NoSQL injection in the MongoDB integration for Laravel PHP allows a remote unauthenticated attacker to subvert equality filter operations across three specific API code paths. When user-controlled input delivers an operator-shaped array to the `where` (equality), `find`, or `delete` methods, MongoDB interprets the array as a query condition rather than a literal value - enabling unauthorized document reads and out-of-scope document deletion. No confirmed active exploitation or public exploit code exists at time of analysis, but the integrity and availability impacts (VI:H, VA:H in CVSS 4.0) are severe given that bulk or arbitrary document deletion may be irreversible.
Authorization bypass in HashiCorp Consul's catalog node-write path allows any authenticated principal holding a node-write token-scoped to any node name whatsoever-to delete a different node's catalog registration and seize that node's identity within the service mesh. All Consul open-source and Enterprise versions prior to the fixed releases are affected, making shared or multi-tenant Consul clusters with delegated node-write tokens particularly exposed. No public exploit code or active exploitation has been identified at time of analysis, but the low access complexity and the typically discoverable nature of node IDs make this a credible lateral-movement and disruption vector in production service-mesh deployments.
Incomplete log sanitization in Renovate before 44.14.4 causes Mutual TLS private keys to be written in cleartext to application logs, exposing mTLS credentials to anyone with log read access. When hostRules[].httpsPrivateKey is configured directly (rather than via the documented secrets mechanism), the value is redacted in the field context but leaks verbatim wherever it appears elsewhere in log output - including interpolated log messages and aliased configuration keys. Recovery of the private key enables an attacker to impersonate the Renovate client in mTLS handshakes against downstream protected services. No public exploit has been identified at time of analysis.
Flextype CMS REST API routes through version 1.0.0-alpha.3 transmit API authentication token pairs as URL query string parameters, causing them to be persistently recorded in web server access logs, proxy logs, CDN logs, and monitoring systems. Any party with read access to those log stores - including system administrators, shared-hosting neighbors, compromised monitoring infrastructure, or log-aggregation services - can extract valid tokens and use them for full API access. No public exploit identified at time of analysis, but exploitation requires only standard log-reading tools and the vulnerability is trivially exploitable once log access is obtained.
Unauthenticated configuration tampering in OpenNMS Horizon allows any attacker with network reach to the web interface to disable event definitions and SNMP data collection by sending HTTP PATCH requests to unprotected /api/v2 REST API endpoints. The Spring Security authorization policy in applicationContext-spring-security.xml defined intercept-url rules for GET, POST, PUT, and DELETE but omitted PATCH entirely, leaving /api/v2/eventconf/**, /api/v2/datacollectionconf/**, /api/v2/snmp-config/**, and /api/v2/trapd/** open to unauthenticated writes. Changes are persisted and reloaded into the running system, silently suppressing alarm generation and stopping metric collection - an attacker can blind the monitoring platform before conducting further operations.
Use-after-free in the reactive client-side encryption component of the MongoDB Java Driver allows a party that can cancel an in-flight encrypted operation to crash the hosting application process. The flaw surfaces only when the reactive encryption stack is active and KMS credentials are fetched on demand - a specific non-default configuration - making the affected population a subset of all Java Driver deployments. No public exploit code or active exploitation has been identified at time of analysis; impact is confined to availability (process termination), with no confidentiality or integrity consequence.
An authenticated user of IBM DataStage on Cloud Pak for Data 5.4.0.0 can abuse path traversal (CWE-22) in file path handling to write to or delete arbitrary files on the platform's shared storage, compromising data integrity and availability for other jobs and tenants using that storage. The flaw is remotely reachable with a valid low-privileged account (CVSS 8.1, AV:N/PR:L, C:N/I:H/A:H) and a vendor patch is available from IBM; there is no CISA KEV listing and no confirmed public exploit, and EPSS is a modest 0.50% (41st percentile), indicating opportunistic rather than widespread exploitation pressure.
Persistent API key access in IBM Langflow OSS 1.0.0-1.11.5 allows authenticated remote attackers to continue executing AI workflows and extracting sensitive data even after their user accounts have been deactivated. The vulnerability stems from insufficient session expiration (CWE-613): API keys issued to users are not invalidated when those accounts are disabled, leaving a persistent backdoor for former users or compromised credentials. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS reflects High confidentiality and High integrity impact, driven by the ability to both execute flows and access sensitive pipeline data.
