Reflected XSS in WWBN AVideo's Gallery plugin allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by supplying a malicious payload in the `getBackURL` GET parameter targeting `plugin/Gallery/view/Category.php`. The injected value is echoed directly into an href attribute without HTML encoding, enabling `javascript:` URI injection that fires when a visitor interacts with the Back navigation control while the SubCategorys feature is active. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score of 5.3 appropriately reflects the mandatory user-interaction step that constrains mass exploitation.
Reflected XSS in WWBN AVideo's confirmLivePassword.php allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The vulnerability arises because the PHP script copies REQUEST_URI verbatim into an HTML form action attribute - a quote character in the URL path breaks attribute context and enables injection of arbitrary event handlers executing within the site's origin. No public exploit code or active exploitation has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms low-complexity unauthenticated exploitation gated only on passive victim interaction.
Reflected XSS in WWBN AVideo's Live plugin (plugin/Live/confirmLivePassword.php) allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of any user - including administrators - who follows a crafted link. The GET parameter `u` bypasses the application's `$securityFilter` and is interpolated without encoding directly into an HTML `<img src="...">` attribute, enabling attribute breakout and injected event-handler execution. No patched version was available at time of disclosure; no public exploit code or active exploitation (CISA KEV) has been identified.
Reflected XSS in WWBN AVideo's showAlertMessage() function allows unauthenticated attackers to inject arbitrary JavaScript into the site's execution context by abusing how the raw HTTP Referer header is embedded inside a JavaScript block comment without output encoding. Exploitation requires luring a victim to navigate to AVideo from an attacker-controlled page so the browser automatically includes the crafted Referer header. The injected script executes under the AVideo site origin, enabling session theft, credential harvesting, or UI redressing against authenticated users.
Log field injection in morgan, the Node.js HTTP request logger middleware, before version 1.12.1 allows unauthenticated remote attackers to manipulate parsed log records by embedding unescaped double quotes in HTTP headers such as User-Agent or Referer. The escapeLogField() function failed to escape the double-quote character, which serves as a field delimiter in the Apache combined log format that morgan emits by default, enabling a downstream log consumer that parses by field position to read attacker-supplied text as a subsequent field. In custom log formats that quote an attacker-controlled token before a server-controlled one, an attacker can forge field values including the HTTP response status code as seen by SIEMs, audit pipelines, or compliance tooling. No public exploit has been identified at time of analysis.
Unauthenticated brute-force authentication bypass in the Xootix OTP Login & Register WooCommerce plugin (≤2.7.2) allows remote attackers to hijack any registered WordPress user's session - including administrators - by exhausting a trivially small OTP space. Two compounding flaws make this practical at scale: the rate-limit attempt counter is keyed on the attacker-controlled `xoo_ml_user_ip_data` cookie rather than the true network source address, enabling unlimited counter resets by rotating the cookie, while OTPs are generated with PHP's non-cryptographic `rand()` over only 9,000 possible values. Successful exploitation calls `wp_set_auth_cookie()`, granting a full WordPress authentication session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing object-level authorization in Concrete CMS below 9.5.3 allows a signed-in dashboard user with limited Page Type editing rights to modify arbitrary Page Types outside their assigned permission boundary. The Types::submit() controller accepts a user-supplied ptID parameter and persists the targeted Page Type without invoking canEditPageType(), meaning the CSRF token validation - which is action- and user-scoped only - provides no object-level constraint. No public exploit or active exploitation has been identified; the vendor self-reported this as a moderate integrity issue (CVSS 4.0: 5.1) and patched it in version 9.5.3.
Stored cross-site scripting in Concrete CMS below 9.5.3 allows an authenticated user holding file-property edit permissions to inject persistent script payloads via the Document Library block's description and tags fields, executing against any visitor - including unauthenticated users - who loads a page rendering those columns. The block controller returned description and tags values without the h() output-escaping helper already applied to the title column, and the view template wrote these raw values directly into the HTML results table. Successful exploitation can result in session token theft or unauthorized browser-side actions against visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in Concrete CMS before 9.5.3 allows authenticated users with limited Express entry permissions to inject entries into Express objects they are not authorized to modify. The vulnerability stems from a parameter confusion bug where the permission check validates the entity supplied in the POST body, but the dashboard submit route resolves the actual target entity from an attacker-controlled route ID - and the two are never compared. An attacker who legitimately holds add-entry permissions on one Express object can therefore write to entirely different, protected datasets, potentially triggering administrative workflows or polluting content managed by higher-privilege users. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization in Concrete CMS 9.2.0-9.5.2 allows authenticated editors holding block-add scope to bypass file-manager visibility controls by exploiting the Area API's block-create endpoint, which never invokes the block type controller's validate() method. For file-referencing block types such as hero_image and gallery, this validate() call is the sole enforcement point for file access authorization - its omission means a restricted file reference can be stored and rendered on any page. The unauthorized file's URL and thumbnail preview are then disclosed to both the submitting editor and all page visitors, with the severity of that disclosure dependent on whether public or private file storage is configured. No public exploit has been identified at time of analysis.
Open redirect in the file-upload handler of an ICS inventory management product (covered by ICS-CERT advisory ICSA-26-254-01) allows an authenticated attacker to redirect other authenticated users' browsers to arbitrary external destinations. The handler reflects the Referer header directly into a post-upload Location response without validating it against the application's own origin, enabling phishing and credential-harvesting chains. No public exploit code exists and this CVE is not listed in the CISA KEV catalog; however, its presence in an OT/ICS context and sharing an advisory with at least one other vulnerability in the same product (CVE-2026-90456) indicates a broader security review of this component is warranted.
