Cookie validation key forgery in liufee FeehiCMS up to 2.1.1 allows unauthenticated remote attackers to craft arbitrary signed cookies by exploiting a hardcoded (or empty) `cookieValidationKey` in the production backend configuration file `environments/prod/backend/config/main-local.php`. Because FeehiCMS is built on the Yii2 framework, this key is used for HMAC-based cookie integrity verification; a known or empty key trivially breaks that guarantee, enabling session/cookie forgery that can lead to authentication bypass and backend access. A public proof-of-concept exploit exists (FEHI-003-Empty-cookieValidationKey), and no vendor patch has been issued despite responsible disclosure through a GitHub issue.
Cross-site scripting in SourceCodester Simple Traffic Offense System 1.0 allows remote attackers to inject arbitrary JavaScript via the site_name and site_desc parameters of the save-settings.php Settings Update Endpoint. The injected payload is stored server-side and executes in the browser of any user who subsequently loads the affected page. A public proof-of-concept exploit has been disclosed on GitHub (issue #3 in tan1540684326-QAQ/cve), confirming the vulnerability is reproducible.
Reflected cross-site scripting in projectworlds Online Examination System 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the Name and Subject parameters of feedback.php. Exploitation delivers malicious script payload to any user whose browser renders the tampered response, enabling session hijacking, credential theft, or defacement within the application context. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing has been identified at time of analysis.
Integer overflow vulnerabilities in Ollama's GGUF model decoder (versions 0.31.0-0.31.1) allow a remote attacker to crash the decoder by supplying a crafted GGUF model file containing malformed string lengths, tensor dimension counts, or array sizes. The overflow triggers in readGGUFV1String and related parsing functions in fs/ggml/gguf.go, causing Ollama to abort model loading and become temporarily unavailable. A public proof-of-concept exists (GitHub issue #17033) and a patch is available in v0.31.2-rc1; exploitation requires the target to load the malicious model file.
Out-of-bounds read in ModelCloud GPTQModel ≤7.2.0 allows an attacker who controls a GPTQ checkpoint file to trigger unauthorized GPU device memory reads during model inference. The Triton dequantization kernel in `tritonv2.py` indexes `scales`/`qzeros` buffers using the checkpoint-supplied `g_idx` tensor without any upper-bound guard, so a crafted entry ≥ `num_groups` reads past the allocated buffer on the device. A public proof-of-concept exists (GitHub issue #2949), and vendor-released fix v7.3.0 is available.
Cross-site scripting in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the msg, title, or content parameters in manage_subjects.php. A public proof-of-concept on GitHub documents both reflected and stored XSS variants, confirming the vulnerability is exploitable and the details are widely available. No vendor-released patch has been identified, and no active exploitation has been confirmed via CISA KEV.
Cross-site scripting in FastAdmin's User Controller (versions up to 1.2.0.20210401_beta) allows remote unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious `url` redirect parameter on the login or register endpoint. The commit diff confirms the `$url` variable was echoed unescaped into HTML attribute contexts and a JavaScript `location.href` assignment in three template files, enabling `javascript:` URI injection in addition to classic reflected XSS. A public proof-of-concept exploit exists; the vendor-released patch in version 1.2.1.20210731_beta resolves all three injection points.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the unsanitized `ID` parameter in `/pages/us_edit1.php`, enabling unauthorized database reads, data modification, and potential privilege escalation within the application. A public proof-of-concept exploit has been disclosed on GitHub, confirming the issue is both reproducible and accessible to low-skilled attackers. No vendor patch has been identified; the product is a PHP-based educational/demo application with limited enterprise deployment footprint.
Session fixation in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows unauthenticated remote attackers to pre-plant a session identifier via the auth_process.php login endpoint, then hijack the authenticated session after a victim logs in. The auth_process.php component fails to regenerate the session ID upon successful authentication, enabling full account takeover of any user who can be socially engineered into authenticating through a crafted link. A public exploit PoC exists on GitHub; no vendor patch has been released.