Denial of service in IBM Db2 11.5.0-11.5.9 and 12.1.0-12.1.5 allows a low-privileged authenticated network user to disable specific server functionality under certain conditions, producing both availability and integrity impact. The root cause is CWE-269 (Improper Privilege Management): the server fails to enforce correct privilege boundaries around a particular Db2 operation, allowing a user whose authorization should not extend to that action to invoke it. No public exploit has been identified at time of analysis; IBM has released a patch and the vendor advisory is the sole remediation reference.
Improper privilege management in IBM WebSphere Application Server 8.5 and 9.0 lets an authenticated user who holds a low-privilege administrative role modify security configuration, resulting in information disclosure or denial of service. The flaw is remotely reachable with low complexity (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N) but requires valid administrative credentials, so it is an insider/privileged-abuse issue rather than an unauthenticated attack path. EPSS is only 0.19% (9th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis; IBM has published a fix.
Cross-tenant secret disclosure in Apache Camel K's custom resource resolution allows an authenticated tenant to reference secrets by name in the shared operator namespace, bypassing authorization boundaries that should isolate tenants from each other. Versions from 2.0.0 before 2.9.3 and from 2.10.1 before 2.10.2 are affected in multi-tenant deployments. No public exploit or active exploitation has been identified; Apache has released fixes in versions 2.9.3, 2.10.2, and 2.11.0.
Unauthenticated privilege escalation in the SiteSkite WordPress plugin (versions ≤ 2.1.5) allows a remote attacker to gain elevated privileges within a WordPress installation without any authentication. The vulnerability is classified under CWE-266 (Incorrect Privilege Assignment), meaning the plugin incorrectly grants elevated roles or capabilities during some reachable code path. With full C:H/I:H/A:H impact and PR:N, successful exploitation results in complete compromise of the affected WordPress site, though AC:H signals a non-trivial exploitation condition such as a race condition, specific request sequence, or timing-dependent logic.
Missing authorization in the WP-Stateless WordPress plugin (versions up to and including 4.4.1) allows authenticated subscriber-level users to modify plugin settings they should have no access to. WP-Stateless manages Google Cloud Storage offloading for WordPress media; unauthorized settings changes by a low-privileged user can corrupt the GCS integration, break media delivery, or reconfigure the storage bucket in ways that degrade site availability. No public exploit code has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.
Unauthenticated PHP Object Injection in Wise Chat WordPress plugin versions up to and including 3.4 allows a remote attacker to achieve high-impact compromise of confidentiality, integrity, and availability by passing crafted serialized data to an unprotected deserialization point. Exploitation requires a viable POP gadget chain within the target WordPress environment, keeping the practical bar elevated despite requiring no credentials. No KEV listing or public POC has been identified at time of analysis.
Privilege escalation in the Bulk Password Reset WordPress plugin (all versions ≤1.3.3) allows any authenticated subscriber-level user to perform a full administrative account takeover. The plugin fails to validate the requesting user's identity before permitting bulk password changes and email-address updates, meaning an attacker can redirect an administrator's email to an attacker-controlled address, then invoke the standard WordPress password-reset flow to obtain reset credentials for that admin account. No public exploit code has been identified at time of analysis, but source code references from WordPress Plugin Trac directly expose the vulnerable functions at lines 44, 594, 659, and 679 of bulk_password_reset.php.
Heap-based buffer overflow in Bosch Sensortec COINES_SDK versions 2.10 through 2.12.2 allows a malicious or compromised USB or BLE peripheral to corrupt host heap memory, leading to process crash or potential arbitrary code execution on the developer's machine. The root cause is that the PC bridge protocol decoder in bridge_decoder.c unconditionally trusts the packet length field supplied by the connected peripheral, passing it directly to mqueue_add_data without validating it against the fixed 255-byte queue slot - enabling a payload of up to ~3 KB to overwrite adjacent heap metadata via memcpy. No public exploit or CISA KEV listing has been identified at time of analysis; exploitation is constrained by the requirement for physical or BLE proximity and user-initiated device pairing.
