Server-side request forgery in EspoCRM before 10.0.4 allows authenticated users to route outbound HTTP requests to internal network services by exploiting an incomplete IPv6 blocklist in the host-validation layer. The HostCheck::ipAddressIsNotInternal() function strips ::ffff: IPv4-mapped prefixes but ignores three IPv6 transition address families - NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001:0000::/32) - enabling an attacker who controls a domain with crafted AAAA records to also defeat the CURLOPT_RESOLVE IP-pinning guard and reach private infrastructure. A publicly available exploit has been confirmed by VulnCheck; no CISA KEV listing has been observed at time of analysis.
Missing capability checks in the Notiqoo WordPress plugin (before 1.4.14) expose multiple AJAX endpoints to any authenticated contributor-level user, allowing arbitrary WordPress option writes. Because the option name is constructed directly from user-supplied input with no validation or authorization gate, a contributor can overwrite any site option - including disabling the Notiqoo plugin itself or corrupting the admin email/user-role mappings to lock every administrator out of the WordPress dashboard. A publicly available proof-of-concept exploit exists per WPScan, and the SSVC framework classifies technical impact as partial with no confirmed active exploitation at time of analysis.
Heap use-after-free in DaveGamble cJSON's cJSONUtils_MergePatch function (cJSON_Utils.c) affects all versions through 1.7.19 when the patch argument is a subtree of the target object. The function deletes the target before duplicating the patch, freeing the patch memory and causing a subsequent read of freed heap - confirmed by an AddressSanitizer-triggering test case in upstream fix PR #1065. A public exploit exists (GitHub issue #1060) and can lead to crash, potential memory disclosure, or memory corruption in any application that passes attacker-influenced JSON through this specific merge-patch call pattern.
HTTP/3 read timeout non-enforcement in Traefik allows unauthenticated remote attackers to exhaust upstream backend connection pools by trickling request body data indefinitely over QUIC streams. Versions 2.8.2 through 2.11.55 and 3.x through 3.7.11 fail to apply the configured `readTimeout` to HTTP/3 entrypoints because that timeout is enforced at the TCP connection layer and QUIC streams have no corresponding deadline. Attackers with access to an exposed HTTP/3 endpoint can hold upstream connections open without triggering any server-side timeout, progressively exhausting backends with bounded connection pools. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
Path traversal in rclone prior to 1.75.1 allows an attacker who can populate a source object store with raw `..` key segments to cause rclone to write files outside the configured destination root when a victim performs a copy or sync operation. Thirteen destination backends - including b2, swift, sftp, smb, webdav, ftp, storj, and others - are affected because they apply path.Join(root, remote) on unvalidated object keys before EncodeDot can neutralize parent-directory segments; sftp and smb destinations carry the highest impact since they can reach other filesystem paths or shares accessible under the victim's credential. No public exploit code has been identified and the issue is fixed in v1.75.1.
ForwardAuth identity spoofing in Traefik allows authenticated network users to impersonate arbitrary identities on normalization-prone backends by sending dot-form HTTP headers (e.g., X.Authenticated.User) that Go's net/http layer treats as distinct from their dash-form equivalents (X-Authenticated-User), while CGI, WSGI, PHP, and NGINX backends collapse both into the same environment variable. Affected deployments span the 2.x branch below v2.11.56 and the 3.x branch from 3.0.0 through 3.7.12; the protective aliasHeadersStrategy option defaults to keep, meaning all unpatched deployments with ForwardAuth and normalization-prone backends are exposed without any additional misconfiguration. No public exploit code and no CISA KEV listing have been identified at time of analysis.
T4 Page Builder by JoomlArt (versions below 2.3.0) exposes an unauthenticated front-end AJAX contact endpoint that functions as a fully open mail relay, allowing any remote actor to send arbitrary email as the victim Joomla site's configured sender identity. The endpoint accepts attacker-controlled recipient address, subject line, and full HTML message body with no authentication, no CSRF token, no captcha when no captcha plugin is active, and no rate limiting. Abuse enables phishing campaigns and bulk spam delivered from a legitimate domain's mail infrastructure, with collateral damage including blocklisting of the site's mail domain by major email providers.
