Authentication bypass in HivePress Authentication plugin for WordPress (≤1.1.4) allows an unauthenticated network attacker to log in as any WordPress user - including administrators - whose account email is linked to a Facebook account. The plugin's Facebook OAuth handler forwards the caller-supplied access_token directly to the Facebook Graph API and blindly trusts the returned email and user ID, performing no /debug_token audience validation and no comparison of the token's app_id against the configured hp_facebook_app_id. Exploitation requires the attacker to first acquire a valid Facebook access token associated with the victim's account, which is the primary complexity barrier - but once obtained, the attack yields full account takeover with no WordPress credentials required. No public exploit or CISA KEV listing has been identified at the time of analysis.
Relative path traversal in Apache Ant's built-in `ftp` and `scp` tasks (versions 1.2 through 1.10.17) permits a malicious or MITM-intercepted remote server to supply server-controlled paths that escape the configured download directory, overwriting arbitrary files with the filesystem permissions of the Ant process. For FTP tasks not using FTPS, no server identity check is enforced, making a network MITM attacker sufficient to trigger the write primitive without needing a valid certificate. The vulnerability is fixed in Ant 1.10.18, which validates destination paths by default; no public exploit code has been identified and EPSS is low at 0.19%.
Uncontrolled resource consumption in wger before 2.5 allows any authenticated user to exhaust server worker threads and deny service to all legitimate users. By creating a routine with an arbitrarily long date range (e.g., 100 years spanning 2000-2099) and then triggering the unbounded `date_sequence` while-loop via any of five routine detail REST endpoints, a single HTTP request forces 36,525 per-day iterations - each performing O(slots × entries × configs) computation - consuming multiple seconds of CPU. No public exploit code has been released independently, though the GHSA advisory itself contains a complete, weaponizable step-by-step PoC including exact API payloads.
Authorization bypass in MISP's UiBeta theme collection view exposes full event details - including identifiers, info fields, timestamps, creator organization, all event tags, and galaxy clusters - to authenticated users who lack ACL permissions to those events. The UiBeta theme's `view.ctp` template performed an independent secondary database query using only `Event.uuid IN (...)` without invoking `createEventConditions()`, the canonical per-user ACL enforcement method, even though `CollectionsController::view()` correctly filtered events via `Event::fetchSimpleEvents($user, ...)`. The flaw is compounded because `CollectionElementsController::add()` accepts arbitrary UUIDs from collection owners without validating the submitter's authorization against the referenced event, making collection elements an attacker-controlled input to an unfiltered query. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.
Certificate revocation bypass in mwiede jsch through version 2.28.5 allows unauthenticated remote attackers to have a revoked SSH host certificate accepted as trusted during host verification. The `setKnownHosts()` parser in `KnownHosts.java` failed to recognize OpenSSH certificate key types (e.g., `ssh-ed25519-cert-v01@openssh.com`) as valid when paired with the `@revoked` marker, causing such entries to be skipped rather than tracked in the revocation pool - silently nullifying the revocation check. A public proof-of-concept is available via GitHub issue #1091, and the fix is released as version 2.28.6.
SSE event injection in the h3 JavaScript HTTP framework (npm package h3js/h3, versions before 1.15.9 stable and before 2.0.1-rc.17 beta) allows remote attackers to inject arbitrary Server-Sent Events by embedding carriage return (`\r`) characters in `data` or `comment` fields that are reflected into the EventStream. Because the HTML SSE specification treats `\r` as a valid line terminator, browsers parse injected `\r` sequences as field boundaries - enabling attackers to spoof event types, split a single push call into multiple distinct browser-parsed events, or escape comment fields to deliver fake data. This is a confirmed incomplete-fix bypass: the prior commit `7791538` sanitized `\n` and `\r` only for `id` and `event` fields while leaving `data` and `comment` unprotected. No public exploit has been confirmed in CISA KEV; however, the GHSA advisory (GHSA-4hxc-9384-m385) includes a proof-of-concept server setup demonstrating the bypass.
Privilege escalation in PostgreSQL Anonymizer (Dalibo) prior to 3.2.0 allows a table owner to execute arbitrary code with full superuser privileges via the `anon.anonymize_database_parallel()` function. The vulnerability (CWE-250, Execution with Unnecessary Privileges) enables a low-to-high privilege escalation within the database server, granting complete C:H/I:H/A:H impact. No public exploit has been identified and the issue is not listed in CISA KEV; a vendor-released patch is available in version 3.2.0.
SQL injection in PostgreSQL Anonymizer's anon.import_database_rules() and anon.import_roles_rules() functions enables privilege escalation to superuser-level code execution within PostgreSQL. A low-privileged database user plants a malicious JSON rules document containing crafted object names (such as schema, table, or column identifiers); when a superuser subsequently invokes either import function, the injected SQL executes with superuser privileges, yielding full database compromise. The vendor has released a fix in version 3.1.4; no public exploit has been identified at time of analysis.