XML External Entity (XXE) injection in IBM webMethods Integration Server 11.1 allows an attacker with low-privileged access to submit malicious XML payloads that coerce the server's XML parser into disclosing sensitive filesystem contents or exhausting memory resources through recursive entity expansion. The vulnerability is confirmed by IBM with a patch available via advisory node/7286620. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Opening a crafted legacy Excel (.xls) file in libxls 1.6.3, or in any application that embeds it, can corrupt the heap and potentially execute arbitrary code because xls_getCSS() trusts a file-controlled font index without validating it against the workbook's font count. The same code path also permits use-after-free/out-of-bounds access to the font array while generating CSS from XF formatting records. Exploitation requires a victim to open a malicious file (CVSS AV:L/UI:R); no public exploit code has been confirmed and CISA KEV does not list this CVE, with EPSS very low at 0.15% (5th percentile), indicating limited real-world targeting at time of analysis.
Heap corruption in Tesseract OCR 5.5.3 and earlier allows an attacker who can supply a malicious unicharset file to corrupt application heap memory during OCR engine initialization, potentially leading to a crash or controlled code execution. The root cause is that UNICHARSET::load_via_fgets treats the declared character count as a trusted loop bound and uses the incrementing id variable as a direct unichars vector index, while unichar_insert_backwards_compatible silently performs no-op insertions for duplicate or empty representations - causing id to exceed unichars.size() and subsequent set_* writes to access memory beyond the vector. No patched release is available as of this review; only an upstream source commit fix exists.
Container escape in crun >= 1.29, when built with libkrun and started rootful with passt networking (krun.use_passt), allows an attacker who controls the container image to execute arbitrary code with host root privileges. This is a regression introduced in crun 1.29, meaning environments that recently upgraded are at risk while those on earlier versions are not. No public exploit code or CISA KEV listing has been identified at time of analysis, but successful exploitation yields full host compromise via container escape.
Cross-tenant log file exposure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows authenticated low-privilege tenant users to read any other tenant's job.log or error.log files from the shared /ds-storage ReadWriteMany PVC by supplying three manipulated path strings to a log-retrieval endpoint, with no project-level ACL enforcement. The read surface, though nominally constrained to files named job.log or error.log, is high-value in DataStage deployments: these logs routinely contain JDBC/ODBC connection strings, {dsnextenc}-format credential ciphertexts decryptable via the DataStage d2-f023 key, and sample customer data rows. Vendor patch is available; no public exploit is identified at time of analysis.
Template injection in Velociraptor's notebook backup restoration pipeline allows a low-privileged NOTEBOOK_EDITOR user to execute arbitrary VQL queries at elevated server-level permissions. The daily backup feature - enabled by default - captures notebook cell content verbatim; when an administrator later restores the backup, that content is interpolated into a Go template without ACL enforcement, breaking the privilege boundary between analyst and server roles. No public exploit has been identified at time of analysis, but the chained attack path (plant payload, wait for restore) represents a credible insider or compromised-analyst escalation vector against DFIR infrastructure.
Uncontrolled memory growth in Suricata's IKEv2 application-layer parser allows remote unauthenticated attackers to exhaust system memory by sending repeated crafted UDP packets, potentially disabling the IDS/IPS/NSM engine entirely. All Suricata releases prior to 7.0.16 and 8.0.5 are affected; the parser accumulates client transform state without any upper bound, making it trivially exploitable from the network. No public exploit code has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a credible denial-of-service risk in any deployment where IKE parsing is active.
Vault secret values leak into error messages, log output, and Nomad task events in HashiCorp consul-template due to improper error handling. The vulnerability affects consul-template deployments integrated with HashiCorp Vault, where a template rendering error can inadvertently expose secret values to any downstream surface that receives error text - including Nomad task event logs readable by lower-privileged operators. The scope-changed CVSS vector (S:C) reflects that the primary harm falls on systems outside consul-template itself: Vault secrets meant to be accessed only by privileged services instead persist in Nomad task events and logging infrastructure accessible to broader audiences.