SP Property, a Joomla real estate extension by joomshaper.com, allows unauthenticated remote attackers to redirect booking inquiry emails to arbitrary destinations by manipulating client-submitted hidden form fields that control recipient routing. Versions 1.0.0 through 4.1.3 are affected; vendor-released patch version 4.1.4 addresses the flaw by moving recipient resolution server-side. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no authentication against any publicly accessible property booking form.
SP Property, a Joomla real estate listing extension by joomshaper.com, exposes gallery image management controller tasks without authorization checks or CSRF token validation in versions prior to 4.1.4. Unauthenticated remote attackers can invoke file deletion against arbitrary path strings and upload files of any type to the server. The unrestricted file upload primitive is particularly dangerous - if the upload directory is web-accessible, which is typical for Joomla component image managers, an attacker can deploy a PHP web shell and achieve full server-side code execution, making the realistic impact far more severe than the CVSS 4.0 score of 6.9 indicates.
HTTP/3 read timeout enforcement is entirely absent in Traefik v2.8.2-v2.11.55 and v3.0.0-v3.7.11, enabling any unauthenticated remote client to hold connections open indefinitely by slowly trickling request body bytes over QUIC. Because QUIC streams cannot accept the TCP-level deadline used to enforce the default 60-second readTimeout, the HTTP/3 server was constructed with no timeout at all; each stalled request occupies one upstream connection. Repeated exploitation exhausts bounded backend connection pools and causes denial of service against proxied applications. Fixed in v2.11.56 and v3.7.12; no public exploit identified at time of analysis.
XML External Entity (XXE) injection in TP-Link Omada Controller's SAML SSO metadata parsing allows an authenticated user with SAML configuration privileges to read arbitrary files from the server, resulting in high-confidentiality information disclosure. The vulnerability arises because the controller does not disable external entity resolution when parsing user-supplied SAML metadata XML, enabling server-side file exfiltration. No public exploit code or active exploitation has been identified at time of analysis, and a vendor-released patch is available.
Out-of-bounds write in Tesseract OCR engine version 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` file to crash the LSTM OCR pipeline through a wild-address bit write into a size-zero vector. The flaw lies in `RecodedCharID::DeSerialize`, which validates array length but silently accepts negative `code_` values; this causes `ComputeCodeRange` to produce a zero `code_range_`, after which `SetupDecoder` indexes `is_valid_start_` out of bounds, reliably producing a crash or heap allocation failure. No fixed release is available; an upstream fix commit exists but has not been tagged into a release.
Denial of service in Tesseract OCR Engine 5.5.3 and earlier allows a local attacker to crash any process that loads a crafted .traineddata model file. The deserialization path in Plumbing::DeSerialize fails to reject a zero-length network stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layer types; subsequent initialization in Series::CacheXScaleFactor unconditionally dereferences stack_[0] on the now-empty vector, producing a deterministic crash via an invalid virtual method call through a dangling Network pointer. No public exploit is identified at time of analysis, and no fixed release has been issued - only an upstream commit fix is available.
HTTP request smuggling in Netty 4.1.133-4.1.137.Final and 4.2.13-4.2.17.Final allows unauthenticated remote attackers to poison HTTP request queues and bypass intermediary security controls by submitting crafted Transfer-Encoding headers. The HttpObjectDecoder's final-coding validation was flawed: both split multi-line TE headers and comma-separated values like 'chunked, xchunked' bypassed the 'chunked must be last' check, causing Netty to interpret message framing differently from upstream proxies. Fixed releases 4.1.138.Final and 4.2.18.Final enforce RFC 9112-compliant validation across all TE header fields; no public exploit code or CISA KEV listing has been identified at time of analysis.
Kernel denial-of-service in Silicon Labs' silabser.sys Windows 8 driver for CP210x USB-to-UART bridge devices allows any local unprivileged user to trigger a kernel crash by supplying incorrect driver settings. The root cause is CWE-369 (Divide by Zero) inside a kernel-mode driver, meaning exploitation produces a Blue Screen of Death (BSOD) and full system reboot. No public exploit code or active exploitation has been identified at time of analysis.