Improper authorization in Open5GS 2.7.7 and 2.8.0 AMF (5G) and MME (4G) components allows an authenticated, network-registered gNB or eNB to send crafted NG-Reset or S1-Reset messages listing NGAP/S1AP UE IDs that belong to sessions managed by a different base station. The AMF/MME processes these resets without verifying ownership, enabling session termination for subscribers served by other base stations. A publicly available proof-of-concept exists (GitHub issue #4680), and an upstream patch commit is available, though no versioned release has been independently confirmed.
Reflected cross-site scripting in code-projects Hotel and Tourism Reservation in PHP 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the `room` parameter in `/ht/details.php`. When a victim user follows a crafted URL, the unsanitized parameter is reflected directly into the HTML response, executing attacker-controlled script in the victim's browser context and enabling session hijacking or credential theft. A public proof-of-concept writeup exists on GitHub, though no active exploitation has been confirmed and no CISA KEV listing is present.
Improper access control in JeecgBoot's AI-RAG module (versions up to 3.9.3) permits a low-privileged authenticated user to invoke the exportXls endpoint in AiragModelController.java and extract LLM model credentials by manipulating the credential parameter beyond their authorization level. The attack is network-accessible and requires only a valid low-privileged session with no administrative rights. A public proof-of-concept is available via GitHub issue #9600, and a vendor patch has been released in version 3.9.5.
Incomplete authorization fix in wger through master exposes three user-management views in wger/core/views/user.py to the same None != None gym-scope bypass previously identified in CVE-2026-43948 (GHSA-mhc8-p3jx-84mm). A gym staff member holding gym.manage_gym permission whose account has gym=None - the default unlinked state for any newly provisioned staff account - can permanently delete, deactivate, or re-activate any other user also carrying gym=None, exploiting a raw integer comparison that evaluates None != None as False instead of blocking the operation. No vendor-released patch has been identified at time of analysis; all wger versions through the master Docker image build of 2026-05-08 are confirmed affected.
Insufficient session expiration in Mstfakts College-Management-System allows an authenticated remote attacker to manipulate the `log_out` argument in `Front-end/server.php` such that the server-side session is not properly invalidated upon logout. An attacker who retains a session token - obtained through prior authentication or session interception - can reuse it after the legitimate user has attempted to log out, maintaining unauthorized access to the application. A public proof-of-concept exists; however, this is an unresponsive open-source project with no released patch.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the firstname parameter in the /pages/cust_transac.php?action=add endpoint, potentially enabling unauthorized data exfiltration, modification, or deletion. The CVSS 4.0 vector confirms authentication is required (PR:L), restricting exploitation to users with at least low-privilege credentials. A public exploit is available on GitHub, lowering the practical barrier for authenticated attackers, though no confirmed active exploitation (CISA KEV) has been identified.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /pages/us_del.php?type=user to execute arbitrary SQL statements against the backend database. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the attack surface to logged-in users. A public proof-of-concept exploit has been disclosed on GitHub, elevating practical risk despite the moderate base score of 5.3.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate the `ID` parameter in `/pages/trans_view.php`, enabling arbitrary database read and write operations. The vulnerability is CWE-89 (Improper Neutralization of Special Elements in SQL Commands), affecting version 1.0 with no version range ambiguity per the CPE wildcard. A public exploit has been released and is available for use in attacks, raising the practical risk above the moderate CVSS 4.0 score of 5.3 suggests.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows a remote authenticated low-privileged user to manipulate the ID parameter in /pages/pro_del.php to read, modify, or partially disrupt the underlying database. The vulnerability is exploitable over the network with low complexity and carries a publicly available proof-of-concept. No vendor patch has been identified; the software is a free educational PHP project distributed by itsourcecode.com, limiting real-world production exposure.
SQL injection in DefaultFuction CRM 1.0.0 allows low-privileged authenticated attackers to manipulate the `ID` parameter in `/modules/customers/delete.php`, enabling unauthorized database read and write operations. A public proof-of-concept exploit is available via a GitHub issue on the vendor's repository, lowering the bar for exploitation. No vendor-released patch has been identified at time of analysis, leaving deployments dependent on compensating controls.
SQL injection in DefaultFuction CRM 1.0.0 allows authenticated remote attackers to manipulate database queries via the ID argument in /modules/orders/delete.php. The CVSS 4.0 vector (PR:L) confirms low-privilege authentication is required, limiting opportunistic mass exploitation. A public proof-of-concept has been disclosed via a GitHub issue against the project repository, meaning the attack path is documented and reproducible. No patch is available at time of analysis.