Unchecked memcpy in the Bosch Sensortec BHI360 SensorAPI C-Library's debug FIFO parser allows a physically-positioned attacker to overflow a 17-byte stack buffer in `bhi360_parse_debug_message()`, corrupting the host microcontroller's saved return address and enabling arbitrary code execution. A compounding format-string flaw - the overflowed buffer is subsequently passed to a printf-style logging sink - provides an additional write-anywhere primitive for `%n`-style exploitation. No public exploit code has been identified and exploitation is constrained to physical or bus-adjacent positions (CVSS AV:P), but the double-primitive nature makes this highly reliable on bare-metal targets lacking stack canaries.
Path traversal in AcyMailing WordPress plugin (all versions through 11.0.4) exposes arbitrary server files to unauthenticated remote attackers via the unsanitized `user[name]` parameter. Exploitation is gated on the 'Embed images' configuration option being enabled, but when active, an attacker can read sensitive server-side files including WordPress configuration, credentials, and other data without any authentication. Wordfence reported this flaw and a patch commit is available in the WordPress plugin repository. No public exploit or active exploitation has been identified at time of analysis.
Unauthenticated arbitrary file read in the Direct Download for WooCommerce WordPress plugin (all versions ≤1.19) allows any remote attacker to retrieve the contents of any file accessible to the web server process — including wp-config.php, database credentials, and server-side secrets. The root flaw is a fatally incomplete authorization check in the plugin's top-level include handler (direct-download.php): it confirms only that some free, virtual, downloadable product exists anywhere on the site, without validating that the requested file path is one of that product's configured download assets. No public exploit has been identified at time of analysis, but the exploitation logic is straightforward and the prerequisite is met by the majority of WooCommerce stores offering free resources.
Denial of service in Suricata IDS/IPS/NSM engine (versions prior to 7.0.16 and 8.0.5) allows an unauthenticated remote attacker to exhaust CPU resources by sending HTTP responses containing crafted oversized `Content-Disposition` headers, causing the inspection engine to perform repeated expensive parsing iterations without bounds. The attack requires no privileges and exploits the security tooling itself - disabling Suricata's inspection capability - which can serve as a precursor to attacks that would otherwise be detected. No public exploit code and no CISA KEV listing have been identified, but the OISF has released patched versions and a rule-based workaround.
Stack-based buffer overflow in the IBM Db2 DRDA client allows full system compromise on any host running an affected Db2 client version when that client connects to an attacker-controlled or impersonated DRDA server endpoint. Affected versions are Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5. By controlling a rogue or man-in-the-middle DRDA server, an unauthenticated network adversary can cause the client to copy unbounded server-supplied data into a fixed-size stack buffer, yielding arbitrary command execution. No public exploit is identified at time of analysis; vendor patch is available via IBM Support.
Uncontrolled memory growth in Suricata's LDAP application-layer parser allows unauthenticated remote attackers to exhaust host memory by sending crafted LDAP traffic over UDP, resulting in denial of service. Affected versions are 8.0.0 through 8.0.4; the flaw does not extend to the 7.x release line based on the stated version range. The practical consequence is that a successful attack disables Suricata's IDS/IPS inspection capability, creating a monitoring blind spot on the protected network segment. No public exploit code or active exploitation has been identified; a vendor-released patch (8.0.5) is available.
Remote unauthenticated denial of service in Suricata's IP defragmentation engine allows an attacker to crash the sensor by sending crafted mixed IPv4/IPv6 fragmented traffic. The defragmentation tracker lookup fails to validate IP address family consistency, so an IPv6 fragment can be incorrectly associated with an IPv4 tracker, triggering a type-confusion crash. All Suricata deployments running versions prior to 7.0.16 (stable) or 8.0.5 (latest) are affected; no public exploit has been identified at time of analysis.
Memory exhaustion in Suricata's NFS application-layer parser allows remote unauthenticated attackers to crash or severely degrade the IDS/IPS/NSM engine by sending crafted NFS traffic. Affected versions span all releases prior to 7.0.16 and 8.0.5, covering both the stable and current release branches maintained by OISF. No active exploitation has been confirmed, but the zero-prerequisite network attack path and the security-critical role of Suricata in detection pipelines make this operationally significant.
Uncontrolled memory consumption in Suricata's DNP3 reassembly engine allows a remote unauthenticated attacker to exhaust host memory by sending crafted DNP3 traffic, causing denial of service. Versions prior to 7.0.16 and 8.0.5 fail to enforce sufficient parser-level bounds during DNP3 stream reassembly, meaning unbounded buffering is possible. The attack surface is significantly constrained because DNP3 parsing is not enabled by default, limiting realistic exposure to Suricata deployments actively monitoring OT/ICS network segments. No public exploit identified at time of analysis.
