Cross-site scripting in aircheng-org iWebShop-5 through version 5.15 allows unauthenticated remote attackers to inject malicious JavaScript via the outerSrc and selectPhoto parameters of the uploadFile function in controllers/pic.php. Victim interaction is required to trigger script execution in the target's browser, resulting in limited integrity impact such as session hijacking or page defacement. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure.
Stack-based buffer overflow in vgmstream up to r2117 allows a remote attacker to crash or potentially execute arbitrary code by delivering a specially crafted TXTH or TXTP audio metadata file to a user. The root cause is an unbounded sscanf invocation in src/meta/txth.c that writes attacker-controlled content from a text metadata file into a fixed-size stack buffer without field-width constraints (CWE-121). Publicly available exploit code exists (GitHub issue #1972), and an upstream patch commit is available (4669d37a6af94866f6f0628678f9f90d46954e8b via PR #1956), though no formally tagged patched release has been independently confirmed.
Cross-site scripting in on-premises Skype for Business Server enables network-accessible spoofing attacks across three supported server generations. The CVSS 6.5 rating reflects limited confidentiality and integrity impact, consistent with content-injection or UI-spoofing outcomes rather than full session takeover. A vendor-released patch is available through the Microsoft Security Response Center; no public exploit has been identified at time of analysis.
Cross-site scripting in HTML::FormHandler before 0.410000 (Perl/CPAN) allows unauthenticated network attackers to inject arbitrary JavaScript by submitting markup to any form field that triggers a validation error message embedding the submitted value. The library's rendering roles - Render::Simple, Render::Table, and Widget::Form::Simple - interpolate error strings directly into HTML error spans without entity encoding, so fields using check regexps, check lists, or type constraints expose the reflected XSS path. A stored XSS variant is also possible when applications persist and later re-render rejected form values. No public exploit is identified; vendor-released patch 0.410000 is available.
Improper access controls in java-json-tools json-patch (versions up to 1.13) allow low-privileged, network-accessible attackers to abuse the CopyOperation.apply and MoveOperation.apply methods to reference JSON document paths outside their permitted scope, enabling unauthorized data reads or writes within the processed JSON structure. The flaw resides in src/main/java/com/github/fge/jsonpatch/CopyOperation.java and affects any application that exposes JSON Patch processing to partially-trusted callers without additional server-side path validation. A public proof-of-concept exists via GitHub issue #170; no CISA KEV listing has been recorded, and the CVSS 4.0 score of 5.3 reflects the limited C/I impact and mandatory low-privilege prerequisite.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows remote authenticated attackers with low-privilege accounts to manipulate the ID argument passed to mysqli_query() in /pages/us_searchfrm.php, enabling database enumeration, data exfiltration, and potential data modification. A public exploit has been published on GitHub, corroborated by VulDB reporting. The CVSS 4.0 vector (PR:L, E:P) confirms authentication is required but that exploit code is in circulation, lowering the bar for opportunistic abuse.
Cross-site scripting in HTML::FormHandler before 0.410002 for Perl allows unauthenticated remote attackers to inject JavaScript into rendered pages when application field attributes are derived from user-controlled data. The root cause is the `process_attrs` method in `HTML/FormHandler/Render/Util.pm`, which formats attribute key-value pairs via `sprintf('%s="%s"', $attr, $value)` without encoding, letting a double-quote character break out of the attribute context and inject event handlers. The fix - encoding double quotes and ampersands via `HTML::Entities::encode_entities` - is confirmed merged and released as version 0.410002 on CPAN.
Stored and reflected cross-site scripting in HTML::FormHandler before 0.410002 (Perl/CPAN) allows attacker-influenced text in form option labels to execute arbitrary JavaScript in victims' browsers. The Select, RadioGroup, CheckboxGroup, and HorizCheckboxGroup widgets passed group labels and individual option labels directly into rendered HTML without applying HTML encoding, meaning any application that builds option lists from database records, user submissions, or dynamic sources exposes those label values as live markup. No public exploit code has been identified, but the patch commit and oss-security disclosure provide full technical detail on the affected rendering paths.