SQL injection in DefaultFuction CRM 1.0.0 allows remote attackers with low-privilege accounts to manipulate the underlying database via the unsanitized ID parameter in /modules/orders/edit.php (CWE-89). A publicly available exploit has been published on the project's own GitHub issue tracker, lowering the bar for exploitation considerably. No vendor patch has been identified at time of analysis.
Cross-site request forgery in diem-project/diem up to version 5.1.3 allows remote attackers to trigger unauthorized console command execution by tricking an authenticated administrator into visiting a malicious page. The vulnerability resides in the dmConsole module's executeCommand action, which processes the dm_command parameter without verifying request origin. A public proof-of-concept exploit exists via GitHub issue #449, and the vendor has not responded to the coordinated disclosure, leaving no patch available.
Stored cross-site scripting in code-projects Task Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the `lname` parameter in `/user/UpdateUserProfile.php`. When a victim views the tampered profile, the injected script executes in their browser session. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation.
Authentication bypass in Mstfakts College-Management-System exposes the login endpoint at Front-end/login.php to manipulation of the email argument, enabling remote unauthenticated attackers to circumvent access controls entirely. A public proof-of-concept exploit has been disclosed (CVSS 4.0 E:P), and the project maintainer has not responded to the responsible disclosure report filed via GitHub. No patched release exists due to the rolling-release delivery model, leaving all current deployments without a vendor-supported fix.
Out-of-bounds read in Valkey's `kvstoreGetHashtable` function (src/kvstore.c) allows an attacker who can supply a crafted RDB file at server startup to corrupt the `didx` argument beyond the valid hashtable index range, crashing the process and rendering the cluster node unavailable. Affected versions are ≤9.0.5 (stable) and ≤9.1.1 (development branch); exploitation requires cluster mode and attacker-controlled RDB input, making this a constrained, low-severity DoS limited to the startup phase. A POC RDB archive is publicly available; no public exploit identified for active exploitation and CISA KEV listing is absent. The Valkey maintainers explicitly characterized the issue as a memory-safety improvement below their security-disclosure threshold.
Open redirect in h3 (h3js) before 2.0.1-rc.18 allows unauthenticated remote attackers to redirect victims to arbitrary external domains by crafting a Referer header containing a same-origin URL with a double-slash path segment (e.g., http://target.com//evil.com/phish). The redirectBack() utility passes the WHATWG origin check - because the parsed origin is correctly identified as the target domain - but emits the raw pathname //evil.com/phish as the Location header, which browsers interpret as a protocol-relative redirect to an attacker-controlled site. A proof-of-concept is included in the GHSA advisory; no active exploitation (CISA KEV) has been identified at time of analysis.
Open redirect in wger's trainer_login view allows an attacker to redirect an authenticated trainer's browser to an arbitrary external domain immediately after impersonation mode is established. The root cause is in `wger/core/views/user.py` (~line 203), where `HttpResponseRedirect(request.GET['next'])` is called without invoking Django's `url_has_allowed_host_and_scheme()` guard, allowing any URL - including off-host ones - to be supplied via the `?next=` GET parameter. Beyond phishing, the redirect leaks the wger instance URL structure and the impersonated user's `user_pk` through the browser's Referer header; a working PoC is confirmed in the GHSA advisory, though no active exploitation has been reported.
CSV/TSV formula injection in wger's gym member export endpoint allows any authenticated gym member to pre-load spreadsheet formulas into their own first_name or last_name profile fields, which are then reproduced verbatim in the TSV export file. When a gym administrator opens the exported file in Excel, LibreOffice Calc, or Google Sheets, the formula executes in the admin's local spreadsheet context, enabling data exfiltration via =HYPERLINK callbacks and, on legacy Excel deployments with DDE enabled, arbitrary local code execution. No public exploit code has been independently verified beyond the researcher's proof-of-concept described in the GHSA advisory; this vulnerability is not listed in the CISA KEV catalog.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes database contents and integrity to remote low-privileged attackers through an unsanitized ID parameter in the supplier management endpoint /pages/sup_del.php?type=supplier. Public exploit code has been published via a GitHub issue, confirming the vulnerability is reproducible. No vendor patch has been identified, and the product originates from itsourcecode.com, a source-code learning platform whose deployments are likely small-scale or demo environments.
Cross-site scripting in Projectwolds Online Attendance System 1.0 allows authenticated remote attackers to inject arbitrary client-side scripts via the email parameter in profile.php. Successful exploitation requires the victim to interact with a crafted page, resulting in low-integrity impact such as session hijacking or UI redressing. A public exploit has been released, though the low CVSS 4.0 score of 2.0 reflects the limited impact and authentication requirement.