Improper access control in BookStack ≤26.05.2 allows authenticated low-privileged users to retrieve attachment edit form data for attachments on pages they are not authorized to access, by manipulating the ID parameter in requests to AttachmentController::getUpdateForm. The missing authorization check constitutes an Insecure Direct Object Reference (IDOR), leaking attachment metadata across permission boundaries. A public proof-of-concept blog post documents the attack path, and a vendor patch commit is available.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries through the `ID` parameter of `/pages/cust_edit1.php`. Exploitation requires low-privilege authentication and can result in unauthorized data read, modification, and limited availability impact against the underlying database. A public proof-of-concept exploit has been disclosed via GitHub, lowering the bar for opportunistic exploitation of any deployed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/settings_edit.php endpoint to database manipulation via the unsanitized ID parameter. Authenticated attackers with low-privilege access can read, modify, or partially disrupt database contents. A public proof-of-concept has been disclosed on GitHub, materially lowering the exploitation skill threshold for any system running this application.
SQL injection in itsourcecode Information System Society Membership System 1.0 exposes the database to read and write operations by authenticated remote attackers who manipulate the `student_id` parameter in `/society/check_student.php`. A public proof-of-concept exploit has been disclosed on GitHub. The CVSS 4.0 base score of 5.3 with low-impact ratings across C/I/A appears conservative for a CWE-89 flaw, which typically permits full database extraction and modification via UNION or stacked-query techniques.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Username parameter in /pages/us_transac.php. The CVSS 4.0 vector (PR:L) confirms a login is required, limiting the unauthenticated attack surface, but the impact spans confidentiality, integrity, and availability of the underlying database. A public proof-of-concept exploit has been disclosed via a GitHub issue, raising the likelihood of opportunistic exploitation against any exposed instance.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_transac.php` endpoint to database manipulation via the unsanitized `companyname` parameter. Authenticated remote attackers can inject arbitrary SQL, achieving partial read and write access to the underlying database. A public proof-of-concept exploit exists per GitHub issue reference; no CISA KEV listing has been observed.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the Name parameter in /pages/pro_transac.php?action=add. The vulnerability stems from unsanitized user input passed directly to SQL queries in a PHP backend, enabling data extraction, modification, or denial of service against the underlying database. A public exploit has been disclosed on GitHub, lowering the bar for exploitation.
Cross-site request forgery in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows a remote unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated victim by tricking them into visiting a malicious page. The vulnerability stems from missing CSRF tokens on one or more application functions, as documented in a public exploit report filed under VULN-08-CSRF-Missing-Tokens. A proof-of-concept exploit is publicly available on GitHub, though no active exploitation has been confirmed by CISA KEV.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries by injecting arbitrary SQL via the `ID` parameter in `/pages/pro_searchfrm.php`. The CVSS 4.0 vector (PR:L) confirms that low-privilege authenticated access is required, limiting the exposure compared to fully unauthenticated SQLi. A publicly available proof-of-concept exists on GitHub (referenced as an issue in the yunfan668/cve repository), though no active exploitation has been confirmed by CISA KEV. The affected product is a free PHP educational source-code project distributed by itsourcecode.com, constraining real-world impact to deployments of this niche academic software.
Cross-site request forgery in light0011 cms (rolling-release, at minimum through commits c774dce3 and f72cf46f) allows a remote attacker to perform unauthorized state-changing operations on behalf of an authenticated CMS user by inducing that user to visit a malicious page. A public proof-of-concept is documented in GitHub issue #12, and the project maintainer has not responded to the disclosure, leaving the vulnerability unpatched. The CVSS 4.0 score of 5.3 reflects the moderate but real-world risk: low integrity impact, no confidentiality exposure, and a mandatory passive user-interaction requirement.
Server-side request forgery in FeehiCMS up to version 2.1.1 allows authenticated high-privilege users to make the backend server issue arbitrary HTTP requests by manipulating the source[] parameter in the UEditor catchImage function. The CVSS 4.0 vector confirms network-reachable exploitation requiring high privileges (PR:H), limiting the attack surface to authenticated backend administrators. A public proof-of-concept writeup has been published on GitHub and the vendor has not responded to the responsible disclosure issue filed against the repository.