Reflected XSS in HTML::FormHandler before 0.410002 allows unauthenticated network attackers to inject JavaScript into rendered Perl web application pages by submitting form input containing script content. The Table form layout and Bootstrap 2 and 3 wrappers interpolated error strings - including rejected field values - directly into HTML without HTML-entity encoding, an incomplete fix relative to CVE-2026-19872 (which patched equivalent paths in other layouts in version 0.410000). No public exploit is identified and EPSS is 0.19%; risk is limited to applications using the three affected widget modules.
Heap out-of-bounds read in gdk-pixbuf's ICNS decompression routine allows an attacker to crash GNOME applications or disclose adjacent heap memory by supplying a crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS data, lacks bounds validation on the source buffer during decompression. Exploitation requires user interaction - the target must open or preview the malicious file - but thumbnail-rendering paths in file managers such as Nautilus may reduce that barrier. No public exploit or KEV listing has been identified at the time of analysis.
Cross-site scripting in Silverpeas Core <=6.4.6 enables attackers to inject malicious JavaScript via the Multimedia library application's introduction field, executing arbitrary scripts in victim users' browser contexts. The scope-changed CVSS vector (S:C) confirms the payload crosses security boundaries, affecting any authenticated user who views the injected library introduction. No active exploitation is confirmed and the EPSS score of 0.15% at the 4th percentile reflects very low current exploitation probability.
Cross-site scripting in Silverpeas Core <=6.4.6 allows script injection through the CKEditor WYSIWYG image upload feature, executing attacker-controlled JavaScript in victims' browsers. The scope-changed (S:C) vector confirms the injected script runs in a different origin context, enabling session theft, credential harvesting, or malicious UI redirection against authenticated platform users. EPSS stands at 0.15% (4th percentile), indicating minimal observed exploitation activity; no public exploit code or CISA KEV listing exists at time of analysis.
Cross-site scripting in Silverpeas Core 6.4.6 exposes other authenticated users to session hijacking or credential theft via the document management file upload feature. The scope-changed CVSS vector (S:C) confirms the injected script executes in a different security context than the upload origin, enabling impact beyond the uploading user's own session. No public exploit or active exploitation has been confirmed; EPSS at 0.15% (4th percentile) indicates very low current exploitation probability.
Privilege escalation in AlgoSec Horizon Security Analyzer (versions A33.10/A33.20/A33.30 on Linux 64-bit) allows a low-privileged local user to gain elevated - likely root - access by injecting malicious parameters into a command approved in the sudoers file. The root cause (CWE-266, Improper Privilege Management) is insufficient restriction of arguments permitted when invoking the sudo-approved command, enabling a classic parameter injection attack. No public exploit code is identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Time-based blind SQL injection in code-projects Student Crud Operation 1.0 allows low-privileged remote attackers to extract database contents by manipulating the `id` parameter in `/edit.php`. A public proof-of-concept exploit documenting the exact technique has been published on GitHub, making exploitation straightforward with automated tooling. No vendor patch has been identified, and the product shows no evidence of active maintenance.
Nginx directive injection in Okta Access Gateway before version 2026.9.1 enables an authenticated administrator to inject arbitrary nginx directives into the gateway's server block by exploiting the application-level custom configuration field, which bypasses the Lua-based restriction mechanism applied to other directive entry points. The field is interpolated directly into the nginx server block without validation, allowing manipulation of routing, access controls, and header processing with high integrity impact. Vendor-released patch version 2026.9.1 is available; no public exploit has been identified at time of analysis.