Directory traversal in knowns through 0.33.0 exposes arbitrary host filesystem paths to unauthenticated remote attackers via the workspace browse endpoint's unsanitized `path` query parameter. Attackers can walk the directory tree to map project directories, configuration file locations, and other filesystem structures without any credentials or special privileges. No public exploit has been identified at time of analysis, and impact is bounded to directory enumeration - file content cannot be read through this vector alone.
Renovate's `minimumReleaseAge` supply-chain defense control is not enforced for digest-type dependency updates, allowing a newly published - potentially malicious - package digest to immediately trigger a pull request and CI pipeline execution before the configured stability waiting period elapses. All Renovate versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0 are affected when repositories combine the `minimumReleaseAge` setting with digest-pinned dependencies such as GitHub Actions commit SHAs, Docker images, Go modules, or NuGet packages. No public exploit has been identified at time of analysis, but the flaw directly undermines an intentionally configured supply-chain defense, making it high-priority for organizations that depend on this control.
Hard-coded API credentials embedded in DrEryk Gabinet's ticket reporting component allow any network-accessible attacker to authenticate directly to the ticket system API in versions before 11.5.0. Once the static credentials are known - through reverse engineering or public disclosure by CERT-PL - an attacker can perform privileged ticket operations including reading and modifying records beyond what the application's own permission model permits. No public exploit code or active exploitation has been identified at time of analysis; the fix is available in version 11.5.0.
Path traversal in JoomShaper's SP Property Joomla extension (all versions before 4.1.4) allows unauthenticated remote attackers to escape the intended gallery directory due to missing directory confinement checks in the gallery management controller tasks. The CVSS 4.0 vector (PR:N, UI:N, AV:N) confirms exploitation requires no privileges or user interaction, though impact is constrained to low-severity integrity and availability effects on both the vulnerable and subsequent systems with no confidentiality exposure. No public exploit or active exploitation has been identified at time of analysis.
Buffer overflow in Bosch Sensortec COINES SDK versions 2.0 through 2.11 allows a malicious or compromised sensor evaluation board, connected to a host machine via USB or BLE, to overflow the host application's heap or stack by streaming an excessive volume of sensor samples. The root cause is that `coines_read_stream_sensor_data()` unconditionally performs a `memcpy` of the full ring buffer content without verifying whether the caller-provided destination buffer can accommodate it, because the internal `comm_intf_process_stream_response()` silently discards the requested `number_of_samples` bound. No public exploit has been identified at time of analysis, but successful exploitation could yield arbitrary code execution on the host developer machine.
Arbitrary code execution on Dell ThinOS 10 (all versions prior to 2605_10.2616) is possible when an unauthenticated attacker gains physical access to a thin client endpoint and exploits the absence of cryptographic integrity verification during code download (CWE-494). The vulnerability allows substitution of a malicious payload during the device's update or provisioning process, resulting in full system compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; the physical access prerequisite (AV:P) substantially constrains the attacker population.
Code injection in AppFlowy 0.11.8 allows arbitrary code execution through insufficient URI and local path validation in the application's file-launch and URL-handling subsystems. The vulnerability exists in the Flutter-based desktop/mobile productivity app's afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, and localPathRegex (common_patterns.dart) components, where inadequate sanitization of URI schemes or local file paths enables an attacker to trigger execution of arbitrary code. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CWE-94 classification confirms the root cause as a code injection pattern rather than a memory-safety issue.
IBM WebSphere Application Server 9.0 and 8.5 contain a local privilege escalation flaw rooted in improper code injection controls (CWE-94) that subverts authentication enforcement, allowing a local attacker without prior privileges to gain unauthorized access to protected resources with high confidentiality and integrity impact. The attack is constrained to local access under complex conditions (CVSS AV:L/AC:H), which substantially limits its real-world reach compared to network-exploitable vulnerabilities. IBM has released a patch via advisory 7286610, and no public exploit code or active exploitation listing has been identified at time of analysis.
Dell ThinOS 10 firmware allows a low-privileged attacker with physical device access to overwrite the Security Version Number (SVN) with an older value, enabling a downgrade rollback to earlier firmware versions that lack current security protections. All releases prior to 2605_10.2616 are affected. By reverting the device to a prior vulnerable firmware state, an attacker can bypass protection mechanisms enforced in newer firmware - including security controls, hardening measures, or patched vulnerabilities - achieving full confidentiality, integrity, and availability compromise of the thin client.
