with an authorization gate that is silently bypassed when a non-numeric post identifier (e.g. 'user_1') is supplied. Reported by Wordfence; no public exploit code or CISA KEV listing was identified at time of analysis, but the trivial, unauthenticated nature makes this a high-priority patch.
Full account takeover in the MemberDash WordPress membership plugin (versions up to and including 1.8.5) lets unauthenticated remote attackers reset the password of any user - including administrators - by supplying an arbitrary target user ID via the 'id' parameter during registration. The victim receives no notification, so takeover is silent. Reported by Wordfence with a critical 9.8 CVSS; no public exploit is identified at time of analysis, though the trivially scriptable request pattern makes weaponization straightforward.
Authentication bypass via response replay affects the DIGEST-MD5 server implementation in the Perl Authen::SASL distribution (Authen::SASL::Perl::DIGEST_MD5) before version 2.2100. The server generates a fresh nonce in its challenge but never compares it against the nonce returned by the client, so an attacker who passively captures one successful qop=auth exchange can replay that exact response against a later session for the same service, host, realm and user and authenticate as that user without knowing the password. An upstream fix is available (2.2100, commit 9433736); no public exploit identified at time of analysis, and EPSS is low at 0.22%.
SAML authentication bypass in the Perl module MojoX::Authentication before 0.006 lets a remote unauthenticated attacker impersonate any user by forging a SAML response. The module's parse_assertion routine constructs a Net::SAML2::Binding::POST object without any trust anchor (no cacert, cert_text, or anchors), so the signature on an unencrypted assertion is validated against the certificate embedded in the response itself rather than the trusted IdP signing certificate. No public exploit has been identified at time of analysis, and EPSS is low (0.11%), but the flaw is a complete pre-authentication account-takeover primitive.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `/delete_user_account.php` endpoint to unauthenticated remote exploitation via an unsanitized `id` parameter. The flaw allows attackers to read, modify, or delete underlying database records without any authentication credential. A public proof-of-concept exploit is available via GitHub, materially elevating practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest at face value.
Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate the database through the ID parameter in /delete_user.php. The vulnerability requires no privileges or user interaction, and a public proof-of-concept exploit has been published on GitHub. Impact is limited by the CVSS 4.0 assessment (VC:L/VI:L/VA:L), suggesting partial data read/write rather than full database compromise, though chained exploitation could escalate impact.
SQL injection in the Login component of code-projects Task Management System In PHP 1.0 exposes the application's database to unauthenticated remote attackers via the `email` parameter in `/index.php`. The root cause is unsanitized user input passed directly into a SQL query (CWE-89), enabling authentication bypass and arbitrary data extraction. A public proof-of-concept writeup has been published on GitHub, significantly lowering the exploitation barrier; no vendor patch has been identified.
SQL injection in code-projects Content Management System 1.0 allows unauthenticated remote attackers to manipulate database queries via the user_name parameter in /login.php. Because the vulnerable endpoint is the authentication form itself, successful exploitation can achieve authentication bypass - granting admin-level access without credentials - as well as full database enumeration. A public proof-of-concept exploit has been published to GitHub, materially lowering the bar for exploitation.
Insecure direct object reference (IDOR) in the dmWidget component of diem-project/diem (versions through 5.1.3) allows unauthenticated remote attackers to bypass authorization controls by manipulating the `widget_id` parameter in `BasedmWidgetActions.class.php`, exposing widget data belonging to other users or contexts. A public proof-of-concept exists via GitHub issue #450, and the upstream project has not responded to the coordinated disclosure despite early notification. The CVSS 4.0 score of 5.5 reflects the limited blast radius - confidentiality impact only, with no integrity or availability consequences confirmed.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the /delete_teacher.php endpoint to unauthenticated remote database manipulation via an unsanitized ID parameter (CWE-89). A proof-of-concept exploit has been publicly released on GitHub, making opportunistic exploitation straightforward for low-skilled attackers. Attackers with network access to the application can extract, modify, or delete records from the underlying database without supplying credentials.