OIDC SSO authentication bypass in n8n Enterprise allows users with credentials in a previously configured but administratively disabled identity provider to obtain valid application sessions. The public OIDC login and callback endpoints in `packages/cli/src/modules/sso-oidc/oidc.service.ee.ts` lacked an `assertOidcLoginEnabled` guard, meaning disabling OIDC at the n8n configuration level did not actually deactivate the protocol handler. Fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2 per GitHub Security Advisory GHSA-pf83-w3f9-8m37; no public exploit code has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in Microsoft SQL Server allows a network-connected attacker with high database privileges to corrupt heap memory, causing at minimum a denial-of-service crash of the SQL Server process and potentially enabling code execution. Affects SQL Server versions 2017 through 2025 across both GDR and Cumulative Update servicing tracks. Microsoft has released patches for all affected versions; no public exploit code or CISA KEV listing identified at time of analysis, though the description's claim of code execution potential warrants close attention despite vendor CVSS metrics reflecting only availability impact.
Prototype pollution in n8n's Instance AI workflow summary feature allows authenticated users to disrupt the main n8n process by submitting crafted workflows via the REST API. The `summarizeWorkflowStructure` function in `packages/@n8n/instance-ai/src/tools/workflows/summarize-workflow.ts` uses workflow node names and connection keys as raw JavaScript object keys without sanitization, so keys such as `__proto__` or `constructor` cause nested writes to reach `Object.prototype` in the main process and corrupt the JavaScript runtime state. This renders the n8n instance unreliable or unavailable for subsequent requests, making it a targeted denial-of-service attack requiring only low-privilege API access. No public exploit and no CISA KEV listing have been identified at time of analysis; patches are available in versions 2.37.7 and 2.38.2.
Use-after-free in MongoDB Server's cursor management component allows an authenticated remote attacker to crash the mongod server process, causing a denial of service. Under specific timing conditions during cursor lifecycle events, a stale pointer to a freed resource is retained and later dereferenced during cursor cleanup, producing undefined behavior and a process crash. Affected branches are MongoDB 7.0.x before 7.0.41, 8.0.x before 8.0.30, and 8.3.x before 8.3.9; vendor-patched releases are available, and no public exploit code is identified at time of analysis.
Denial of service in MongoDB Server allows any authenticated user - including those with only read-only privileges - to crash the mongod process by exploiting an internal aggregation expression that was incorrectly registered as user-accessible rather than restricted to internal cluster operations. Submitting a malformed index specification within this expression triggers an assertion failure (CWE-617) in the index key generation code path. In affected build configurations, this assertion failure terminates the mongod process, severing all active client connections. No public exploit code and no CISA KEV listing are identified at time of analysis, but the low privilege requirement (read-only user) makes this a realistic insider or compromised-credential threat.
Heap use-after-free in MongoDB Server's text index query parser allows authenticated users with readWrite privileges to crash the server process through deliberate concurrent operations. By combining upsert retry text-search queries with concurrent index lifecycle operations (create/drop) on the same collection, an attacker can trigger a race window where a raw pointer to freed text index metadata structures is dereferenced, aborting the mongod process and causing denial of service for all connected clients. No public exploit has been identified; vendor patches are available for all three affected release lines (7.0.x, 8.0.x, 8.3.x).
Denial-of-service in Windows DNS Server allows unauthenticated network attackers to crash or hang the DNS service via a race condition in concurrent request handling. The vulnerability spans a broad range of Windows Server versions from Server 2012 through Server 2025, making it relevant across many enterprise environments. No public exploit exists and SSVC rates exploitation as none with non-automatable attack path, but successful exploitation would disrupt name resolution for all clients depending on the affected server.
Filesystem junction abuse during uninstallation of Okta Verify for Windows (versions 5.1.3 through 6.x) allows a low-privileged local user to trigger arbitrary recursive directory deletion with elevated privileges. The uninstaller fails to verify whether the user data directory is an NTFS junction point before deleting its contents as a privileged process, so a pre-positioned junction can redirect the elevated deletion to any directory reachable on the same volume. No public exploit code has been identified at the time of analysis, though this class of junction-based privilege abuse is well understood in Windows security research circles.