Path traversal in the Youzify WordPress plugin (versions ≤ 1.3.7) allows any authenticated subscriber to download arbitrary files from the hosting server. The flaw stems from insufficient sanitization of user-supplied file path input (CWE-22), enabling directory traversal sequences to escape the intended download scope. An attacker with a low-privilege WordPress account can retrieve sensitive server files - including wp-config.php containing database credentials - with no public exploit identified at time of analysis.
Arbitrary file read in GeoVision GV-LPC2211 v1.13 allows authenticated remote users to exfiltrate any file accessible to the root-run web service by supplying unsanitized absolute path parameters to BKDownloadLink.cgi. The CGI handler fails entirely to restrict the filename input, making the vulnerability straightforward to exploit by any valid credential holder. No public exploit or active exploitation has been identified, and no patched firmware version is confirmed in available sources.
Arbitrary file read in IBM Langflow OSS 1.0.0 through 1.11.5 allows a remote authenticated attacker to access files outside their authorized scope due to improper access control (CWE-284). The CVSS vector confirms PR:L, meaning exploitation requires valid credentials but no elevated privileges, making this a post-authentication authorization flaw rather than an authentication bypass. No public exploit has been identified at time of analysis, and a vendor patch is available at IBM support node 7286657.
Full-read Server-Side Request Forgery in Transmute's URL import endpoint (versions prior to 1.3.0) allows authenticated users - or guest users if that feature is enabled - to direct the Transmute server to fetch arbitrary internal or cloud-local HTTP resources, with the fetched content stored and fully retrievable via the files API. The HTTP downloader follows redirects without validating whether target addresses resolve to private or link-local network space (e.g., cloud instance metadata services), making this a full-read SSRF rather than a blind one and elevating the practical confidentiality impact significantly. Vendor-released patch is version 1.3.0; no public exploit identified at time of analysis.
Stack buffer overflow in GeoVision GV-LPC2211 firmware V1.13 allows any authenticated, low-privilege user to remotely crash the SSVR service by sending crafted fragmented SSVR protocol data. Both the GV-LPC2011 and GV-LPC2211 models share the affected codebase per CPE data. Impact is limited to availability loss - no code execution or data disclosure has been demonstrated, and no public exploit code has been identified at time of analysis.
Cross-user file disclosure in IBM Langflow OSS 1.0.0-1.11.5 allows any authenticated low-privileged user to read files uploaded by other users by supplying arbitrary storage path identifiers in flow component inputs. The File/Read File component, when invoked via the /api/v1/run/advanced/{flow_id} endpoint, accepts user or flow storage namespace identifiers without verifying the requester owns the referenced namespace - a classic IDOR (CWE-639). No public exploit code has been identified at time of analysis, and IBM has released a patch.
Filesystem exhaustion denial of service in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated adjacent-network attacker to crash the server by sending specially crafted HTTP requests to an administrative endpoint that lacks authentication (CWE-306). Repeated triggering fills the host filesystem, disrupting all applications deployed on the instance and preventing logging or recovery operations. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; IBM has released a patch.
Open WebUI's OAuth token exchange endpoint (present in versions 0.8.0 through 0.8.x) bypasses the `OAUTH_ALLOWED_DOMAINS` email domain allowlist that the normal OAuth login callback enforces, allowing a user whose domain was removed from the allowlist to continue obtaining valid sessions via the alternate endpoint. The flaw is rooted in code duplication: the token exchange endpoint re-implemented identity lookup but omitted the authorization policy checks present in the primary callback. No public exploit is identified at time of analysis; vendor-released patch is available in 0.9.0.
SQL injection in the JasperReports reporting engine of OpenNMS Meridian and Horizon allows any authenticated ROLE_USER to execute arbitrary SQL against the OpenNMS PostgreSQL database by supplying a crafted DATE_FORMAT parameter to two default-enabled asset-management reports via the REST API. The database exposure includes SNMP community strings, provisioning credentials, and notification credentials for every monitored device - high-value intelligence enabling lateral movement across the managed network. No public exploit is identified at time of analysis, but the upstream patch diff on GitHub PR #8832 publicly names the vulnerable parameters and report IDs, substantially lowering the bar for exploit development.