Missing authorization in FluentCMS's permission-management layer allows network-accessible, high-privileged users to bypass access controls enforced by the `GetAccessible` function in `PermissionManager.cs`. Versions up to and including 0.0.5 are affected. A publicly available proof-of-concept exists via a GitHub issue report, and the project had not responded to the disclosure at time of analysis; no vendor-released patch is available.
Reflected cross-site scripting (XSS) in code-projects Hospital Information System 1.0 allows a remote authenticated attacker to inject arbitrary JavaScript into victim browsers via the unsanitized `id` parameter in `/HIS/src/patients/editPatient.php`. An attacker who can craft a malicious URL and induce an authenticated user to click it can execute scripts in the victim's browser session, enabling session hijacking, credential theft, or UI redress. A public proof-of-concept exploit is available on GitHub; no KEV listing exists, and the CVSS 4.0 score of 2.0 reflects the limited real-world impact given authentication and user-interaction prerequisites.
Insufficient data exists to characterize this vulnerability beyond its title. The only available intelligence is the description 'Memory Leak During Message Stringification' and a single Ubuntu vendor attribution. No affected product, version, CVSS score, CWE, CPE, references, or patch details have been provided. Memory leak vulnerabilities during message serialization or stringification operations typically result in heap exhaustion and denial of service, but the specific product, component, and exploitation context remain entirely unknown from available data.
Memory leak vulnerabilities in attribute certificate parsing expose affected cryptographic library users to potential denial-of-service via memory exhaustion. Attribute certificates (X.509v2 AC, RFC 5755) are distinct from public-key certificates and carry authorization attributes; parsing them from untrusted network input - for example during TLS handshakes or certificate validation workflows - would allow an unauthenticated remote attacker to trigger repeated leaks and exhaust process heap memory over time. Reported by Ubuntu, no active exploitation has been identified at time of analysis, and no CVSS score is yet assigned.
Memory exhaustion via PKCS#7 certificate processing affects an Ubuntu-packaged cryptographic component, allowing crafted certificate containers to gradually leak heap memory. The vulnerable component is reported by Ubuntu but the specific library (e.g., OpenSSL, GnuTLS, or another ASN.1/PKCS#7 parser) is not identified in available data. An attacker capable of delivering malicious PKCS#7 containers to a vulnerable service - such as a TLS endpoint, S/MIME mail processor, or package verification daemon - could trigger sustained memory growth leading to service degradation or crash.
The generic VCS webhook handler in JetBrains YouTrack before 2026.2.18634 fails open when no webhook secret is configured, allowing unauthenticated remote callers to trigger webhook processing without any valid credential check. This CWE-306 flaw means that deployments where the webhook secret field is intentionally or inadvertently left blank accept all inbound webhook payloads as legitimate, bypassing the shared-secret verification mechanism. No public exploit code has been identified and the vulnerability is not in CISA KEV; the low CVSS score of 3.7 with AC:H accurately reflects that exploitation is constrained to misconfigured instances.
HCL MyXalytics is susceptible to a low-severity denial-of-service condition via unrestricted character input in user-facing fields. Authenticated users can submit arbitrarily long strings into application inputs, potentially degrading system performance or availability due to absent input-length controls. No public exploit code exists and no active exploitation has been observed; the vendor CVSS score of 3.5 (Low) reflects limited real-world impact.
Content spoofing in HCL MyXalytics (CWE-451) enables an authenticated, low-privileged attacker to inject manipulated content into the application's user interface, causing it to appear as though the content originates from a trusted source. The vulnerability requires victim interaction - a user must view the attacker-influenced page - and carries a CVSS 3.5 (Low) base score, reflecting its constrained impact on integrity only with no confidentiality or availability effects. No public exploit code or active exploitation has been identified; the primary real-world concern is phishing and social engineering facilitated through the spoofed interface.