Lua sandbox bypass in Suricata 8.0.0-8.0.4 allows a crafted Lua detection rule that registers an excessive number of flow variables to corrupt Suricata's internal Lua detection state and escape the restricted Lua execution sandbox. Deployments with `security.lua.allow-rules` enabled face both integrity loss - attacker-controlled Lua rules can subvert detection logic - and availability risk, as the same corruption pathway can crash the Suricata process entirely. No public exploit has been identified at time of analysis; vendor-released patch version 8.0.5 is available.
Stack-based buffer overflow in GeoVision GV-LPC2011/LPC2211 firmware V1.14 (260903) exposes the VLSVR service to unauthenticated remote denial-of-service attacks. Multiple VLSVR request handlers fail to validate variable-length input fields before copying them into fixed-size stack buffers, allowing a network-reachable attacker with no credentials to crash the service. No public exploit code or active exploitation has been identified at time of analysis, though the zero-authentication, low-complexity network attack surface warrants prompt attention for cameras deployed outside isolated VLANs.
Stack buffer overflow in GeoVision GV-LPC2211/LPC2011 V1.13 allows a remote unauthenticated attacker to crash the ONVIF WS-Discovery process by sending a crafted Probe request with an unbounded number of Scopes tokens. The device fails to enforce any limit on Scopes token count, leading to stack control-state corruption and a denial of service against the device discovery service. No public exploit code has been identified at time of analysis, but the low-complexity, unauthenticated network vector makes this straightforward to weaponize for disruption of IP camera discovery.
Pre-authentication information disclosure in Apache ActiveMQ Artemis and Apache Artemis exposes cluster topology details to any unauthenticated remote attacker. The CORE protocol's SUBSCRIBE_TOPOLOGY request can be submitted before the broker enforces authentication, leaking cluster node configuration including internal broker addresses and cluster membership data. No public exploit code has been identified and it is not listed in CISA KEV, but the zero-prerequisite network vector makes automated scanning trivially feasible at scale.
Remote, unauthenticated resource exhaustion in GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.14 (build 20260903) allows an attacker to disable the device by abusing the VLSVR streaming protocol. By declaring arbitrarily large frame lengths and then stalling the blocking receive indefinitely, an attacker can lock up memory buffers, exhaust connection slots, and starve worker threads until the license plate recognition service becomes entirely unresponsive. No active exploitation or public proof-of-concept has been identified at time of analysis.
PTZ connection starvation in GeoVision GV-LPC2011/GV-LPC2211 firmware V1.13 allows an unauthenticated remote attacker to monopolize the device's PTZ accept loop by establishing and retaining a session without releasing connection state, permanently blocking all subsequent PTZ control connections until the device is rebooted. The root cause is improper connection lifecycle management (CWE-400: Uncontrolled Resource Consumption) - the firmware imposes no idle timeout, connection limit, or non-blocking safeguard on the PTZ listener. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; the CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects trivially automatable, unauthenticated network exploitability.
Broken access control in the VillaTheme Thank You Page Customizer for WooCommerce plugin (all versions through 1.2.2) exposes WooCommerce order data to unauthenticated remote attackers. The missing authorization check (CWE-862) on one or more plugin endpoints allows any network-reachable party to retrieve order-associated confidential data without credentials, consistent with the CVSS C:H/PR:N/UI:N vector reported by Patchstack. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.11.5 allows unauthenticated remote attackers to coerce the server into issuing arbitrary outbound HTTP requests, exposing internal network services, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and other resources inaccessible to the attacker directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H) confirms this requires no authentication and trivial network access, with high confidentiality impact. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated remote attackers can create arbitrary durable queues on Apache Artemis and Apache ActiveMQ Artemis brokers via the native CORE protocol due to missing authentication enforcement in the protocol handler. The vulnerability spans the entire Apache ActiveMQ Artemis release history (1.0.0 through 2.44.0) and the recently rebranded Apache Artemis fork (2.50.0 through 2.56.0), making the unpatched population potentially very large. Exploitation enables persistent unauthorized broker state manipulation and denial-of-service through storage and memory exhaustion, with no credentials or user interaction required; no public exploit code has been identified at time of analysis.