Field policy bypass in AshLua 0.1.0-0.2.1 allows authenticated Lua script executors to read actor-restricted fields by requesting them through aggregate operations (min, max, first, sum, avg, list) rather than as direct record fields, circumventing per-actor field policy authorization while remaining within the configured exposed-field allow-list. The Ash framework normally redacts forbidden fields on returned record structs with %Ash.ForbiddenField{}, but AshLua's read action did not apply this check when constructing ad-hoc Ash.Query.Aggregate instances, returning raw field values instead. No public exploit code exists and the vulnerability is not in CISA KEV; the CVSS 4.0 score of 6.0 reflects network-accessible but prerequisite-gated exploitation requiring authenticated script execution access.
Field policy bypass in ash_ai (versions 0.1.0 through < 1.0.3) allows authenticated, low-privilege actors to read per-actor-restricted fields - including sensitive PII - by invoking the aggregate result type (min, max, sum, avg) via the LLM read tool instead of direct record retrieval. Ash field policies redact forbidden fields on returned records by substituting %Ash.ForbiddenField{}, but this redaction mechanism was never applied to aggregate code paths; the tool's authorization check only tested field.public?, a static attribute orthogonal to per-actor policy evaluation. Patch version 1.0.3 is available via the vendor advisory; no CISA KEV listing or public exploit code has been identified at time of analysis.
SQL injection in iWebShop-5 (versions 5.0-5.15) allows authenticated high-privilege users to manipulate database queries via the Search argument of the member_list function in controllers/member.php. The CVSS 4.0 vector (PR:H) confirms that administrative credentials are required, constraining the realistic attacker pool but not eliminating risk in multi-tenant or compromised-admin scenarios. A public exploit has been disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure.
Stored cross-site scripting in ShowDoc 3.9.0 and 3.9.1 allows an authenticated low-privileged user to inject malicious JavaScript via a crafted Mermaid diagram block saved through the API Page Save Endpoint, which then executes in the browser of any user who views the poisoned documentation page. The root cause is the Mermaid rendering library operating in its permissive default mode - with `htmlLabels` enabled and `securityLevel` not set to `strict` - combined with the absence of DOMPurify sanitization on rendered SVG output. A public proof-of-concept exploit is available; vendor-confirmed patch v3.9.2 resolves the issue.
Server-side request forgery in n8n's Instance AI credential setup flow enables network-accessible attackers to cause the n8n server to issue authenticated requests, redirects, or internal probes to arbitrary unintended origins. The root cause is that the extractServiceOrigin function in credential-utils.ts accepts a credential verification URL from user-influenced input without validating it against the workflow node's expected origin, so attacker-controlled fetched content can further redirect where those requests land. Versions prior to 2.37.7 and the 2.38.0-2.38.1 branch are affected; vendor-released patches exist at 2.37.7 and 2.38.2.
Incorrect OAuth refresh token resource binding in n8n prior to 2.37.7 and 2.38.1 allows an attacker controlling a registered OAuth client to obtain valid access tokens for workflows they were never authorized to access. The first access token issued after user consent was correctly bound to the consented workflow resource, but the accompanying refresh token was not - at refresh time n8n only checked that the requested resource was a registered workflow, not that it matched the original consent grant. No public exploit code or CISA KEV listing has been identified at time of analysis; fixes are confirmed in released versions 2.37.7 and 2.38.1.
Credential exfiltration in n8n's Log Streaming subsystem allows an authenticated user holding a custom global role with Log Streaming scopes to decrypt and exfiltrate credentials belonging to any other project. The authorization check in destination-credentials-access.ts performs a credential:read scope check but omits an ownership or project-membership check, so any credential ID can be referenced regardless of which project owns it. No public exploit has been identified at time of analysis, but the impact is high-confidentiality for any secret stored in the platform because the decrypted value is sent directly to an attacker-controlled HTTP endpoint.