Keycloak's Device Authorization Grant flow (RFC 8628) fails to enforce brute-force account lockout during token redemption, allowing an attacker holding an active device authorization session for a locked account to complete the flow and obtain valid access and refresh tokens. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 across all versions flagged in the CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the flaw silently undermines a core security control intended to stop credential-stuffing and persistent account compromise.
Guest-authenticated users on GeoVision GV-LPC2211 and GV-LPC2011 firmware V1.13 can invoke the SSVR firmware-upgrade mode without holding the authorization required for that privileged function (CWE-862), immediately dropping live camera services before any firmware image is submitted or validated. The affected devices are IP-based license plate recognition cameras used in physical security, traffic monitoring, and municipal surveillance deployments. No public exploit code has been identified at time of analysis, but the network-accessible attack vector with only low-privilege credentials required makes the disruption trivially easy for any user holding a Guest account.
Broken access control in the Salon Booking System WordPress plugin (≤10.31.5) allows unauthenticated remote attackers to reach plugin functionality that should require authorization, resulting in low-level integrity modification and availability disruption against affected WordPress installations. The root cause is CWE-862 (Missing Authorization) - the plugin fails to verify user capabilities before executing privileged actions, a pattern typically seen in unprotected AJAX handlers or REST endpoints. No public exploit or CISA KEV listing exists at time of analysis, but the zero-complexity unauthenticated attack vector makes automated scanning trivial.
Plaintext credential disclosure in GeoVision GV-LPC2211 V1.13 allows an authenticated Guest-level user to retrieve the full persistent device configuration - including administrative and standard user passwords in cleartext - via the SSVR service endpoint. The root cause is a missing authorization check (CWE-862): the device fails to restrict configuration retrieval to privileged roles, allowing the Guest role to access sensitive data it should never reach. While direct CVSS impact is confidentiality-only, exposure of admin credentials enables full device takeover as a secondary step, elevating practical risk for physical-security deployments. No public exploit has been identified at time of analysis.
Denial of service in Apache ActiveMQ Artemis and Apache Artemis message brokers allows authenticated clients holding MANAGE permission to crash broker processing threads by submitting crafted management-via-messaging requests that trigger unsafe Java deserialization. The deserializer processes method parameters the broker never actually uses, permitting gadget-chain payloads that consume excessive CPU and pin the thread pool. Both the legacy ActiveMQ Artemis lineage (1.3.0-2.44.0) and the newer Apache Artemis project (2.50.0-2.56.0) are affected; no public exploit or active exploitation has been identified at time of analysis.
Denial of service in Apache ActiveMQ Artemis and Apache Artemis allows an authenticated client to exhaust shared broker thread resources by attaching a consumer with a crafted wildcard message selector that triggers excessive computational evaluation during message delivery. Affected versions span Apache ActiveMQ Artemis 1.0.0-2.44.0 and Apache Artemis 2.50.0-2.56.0, with a vendor-confirmed fix released in version 2.57.0 on September 9, 2026. No public exploit code or active exploitation has been identified at time of analysis.
mruby 4.0.0's Prism-based compiler front end (mrbgems/mruby-compiler) passes NULL pointers returned by zero-length allocations into memcpy() and memcmp(), so parsing a crafted Ruby source file such as an operator assignment whose write name is exactly "=" (for example eval('[.m M:+=')) causes undefined behavior and a possible interpreter crash. The impact is availability-only: an attacker who can get the target to compile or eval untrusted mruby source can interrupt the hosting process. No public exploit code or CISA KEV listing is known, EPSS is only 0.15% (5th percentile), and an upstream fix commit (c6866eed) exists, but the description's claim of a practical crash conflicts with the commit's own note that only sanitizer builds actually report the condition.