Improper input validation in HCL MyXalytics allows an authenticated low-privileged user to submit malicious or unexpected data through the application, causing unintended system behavior or minor integrity-affecting outcomes. The CVSS vector (PR:L/UI:R/I:L) indicates exploitation requires both an authenticated session and user interaction, with impact limited to low-level integrity modification and no confidentiality exposure. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows a high-privileged attacker to inject malicious scripts by uploading crafted project or organization icon files. When other authenticated users subsequently view the affected project or organization page, the stored payload executes in their browser context, enabling session data exposure or unauthorized in-application actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
IP spoofing via forged HTTP headers in JetBrains YouTrack before 2026.2.18634 allows unauthenticated remote attackers to bypass Bitbucket webhook source validation, causing YouTrack to process attacker-crafted webhook payloads as if they originated from a legitimate Bitbucket server. The root cause is CWE-291 - reliance on IP address for authentication - specifically trusting client-controlled headers such as X-Forwarded-For to gate webhook acceptance. No public exploit has been identified at time of analysis, and JetBrains has released a patched build.
IntelliJ IDEA before version 2026.2.2 leaks project metadata to JetBrains Marketplace due to a missing project-trust check, exposing potentially sensitive project information without developer consent. The flaw requires local access and user interaction - specifically, a developer must open an untrusted project for the metadata transmission to occur. No public exploit code exists and no active exploitation has been identified; the impact is limited to a low-severity confidentiality breach (CVSS 3.3).
Server-Side Request Forgery (SSRF) in JetBrains IntelliJ IDEA before version 2026.2.2 allows an attacker to probe internal network resources by embedding a malicious Kubernetes spec-source URL inside a crafted project file. When a developer opens the untrusted project, the IDE automatically fetches the attacker-controlled URL, causing outbound requests to arbitrary hosts reachable from the developer's machine. Impact is limited to partial confidentiality loss (C:L) - internal network topology or service responses may be disclosed - with no integrity or availability consequences. No public exploit code is identified and the vulnerability is not listed in CISA KEV at time of analysis.
Authorization bypass in JetBrains YouTrack's whiteboard feature allows authenticated read-only whiteboard users to modify canvas content they should only be able to view, by sending a crafted WebSocket message. Affected versions are all YouTrack releases before 2026.2.18634. The vulnerability stems from CWE-863 (Incorrect Authorization) - the server-side WebSocket handler fails to enforce the read-only permission boundary, accepting write operations from users who lack write privileges. No public exploit or active exploitation has been identified.
Terminal command input written to idea.log in JetBrains IntelliJ IDEA before 2026.2.2 exposes sensitive command-line strings to any local party that can read the IDE's diagnostic log. Classified as CWE-532 (Insertion of Sensitive Information into Log File), the flaw means that developers who type passwords, API keys, or tokens as command-line arguments in IntelliJ's integrated terminal inadvertently persist those secrets on disk in a plaintext log file. No public exploit has been identified at time of analysis, and the vendor-assigned CVSS score of 2.8 accurately reflects the constrained local-only, user-interaction-dependent attack surface.
Terminal escape sequence injection in ash-project Igniter (versions 0.8.1-0.8.3) allows a malicious or typosquatted hex.pm package publisher to forge the `mix igniter.install` confirmation panel by embedding ANSI cursor-movement and line-erase control sequences in publisher-controlled metadata fields such as the package description, owner usernames, version, and download counts. Developers relying on this panel as an anti-typosquatting safeguard are shown attacker-crafted content that conceals the real metadata, potentially deceiving them into approving a malicious dependency. A vendor patch is available in version 0.8.4; no public exploit and no CISA KEV listing have been identified at time of analysis.
Authenticated MISP users can enumerate the hidden organisation directory in deployments running version ≤2.5.45 where Security.hide_organisation_index_from_users is enabled, because multiple dashboard widgets failed to enforce the same authorization check that guards the standard /organisations/index endpoint. Three compounding weaknesses escalate the exposure beyond simple enumeration: missing checkPermissions() in NewOrgsWidget and OrgsContributorsGeneric allows any authenticated user to bypass the intended restriction; unrestricted find('all') database queries returned full organisation table rows including contacts and metadata through the JSON export code path; and a limit parameter flaw (limit=0 or negative values exploiting CakePHP DboSource behavior) effectively removed result pagination, potentially dumping the entire organisation table. CIRCL reported and patched the issue via commits 67892d90e and 5e333a159; no public exploit is identified at time of analysis.
