Certificate revocation bypass in mwiede jsch through version 2.28.5 allows unauthenticated remote attackers to have a revoked SSH host certificate accepted as trusted during host verification. The `setKnownHosts()` parser in `KnownHosts.java` failed to recognize OpenSSH certificate key types (e.g., `ssh-ed25519-cert-v01@openssh.com`) as valid when paired with the `@revoked` marker, causing such entries to be skipped rather than tracked in the revocation pool - silently nullifying the revocation check. A public proof-of-concept is available via GitHub issue #1091, and the fix is released as version 2.28.6.
Improper authorization in Open5GS 2.7.7 and 2.8.0 AMF (5G) and MME (4G) components allows an authenticated, network-registered gNB or eNB to send crafted NG-Reset or S1-Reset messages listing NGAP/S1AP UE IDs that belong to sessions managed by a different base station. The AMF/MME processes these resets without verifying ownership, enabling session termination for subscribers served by other base stations. A publicly available proof-of-concept exists (GitHub issue #4680), and an upstream patch commit is available, though no versioned release has been independently confirmed.
Reflected cross-site scripting in code-projects Hotel and Tourism Reservation in PHP 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the `room` parameter in `/ht/details.php`. When a victim user follows a crafted URL, the unsanitized parameter is reflected directly into the HTML response, executing attacker-controlled script in the victim's browser context and enabling session hijacking or credential theft. A public proof-of-concept writeup exists on GitHub, though no active exploitation has been confirmed and no CISA KEV listing is present.
Improper access control in JeecgBoot's AI-RAG module (versions up to 3.9.3) permits a low-privileged authenticated user to invoke the exportXls endpoint in AiragModelController.java and extract LLM model credentials by manipulating the credential parameter beyond their authorization level. The attack is network-accessible and requires only a valid low-privileged session with no administrative rights. A public proof-of-concept is available via GitHub issue #9600, and a vendor patch has been released in version 3.9.5.
Insufficient session expiration in Mstfakts College-Management-System allows an authenticated remote attacker to manipulate the `log_out` argument in `Front-end/server.php` such that the server-side session is not properly invalidated upon logout. An attacker who retains a session token - obtained through prior authentication or session interception - can reuse it after the legitimate user has attempted to log out, maintaining unauthorized access to the application. A public proof-of-concept exists; however, this is an unresponsive open-source project with no released patch.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries via the firstname parameter in the /pages/cust_transac.php?action=add endpoint, potentially enabling unauthorized data exfiltration, modification, or deletion. The CVSS 4.0 vector confirms authentication is required (PR:L), restricting exploitation to users with at least low-privilege credentials. A public exploit is available on GitHub, lowering the practical barrier for authenticated attackers, though no confirmed active exploitation (CISA KEV) has been identified.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the ID parameter in /pages/us_del.php?type=user to execute arbitrary SQL statements against the backend database. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the attack surface to logged-in users. A public proof-of-concept exploit has been disclosed on GitHub, elevating practical risk despite the moderate base score of 5.3.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate the `ID` parameter in `/pages/trans_view.php`, enabling arbitrary database read and write operations. The vulnerability is CWE-89 (Improper Neutralization of Special Elements in SQL Commands), affecting version 1.0 with no version range ambiguity per the CPE wildcard. A public exploit has been released and is available for use in attacks, raising the practical risk above the moderate CVSS 4.0 score of 5.3 suggests.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows a remote authenticated low-privileged user to manipulate the ID parameter in /pages/pro_del.php to read, modify, or partially disrupt the underlying database. The vulnerability is exploitable over the network with low complexity and carries a publicly available proof-of-concept. No vendor patch has been identified; the software is a free educational PHP project distributed by itsourcecode.com, limiting real-world production exposure.
SQL injection in DefaultFuction CRM 1.0.0 allows low-privileged authenticated attackers to manipulate the `ID` parameter in `/modules/customers/delete.php`, enabling unauthorized database read and write operations. A public proof-of-concept exploit is available via a GitHub issue on the vendor's repository, lowering the bar for exploitation. No vendor-released patch has been identified at time of analysis, leaving deployments dependent on compensating controls.
SQL injection in DefaultFuction CRM 1.0.0 allows authenticated remote attackers to manipulate database queries via the ID argument in /modules/orders/delete.php. The CVSS 4.0 vector (PR:L) confirms low-privilege authentication is required, limiting opportunistic mass exploitation. A public proof-of-concept has been disclosed via a GitHub issue against the project repository, meaning the attack path is documented and reproducible. No patch is available at time of analysis.
SQL injection in DefaultFuction CRM 1.0.0 allows remote attackers with low-privilege accounts to manipulate the underlying database via the unsanitized ID parameter in /modules/orders/edit.php (CWE-89). A publicly available exploit has been published on the project's own GitHub issue tracker, lowering the bar for exploitation considerably. No vendor patch has been identified at time of analysis.
Cross-site request forgery in diem-project/diem up to version 5.1.3 allows remote attackers to trigger unauthorized console command execution by tricking an authenticated administrator into visiting a malicious page. The vulnerability resides in the dmConsole module's executeCommand action, which processes the dm_command parameter without verifying request origin. A public proof-of-concept exploit exists via GitHub issue #449, and the vendor has not responded to the coordinated disclosure, leaving no patch available.
Stored cross-site scripting in code-projects Task Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the `lname` parameter in `/user/UpdateUserProfile.php`. When a victim views the tampered profile, the injected script executes in their browser session. A public proof-of-concept exploit is available on GitHub, lowering the bar for exploitation.
Out-of-bounds read in Valkey's `kvstoreGetHashtable` function (src/kvstore.c) allows an attacker who can supply a crafted RDB file at server startup to corrupt the `didx` argument beyond the valid hashtable index range, crashing the process and rendering the cluster node unavailable. Affected versions are ≤9.0.5 (stable) and ≤9.1.1 (development branch); exploitation requires cluster mode and attacker-controlled RDB input, making this a constrained, low-severity DoS limited to the startup phase. A POC RDB archive is publicly available; no public exploit identified for active exploitation and CISA KEV listing is absent. The Valkey maintainers explicitly characterized the issue as a memory-safety improvement below their security-disclosure threshold.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes database contents and integrity to remote low-privileged attackers through an unsanitized ID parameter in the supplier management endpoint /pages/sup_del.php?type=supplier. Public exploit code has been published via a GitHub issue, confirming the vulnerability is reproducible. No vendor patch has been identified, and the product originates from itsourcecode.com, a source-code learning platform whose deployments are likely small-scale or demo environments.
Cross-site scripting in Projectwolds Online Attendance System 1.0 allows authenticated remote attackers to inject arbitrary client-side scripts via the email parameter in profile.php. Successful exploitation requires the victim to interact with a crafted page, resulting in low-integrity impact such as session hijacking or UI redressing. A public exploit has been released, though the low CVSS 4.0 score of 2.0 reflects the limited impact and authentication requirement.