Unauthenticated remote access to an exposed SQL database backup file in code-projects Daily Expense Manager 1.0 allows any network attacker to retrieve sensitive application data. The file `/Daily-Expense-Manager/exp_ak.sql` - a raw database dump - is served directly from the web root without access control, disclosing potentially credentials, user records, and expense data. No public exploitation via CISA KEV, but a public exploit writeup is available on GitHub confirming the exposure path.
Unauthenticated remote download of a raw SQL database backup in code-projects Hotel and Tourism Reservation in PHP 1.0 exposes the full application database to any internet-connected attacker. The file /ht/hotel_db%20(1).sql is placed inside the web root without access restrictions, making it directly retrievable over HTTP with no credentials. A publicly available proof-of-concept exploit exists; the database dump likely contains guest PII, booking records, and potentially hashed or plaintext admin credentials.
Unauthenticated SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the application to full database read and write via the `fname` parameter in `/admin/modal_add_product.php`. The underlying `mysqli_query` call accepts unsanitized user input, allowing remote attackers to craft malicious SQL payloads without any authentication. A public exploit has been disclosed on GitHub, materially increasing the likelihood of opportunistic exploitation.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries via the unsanitized `course` parameter passed directly to mysqli_query in /admin/modal_add_coursea.php. The vulnerability carries limited but confirmed data exposure and integrity risk (VC:L/VI:L/VA:L per CVSS 4.0). A public proof-of-concept exploit was published to GitHub, lowering the bar for exploitation significantly. No vendor patch has been identified.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the `course` parameter in `/admin/modal_add_course2.php` to unauthenticated remote attackers who can manipulate the underlying MySQL database. The vulnerability is rooted in direct, unsanitized input concatenation into a `mysqli_query()` call, yielding bounded but real read, write, and partial availability impact. A proof-of-concept exploit has been publicly disclosed on GitHub, materially lowering the exploitation barrier.
SQL injection in Mstfakts College-Management-System exposes the Search Handler endpoint (Front-end/university.php) to unauthenticated remote exploitation via unsanitized book_name and book_author parameters passed directly to mysqli_query(). A working proof-of-concept has been publicly disclosed via GitHub Issue #5, and the project maintainer has not responded to the disclosure, leaving the codebase unpatched. No public exploit identified as actively exploited in the wild at time of analysis, but the low attack complexity and no-authentication requirement combined with public PoC materially elevate practical risk.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate database queries via the room_name parameter passed to the mysqli_query() call in /admin/modal_add_room.php. Exploitation yields limited data disclosure and modification (VC:L/VI:L per CVSS 4.0), consistent with a classic unsanitized input flaw in a PHP/MySQL stack. A public proof-of-concept is available on GitHub, no vendor patch has been identified, and no active exploitation (CISA KEV) has been confirmed.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 exposes the database to unauthenticated remote attackers via the `course` parameter passed to `mysqli_query()` in `/admin/modal_add_course1.php`. An attacker can craft a malicious HTTP request to read, modify, or delete database contents without prior authentication, as confirmed by a publicly available proof-of-concept exploit. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N) reflects straightforward remote exploitation with no special conditions, though limited CIA impact scores (VC:L/VI:L/VA:L) suggest partial rather than full database compromise.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL against the application database through the unvalidated `course` parameter in `/admin/modal_add_course.php`. The `mysqli_query` function receives attacker-controlled input without parameterization or sanitization, enabling full database extraction, credential theft, and record manipulation. A public proof-of-concept exploit is available on GitHub; no vendor patch has been identified at time of analysis.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the login endpoint `/ajax.php?action=login` to database manipulation via an unsanitized Username parameter. A remote attacker with no credentials can craft malicious SQL input to bypass authentication, extract database contents, or alter voting records. A public proof-of-concept exploit has been disclosed on GitHub (CVE exploit issue #1), elevating practical risk above the moderate CVSS 4.0 score of 6.9.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 allows remote attackers to manipulate database queries via the unsanitized `id` parameter in `/ajax.php?action=delete_category`. Because the endpoint accepts user-supplied input without parameterization or sanitization, an attacker can craft malicious SQL payloads to read, modify, or delete database contents - including voter credentials, vote tallies, and administrative account data. A public proof-of-concept exploit exists per VulDB submission; no vendor patch has been identified at time of analysis. No public exploit identified at time of analysis is contradicted by the POC flag - POC is confirmed publicly available.