Organisation metadata enumeration in MISP ≤2.5.45 is possible for authenticated users when the `Security.hide_organisation_index_from_users` configuration option is enabled, because the dashboard organisation picker queries the full organisation table without applying the same ACL conditions enforced by the standard organisation index and per-organisation view endpoints. The picker returns organisation ID, UUID, and name for all organisations, bypassing the visibility restriction. Patch commit 8ca4486af from CIRCL adds the missing `Organisation::createConditions()` call to scope picker results to organisations the requesting user is already authorised to see. No public exploit code has been identified and this CVE is not listed in CISA KEV.
Reflected cross-site scripting in sfturing ssm_pro's OrderController allows unauthenticated remote attackers to inject arbitrary JavaScript via the hospitalName, officesName, or doctorName parameters of the Order Endpoint. The affected codebase (up to commit 627f426331da8086ce8fff2017d65b1ddef384f8) is a Java-based hospital order management system that fails to sanitize user-supplied input before rendering it in the browser. An exploit has been published and is publicly available; the project maintainer has not yet responded to the disclosure despite being notified via a GitHub issue report.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated low-privilege remote attackers to manipulate the `id` parameter in `/pages/emp_edit1.php`, enabling arbitrary SQL query manipulation against the underlying database. A public proof-of-concept has been published via GitHub (E:P confirmed in CVSS 4.0 vector). The CVSS 4.0 base score of 2.1 reflects limited assessed impact (VC:L/VI:L/VA:L), though real-world SQL injection impact is database-permission-dependent and may exceed this baseline in misconfigured deployments.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows low-privileged remote attackers to manipulate database queries through the `Customer` argument at `/pages/pos_transac.php?action=add`. The flaw enables unauthorized data reading and modification within the application database. A proof-of-concept exploit has been publicly published, lowering the bar for exploitation.
ULID first-character non-canonicality in ash_double_entry (Elixir) exposes a multi-spelling identifier aliasing flaw affecting versions 0.1.0 through 1.0.18. The AshDoubleEntry.ULID type encodes 128-bit identifiers as 26 Crockford base-32 characters, but the first character carries only 3 usable bits - canonical values are 0 through 7 - while the library's decode and validation functions accepted all 32 possible characters there, allowing 8, G, and R to silently decode to the identical 16-byte value as their canonical counterpart. An attacker who can submit caller-controlled ULIDs over an HTTP or API boundary can exploit this to circumvent application-layer string comparisons such as idempotency keys, deduplication guards, deny-list lookups, or audit-trail correlation, causing the server to resolve the intended record while treating the alternate spelling as a distinct key. No public exploit has been identified at time of analysis.
ImageMagick's video decoder contains a TOCTOU race condition that allows a local low-privileged attacker to bypass the policy.xml path write restrictions by swapping a symlink between the policy validation step and the actual file write operation. Both the ImageMagick 7 branch (before 7.1.2-30) and the legacy ImageMagick 6 branch (before 6.9.13-55) are affected, covering a wide range of deployed versions. No public exploit code exists and no active exploitation has been confirmed; the CVSS 4.0 score of 2.0 accurately reflects the local-access and race-condition constraints.
Path policy enforcement in ImageMagick before 7.1.2-30 on Windows can be circumvented by a local attacker exploiting a TOCTOU symlink race condition (CWE-59), granting unauthorized read or write access to files explicitly blocked by the ImageMagick policy.xml security configuration. The race window opens between the moment ImageMagick validates the symlink target against its policy and the subsequent actual filesystem I/O call, allowing an attacker to atomically swap the symlink to a policy-denied destination in that interval. No public exploit code is identified at time of analysis, CISA has not listed this in KEV, and the CVSS 4.0 base score of 1.0 accurately reflects the high attack complexity and constrained local-only vector.