Arbitrary file write in Okta Access Gateway (all versions before 2026.9.1) allows a highly privileged authenticated attacker to direct the Kerberos configuration handler to write files to arbitrary locations on the appliance filesystem by supplying a path traversal string in an event payload. The root cause is CWE-73 (External Control of File Name or Path): the handler uses the payload-supplied path directly as the write destination without sanitization or canonicalization. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Insufficient access control on an exposed IOCTL interface in ASUS Armoury Crate allows a low-privileged local user to bypass driver-level authentication and directly manipulate PCIe configuration space, enabling both hardware configuration disclosure and hardware disablement. The vulnerability stems from the kernel driver accepting IOCTL requests without validating caller privilege against the required access level, granting unprivileged processes read and write access to raw PCIe registers. No public exploit code has been identified at time of analysis, and no KEV listing exists, though the local nature of the attack limits the attack surface to already-compromised or multi-user systems.
Arbitrary PCI/PCIe configuration space read and write access through the ASUS Armoury Crate kernel driver exposes a local low-privileged user to hardware-level integrity and availability risks by bypassing the driver's IOCTL verification logic. All tracked versions of Armoury Crate are affected (CPE wildcard), meaning any Windows-based ASUS gaming system with the software installed is in scope. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 5.9 reflects the constrained local/high-complexity exploitation model.
Denial of service against Active Directory Federation Services (AD FS) on multiple Windows Server and Windows 10 builds is achievable by unauthenticated remote attackers via unthrottled resource allocation (CWE-770). High attack complexity (AC:H) limits trivial or automated exploitation, and SSVC assessment confirms no active exploitation and non-automatable attack patterns. Only availability is impacted; confidentiality and integrity are unaffected. Vendor patch is available through Microsoft MSRC; no public exploits have been identified.
Server-side request forgery in Snipe-IT before 8.7.0 allows a super-admin to bypass the ExternalUrl webhook SSRF guard by supplying IPv6 transition addresses (NAT64, 6to4, or Teredo) that encode private IPv4 targets. The validation logic only checks IPv4 address representations, so transition-encoded addresses such as 64:ff9b::169.254.169.254 pass unchallenged, enabling the server to reach internal services or cloud metadata endpoints like the AWS IMDSv1 API. No public exploit or CISA KEV listing exists at time of analysis; the vendor-released fix is version 8.7.0.
Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Out-of-bounds read in the Windows NTFS filesystem driver allows a low-privilege authenticated attacker to disclose sensitive memory contents over a network. Affected across a broad swath of Windows 10, Windows 11, and Windows Server releases from 2019 through 2025, this vulnerability requires victim user interaction (UI:R) to trigger, likely via a specially crafted NTFS volume or file accessed over a network path such as an SMB share. Impact is limited to confidentiality (C:H, I:N, A:N); no public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Out-of-bounds read in the Windows SMB Client component exposes sensitive in-memory data to network-accessible, low-privilege attackers across a broad range of Windows releases from Server 2012 through Server 2025 and Windows 10/11 in multiple feature versions. An authorized attacker who induces a victim's SMB client to parse a malformed server response triggers a CWE-125 out-of-bounds memory read, potentially leaking high-value in-process data including credentials or tokens. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected versions.
Sensitive information disclosure in Windows Print Spooler Components allows a low-privileged authenticated attacker to retrieve confidential data over the network by triggering error conditions that expose sensitive details in error messages (CWE-209). The vulnerability spans a broad range of Microsoft Windows desktop and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified; Microsoft has released patches addressing all affected build lines.
Untrusted pointer dereference in Windows Print Spooler Components (CWE-822) enables a low-privileged, network-adjacent authenticated attacker to crash the Print Spooler service, causing a denial of service on all affected Windows versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R/A:H) confirms the impact is purely availability - no confidentiality or integrity impact occurs. No public exploit has been identified at time of analysis, and Microsoft has released patches addressing all listed affected builds.