Unauthenticated SQL injection in SourceCodester Online Voting System 1.0 exposes the `/ajax.php?action=delete_voting` endpoint to arbitrary database manipulation via an unsanitized `ID` parameter. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote exploitation with no authentication or preconditions, and a public proof-of-concept has been disclosed on GitHub. An attacker can read, modify, or delete voting records depending on the database user's privileges, with potential to undermine the integrity of any election or poll managed by the application.
SQL injection in SourceCodester Online Voting System 1.0 exposes the /ajax.php?action=save_user endpoint to unauthenticated remote exploitation via the unsanitized ID parameter. A public proof-of-concept exploit is available on GitHub, enabling database extraction or manipulation without authentication. The CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation, though impact is bounded at the database layer rather than full system compromise.
Unauthenticated SQL injection in rabindralamsal's inventory-management-system 1.0.0 exposes the login endpoint (index.php) to direct database manipulation via unsanitized username and password parameters. An attacker with network access can craft malicious SQL payloads to bypass authentication, enumerate database contents, or alter stored records without any prior credential or privilege. A public proof-of-concept exploit exists (GitHub issue), making this immediately actionable by low-skill attackers; no patch has been identified.
Improper privilege management in the Tenda CP3 IP camera (firmware 27.5.57.101) exposes the CRedirServer::SetRedirectEnable function (Functions/Redirect.cpp) to remote abuse, letting an attacker toggle the device's redirect handling without proper authorization enforcement. The flaw was disclosed by VulDB (vuln #399276) and carries a CVSS 4.0 base score of 9.4, though no public exploit code and no active-exploitation evidence accompany the entry. No public exploit identified at time of analysis, and the single-source, sparse disclosure limits how much of the claimed impact can be independently confirmed.
Unauthorized role self-assignment in the B2BKing WooCommerce plugin before version 5.2.40 allows unauthenticated registrants to claim restricted B2B customer group memberships without admin approval by supplying arbitrary role parameters not bounded by server-side validation. The plugin fails to verify that a role submitted during account registration is actually one offered on the public registration form, enabling any user to bypass the manual account-approval workflow and gain access to wholesale pricing tiers or restricted catalogs. A publicly available proof-of-concept exists via WPScan, though no confirmed active exploitation has been identified in CISA KEV at time of analysis.
Server-side request forgery in OpenMAIC before 1.0.1 lets unauthenticated attackers coerce the server into fetching arbitrary attacker-supplied provider URLs, reaching cloud instance metadata endpoints (e.g. 169.254.169.254) to steal IAM credentials and instance metadata. The flaw exists because the outbound URL guard was gated to production builds only, so any deployment not running under NODE_ENV=production skipped SSRF validation entirely. Reported privately by VulnCheck; a vendor patch (v1.0.1) is available, no public exploit code was identified, and the product is not in CISA KEV.
Privilege escalation and arbitrary code execution in PostgreSQL Anonymizer (by Dalibo) allow authenticated masked users to break out of their restricted data-access context by embedding malicious expressions inside operators, domain casts, or view subqueries. When the extension's masking engine evaluates these objects during data anonymization, the embedded code runs with the elevated privileges of the extension owner or superuser, granting full database compromise from a nominally low-privilege account. No public exploit or KEV listing is recorded at time of analysis, but the CVSS score of 8.8 and the availability of a confirmed patch version make this a high-priority upgrade for any deployment relying on PostgreSQL Anonymizer for compliance or access control.