Denial of service in the Robotics-STAR-Lab (SYSU STAR Group) RACER autonomous exploration framework allows an unauthenticated remote attacker who can reach the exploration stack to disrupt its exploration state machine, halting or crashing mission execution on an affected robot. The flaw is an improper check or handling of exceptional conditions (CWE-703) that is remotely reachable with low complexity and no privileges or user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only high impact). No public exploit code was identified in the supplied metadata and exploitation likelihood is very low (EPSS 0.17%, 6th percentile), consistent with RACER being a niche academic robotics project rather than widely deployed production software.
Denial of service in ZJU-FAST-Lab EGO-Planner-v2 (all versions through commit 5c99a958) lets an attacker stall or crash the planner by driving the EGOReplanFSM component into uncontrolled resource consumption (CWE-400). The vulnerable component is the finite state machine that orchestrates local trajectory replanning for autonomous quadrotors, so a successful attack removes fresh trajectory generation from the flight stack. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only), EPSS 0.17% (6th percentile) and no CISA KEV listing; no public exploit code is confirmed in the supplied metadata, although the report references a public GitHub issue and a gist that may contain reproduction detail.
Denial-of-service in EGO-Planner-v2, ZJU-FAST-Lab's open-source drone trajectory replanning framework, allows unauthenticated remote attackers to crash the planning process by triggering uncontrolled resource consumption in three FSM callback functions. All repository commits up to 5c99a95880401e2599638d567abc0e240396cb42 are affected, with no vendor-released patch identified at time of analysis. A public gist documenting the issue exists, though no confirmed active exploitation has been observed, and EPSS is extremely low at 0.17%.
Out-of-bounds read in libxls 1.6.3 allows a remote, unauthenticated attacker to leak heap memory contents by supplying a maliciously crafted XLS file with manipulated OLE Property Set Stream offsets. The vulnerability resides in xls_dumpSummary(), which dereferences file-controlled section and property offsets against a 4096-byte OLE summary buffer without first validating that those offsets remain within buffer bounds. Any server-side or automated pipeline that parses untrusted XLS files via libxls is exposed; no public exploit code has been identified and EPSS stands at 0.15%, indicating low current exploitation activity.
Memory exhaustion in rclone 1.75.0's serve S3 multipart upload handler allows remote attackers to exhaust process or host memory and permanently block request handlers by sending UploadPart requests that declare a large Content-Length but deliver no body bytes. The handler in cmd/serve/s3/multipart.go pre-allocates lib/pool pages sized to the attacker-controlled Content-Length header before any body bytes arrive, and the waitForTurn scheduling mechanism admits one additional oversized part even when --multipart-streaming-buffer-limit is active, partially bypassing the intended cap. The issue is fixed in rclone v1.75.1; no public exploit or CISA KEV listing has been identified.
Broken access control in the WP Fast Total Search WordPress plugin (versions ≤ 1.82.284) exposes restricted data to unauthenticated remote attackers via missing authorization checks (CWE-862). The Epsiloncool plugin fails to verify requester permissions on one or more endpoints, allowing network-accessible exploitation with no credentials or user interaction - reflected in a CVSS 7.5 High score with C:H/I:N/A:N impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make automated discovery straightforward.
Unauthenticated sensitive data exposure in the ZHBackup - Backup, Restore & Migration WordPress plugin (versions <= 2.4.2) permits remote attackers to access protected backup archives without any credentials or user interaction. Classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), the flaw likely exposes backup archives containing database dumps, WordPress configuration data, password hashes, and secret keys - artifacts that enable full site takeover if retrieved. No public exploit code has been identified at time of analysis, and the CVE has not been added to the CISA KEV catalog.
Remote code execution in the RepairBuddy WordPress plugin (versions <= 4.1224) is reachable by authenticated users holding only subscriber-level privileges - the lowest WordPress role - via a code injection flaw (CWE-94). A subscriber can send a crafted network request to trigger server-side code execution, achieving full confidentiality, integrity, and availability compromise of the WordPress host. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has disclosed the vulnerability with a dedicated advisory.