Pacemaker Configuration System (PCS) on Red Hat Enterprise Linux 8, 9, and 10 exposes an arbitrary file-read primitive to local members of the 'haclient' group via the `pcs host auth --token` command. The pcsd daemon reads the attacker-specified file path with root privileges, base64-encodes up to 256 bytes of content, and transmits it through cluster node communication channels the attacker controls - enabling exfiltration of short sensitive files such as API tokens, symmetric keys, or credential snippets that are otherwise inaccessible to the attacker. No public exploit has been identified at time of analysis, but the attack requires only local access and group membership, making it a realistic insider-privilege escalation threat in multi-tenant HA environments.
Memory exhaustion denial of service in HashiCorp Consul's native RPC listener allows a network-adjacent client holding a valid mTLS certificate - but no ACL token - to crash or severely degrade Consul servers by exhausting server memory before ACL authorization is evaluated. Both open-source Consul and Consul Enterprise are affected across multiple release tracks. Vendor-released patches are available in Consul 2.0.4 and Consul Enterprise 1.21.18, 1.22.12, and 2.0.4; no public exploit or CISA KEV listing has been identified at time of analysis.
Open WebUI versions 0.8.0 through 0.11.0 contain an authorization bypass in the OAuth token exchange endpoint that allows users to obtain valid sessions without triggering the role management logic enforced by the normal OAuth login callback. Users whose identity provider roles would cause Open WebUI to deny or demote them on standard login can instead present a provider access token directly to the `/token_exchange` endpoint and receive a session at their existing (unauthorized) role level. Fixed in v0.11.1; no public exploit identified at time of analysis.
Stored Cross-Site Scripting in the EventON WordPress plugin (versions ≤ 2.5.7) allows authenticated subscribers to inject malicious JavaScript that executes in the browsers of other users, including administrators. The vulnerability stems from insufficient input sanitization and output encoding in subscriber-accessible event fields, enabling privilege escalation via script execution in a privileged session. No public exploit code or active exploitation has been confirmed at time of analysis.
Broken authentication in IMPress for IDX Broker WordPress plugin (versions ≤ 3.3.0) allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited integrity and availability impact. The CVSS vector (PR:N, AV:N, AC:L) confirms exploitation requires no credentials and no user interaction against default plugin configurations. No active exploitation or public exploit code has been identified at time of analysis, though the unauthenticated nature and low complexity lower the barrier for opportunistic attacks against WordPress sites running the vulnerable plugin.
Unauthenticated broken access control in the BuddyForms WordPress plugin (ThemeKraft, versions ≤ 2.9.0) permits remote unauthenticated attackers to invoke restricted plugin functionality without valid credentials, yielding limited integrity and availability impact. The root cause is CWE-862 (Missing Authorization) - the plugin omits the required WordPress capability checks before executing certain operations, leaving those actions reachable by any network requestor. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, but the zero-authentication barrier keeps real-world risk elevated relative to the Medium CVSS score alone.
Stored Cross-Site Scripting in the WP Docs WordPress plugin (versions ≤2.3.1) allows authenticated subscribers to inject malicious scripts that execute in the browsers of other users, including administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a subscriber-initiated, stored XSS with scope change, meaning a low-privilege account can affect higher-privilege sessions. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in the Robokassa Payment Gateway for WooCommerce plugin (versions ≤1.8.9) allows unauthenticated remote attackers to invoke restricted plugin actions, resulting in limited integrity and availability impact on affected WordPress e-commerce stores. The root cause is CWE-862 (Missing Authorization): the plugin fails to perform capability checks before executing sensitive operations, as reported by Patchstack (EUVD-2026-75513). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated content injection in the Simple Cloudflare Turnstile WordPress plugin (versions <= 1.42.1) allows remote attackers without any credentials to inject arbitrary content into affected WordPress sites. Reported by Patchstack and classified under CWE-94 (Code Injection), the flaw exposes sites to partial confidentiality and integrity compromise (CVSS C:L/I:L) via a network-accessible attack requiring no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in the import_contacts function of the Groundhogg WordPress CRM plugin (versions ≤ 4.7.1) allows authenticated low-privilege users to read arbitrary files from the web server by supplying directory traversal sequences in a file path parameter. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the flaw is network-exploitable with no complexity or interaction requirements beyond holding a basic WordPress account. Because WordPress plugins execute in the web server process context, the most critical exposure is likely reading wp-config.php, which contains database credentials and secret keys, enabling secondary attacks well beyond the medium 6.5 base score.