Shortcode injection in the Ninja Forms WordPress plugin (versions 3.14.10 through 3.15.1) allows unauthenticated network attackers to execute any shortcode registered on the target site by embedding shortcode syntax into form request fields the plugin later processes. The plugin fails to strip or escape shortcode markers before passing user-controlled values through WordPress's shortcode execution pipeline, meaning the server interprets and runs injected tags. A publicly available exploit exists per WPScan's advisory; real-world impact scales with the shortcodes registered on the site - ranging from benign output to sensitive data exposure or unintended privileged actions.
Shortcode injection in the Redirection for Contact Form 7 WordPress plugin (versions 2.2.7 through 3.2.10) enables unauthenticated remote attackers to execute arbitrary registered WordPress shortcodes server-side and capture their output. The plugin substitutes raw form submission values into its action settings and then evaluates those settings through WordPress's do_shortcode() pipeline without sanitizing or stripping user-supplied shortcode syntax first. A public proof-of-concept is available via WPScan; vendor-released patch version 3.2.11 addresses the issue.
Email header injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated attackers to manipulate outgoing email headers by submitting CRLF sequences in form address fields. Exploitation enables adding hidden recipients via BCC, spoofing the sender address, and abusing the victim site's trusted email reputation as a phishing or spam relay. A publicly available exploit entry is documented by WPScan, though exploitation requires a non-default configuration in which the plugin is explicitly set to source message address headers from user-submitted form fields.
Denial of service in h3 (npm package h3js/h3, versions 2.0.0-beta.4 through 2.0.1-rc.17) allows unauthenticated remote attackers to hang the Node.js server process with a single HTTP request. The `setChunkedCookie()` and `deleteChunkedCookie()` functions trust an attacker-controlled chunk count parsed from the sentinel cookie value (`__chunked__N`) without any upper bound, causing an O(n²) cleanup loop where each of up to N iterations scans all existing set-cookie response headers. No public standalone exploit repository has been identified, but the GHSA advisory publishes a complete exploit chain including exact cookie payloads, significantly lowering the exploitation bar.
Real Estate Papi WordPress theme (≤1.0.5) exposes an AJAX endpoint that lacks both capability checks and CSRF validation, enabling any authenticated subscriber to silently force-install a fixed set of companion plugins from the WordPress.org repository. Because CSRF protection is also absent, an attacker can craft a cross-site request that fires in an active administrator session, causing those plugins to be activated as well - an escalation beyond what subscriber-level access alone would permit. WPScan published a proof-of-concept; SSVC rates exploitation as none with partial technical impact, indicating no confirmed in-the-wild abuse at time of analysis.
Path traversal in h3's serveStatic utility (versions before 1.15.9) enables unauthenticated remote attackers to read arbitrary files from URL-based storage backends (S3, CDN, object storage) by exploiting a double-decoding flaw that bypasses dot-segment normalization. A request crafted with double-encoded dot sequences (%252e%252e) survives the resolveDotSegments() guard - which only matches literal '.' characters - and is then interpreted as '..' by RFC 3986-compliant URL backends. No public exploit code or active exploitation has been confirmed, though the GHSA advisory provides source-level analysis sufficient to guide exploit development.
Bifrost HTTP transport before version 2.0.0 exposes an unauthenticated plugin installation endpoint (POST /api/plugins) that accepts HTTP URLs as plugin paths, enabling SSRF on all build types and unauthenticated remote code execution on dynamically linked builds. Because management authentication is disabled by default (governance.auth_config.is_enabled=false), no credentials are required to trigger the flaw; the shared-object loader fetches the attacker-supplied URL, writes it as a temporary .so, and on DYNAMIC=1 builds calls plugin.Open() which immediately executes the plugin's Init() function as the Bifrost process user. Reported by JFrog, the fix ships in transports/v2.0.0, adding an SSRF-safe dial context (SSRFSafeDialContextWithAllowlist) around plugin downloads; no public exploit code or active exploitation has been confirmed at time of analysis.