Windows Search Component on multiple Windows 11 and Windows Server builds writes sensitive information to externally-accessible file or directory locations (CWE-538), enabling an authenticated network attacker - with victim interaction - to read that exposed data. The flaw affects a wide swath of actively-supported Windows releases including Server 2022 and 2025, all patched by Microsoft in the current update cycle. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, consistent with its moderate 5.7 CVSS score.
Windows Management Instrumentation (WMI) across a wide range of Windows 10, 11, and Server editions returns uninitialized memory to authenticated remote callers (CWE-908), potentially exposing sensitive heap or stack contents from prior operations. The CVSS 3.1 vector (PR:L/UI:R) confirms exploitation requires a valid low-privileged Windows account plus some form of user interaction, which substantially limits automated or unauthenticated abuse. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Out-of-bounds read in the Windows Program Compatibility Assistant (PCA) Service exposes high-confidence memory contents to authenticated network attackers across a broad swath of Windows 10, 11, and Windows Server releases. The flaw (CWE-125) allows a low-privileged user who triggers the right interaction to cause the service to read beyond a buffer boundary, leaking memory over the network with no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and Microsoft has released patches for all affected versions.
Origin validation error (CWE-346) in Microsoft Teams for Android enables an authenticated network attacker with user interaction to disclose sensitive cross-origin information. Affecting all versions prior to 1416/1.0.0.2026142702, the flaw allows a malicious origin to extract data that the Teams application fails to properly restrict, resulting in a scope-changed confidentiality breach rated C:H by Microsoft. No public exploit has been identified at time of analysis, and a vendor patch is available.
Out-of-bounds read (CWE-125) in the Windows Network File System kernel component allows a low-privileged, authenticated network attacker with some form of user interaction to crash the NFS service, resulting in denial of service. Affected platforms span a wide range of Windows Server versions from Server 2012 through Server 2025, as well as Windows 10 (versions 1607 and 1809). Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.
Out-of-bounds read in Windows DHCP Server enables an adjacent-network attacker with low privileges to crash the DHCP service, denying network address configuration to clients on the affected subnet. The flaw spans Windows Server 2012 through 2025, plus select Windows 10 builds, and carries a CVSS 5.7 Medium rating reflecting its adjacency constraint and authentication requirement. Microsoft has issued patches; no public exploit code or active exploitation via CISA KEV has been identified.
Out-of-bounds read (CWE-125) in the Windows DHCP Server service allows an authorized adjacent-network attacker to crash the DHCP service, causing a denial of service that disrupts IP address assignment for all clients depending on that server. The vulnerability affects a broad swath of Windows Server releases from 2012 through 2025 with the DHCP Server role installed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches addressing all affected build lines.
Local privilege escalation in ASUS Armoury Crate allows a low-privileged local user to bypass the software's driver authentication and directly access model-specific registers (MSRs) or other hardware control interfaces, enabling unauthorized modification of hardware configuration settings such as voltage, power limits, and thermal thresholds. This is classified under CWE-1256, which covers software that fails to properly restrict userland access to hardware-level features exposed through drivers. In a worst case, exploitation could result in irreversible hardware damage by pushing components beyond manufacturer-safe operating parameters. No public exploit code or active exploitation has been identified at time of analysis.
Arbitrary memory freeing in the ASUS Armoury Crate kernel driver allows a local low-privileged user to trigger system crashes (BSOD) and corrupt kernel data structures. The driver's IOCTL handling fails to validate pointer references before releasing memory, and an attacker can bypass this verification to free arbitrary kernel memory via a crafted IOCTL request. No public exploit or KEV listing exists at time of analysis; the CVSS 4.0 score of 5.8 reflects the local, high-complexity attack surface.