CSV formula injection in WWBN AVideo (through commit c3edcc274) enables authenticated users to embed spreadsheet formula payloads in comments that execute when administrators or video owners open exported CSV files from the myComments.download.php endpoint. The unsanitized comment text containing =, +, -, or @ prefixes is written directly into the CSV output, which spreadsheet applications interpret as executable expressions. Depending on the victim's application and security settings, this can chain to OS command execution via DDE or similar mechanisms, elevating a low-privilege user's impact to the admin's local session. No public exploit has been identified and it is not listed in CISA KEV.
Open redirect combined with CSRF guard bypass in WWBN AVideo allows a remote unauthenticated attacker to redirect authenticated playlist managers to attacker-controlled phishing sites. The vulnerability resides in `objects/playlistSort.php`, which escapes AVideo's automatic CSRF protection because it lacks the `.json.php` filename suffix that triggers `autoCSRFGuard()`/`forbidIfIsUntrustedRequest()`, while simultaneously forwarding the unvalidated `HTTP_REFERER` header as a `Location` redirect without invoking AVideo's own `isSafeRedirectURL()` sanitizer. No patched version is available at time of analysis, leaving all AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 exposed to both playlist tampering and browser hijacking.
Keycloak's Dynamic Client Registration endpoint exposes confidential client secrets in cleartext to users holding the view-clients realm management role, violating the principle of least privilege. Affected deployments include Red Hat Build of Keycloak and Red Hat Single Sign-On 7 across all tracked versions. An attacker granted only read-only view-clients access can harvest any confidential OAuth/OIDC client secret via the registration API and subsequently authenticate as that client, escalating their effective permissions within the realm to whatever the compromised client is authorized to do.
Stored cross-site scripting in Concrete CMS versions below 9.5.3 allows an authenticated user with edit_page_contents permissions to inject malicious script payloads via the Date Format field in the Page Attribute Display block. Any site visitor who subsequently loads a page containing the poisoned block will execute the attacker's script in their browser, enabling session-token theft or malicious redirects. A vendor-released patch is available (9.5.3), no public exploit has been identified, and no CISA KEV listing exists at time of analysis.
Out-of-bounds read (CWE-125) in Citrix Workspace App for Windows exposes local, low-privileged users to limited memory disclosure and partial availability impact across Current Release and both LTSR branches. An attacker with local access and a standard user account can trigger the defect without user interaction, potentially reading a small amount of process memory and causing intermittent instability. No active exploitation or public exploit code has been identified; the vendor-released patch addresses the issue across all three affected release trains.
Email header injection in MetForm WordPress plugin before 4.1.9 allows unauthenticated attackers to inject arbitrary SMTP headers - such as Bcc - into notification emails dispatched by the site, by embedding newline characters in form field submissions that are configured to populate those headers. This enables silent exfiltration of form submission content to attacker-controlled addresses and potential abuse of the site as a spam relay. No public exploit code or CISA KEV listing exists; the CVSS 4.8 with AC:H correctly reflects the configuration prerequisite that limits the exploitable surface.
Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.
Out-of-bounds write (CWE-787) in Citrix Workspace app for Windows allows a physically present, low-privileged attacker to corrupt memory, resulting in high integrity and availability impact on the affected endpoint. Affected versions span all supported tracks: Current Release builds before 2603.11, LTSR 2507.x builds before CU3 (2507.1), and LTSR 2607 builds before the base release. No public exploit code has been identified at time of analysis, and the physical access requirement substantially constrains real-world exploitability despite the VI:H/VA:H impact ratings.
Cross-site request forgery in Site Kit by Google WordPress plugin version 1.186.0 and earlier allows an unauthenticated remote attacker to perform unauthorized actions on behalf of authenticated site administrators or editors. The flaw (CWE-352) exists because the plugin fails to properly validate request origin tokens, enabling forged state-changing requests to succeed when an authenticated victim interacts with attacker-controlled content. No public exploit has been identified at time of analysis, and real-world impact is constrained by the UI:R requirement - a legitimate privileged user must be socially engineered into triggering the request.
Contributor-level Insecure Direct Object Reference (IDOR) in the Starter Templates WordPress plugin (≤4.7.5) permits authenticated low-privilege users to manipulate object identifiers in plugin requests, modifying resources outside their authorized scope. Reported by Patchstack with a CVSS 4.3, the flaw is bounded to integrity-only impact - no data disclosure or availability disruption applies. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
Slim SEO WordPress plugin versions up to and including 4.10.0 exposes an Insecure Direct Object Reference (IDOR) vulnerability exploitable by authenticated contributors. With only contributor-level access (PR:L), an attacker can access SEO-related data objects - such as post metadata or SEO settings - that belong to other users or posts they are not authorized to view. The vulnerability is limited to confidentiality impact (C:L) with no integrity or availability consequence, and no public exploit has been identified at time of analysis.
Server-side template injection (SSTI) in Arma Digital Media Inc.'s Website Template product enables remote unauthenticated attackers to inject template engine expressions that are evaluated server-side, achieving code injection. All versions through build 11092026 are affected, and the vendor did not respond to TR-CERT's responsible disclosure, leaving no vendor-released patch available. No public exploit or CISA KEV listing has been identified at time of analysis.
Stack overflow in glibc's nscd (Name Service Cache Daemon) service, versions 2.3.4 and later, can be triggered by a malicious DNS server returning an oversized DNS response, causing the daemon to crash and degrading DNS resolution performance for the affected host. There is a remote theoretical possibility of nscd cache corruption if an attacker achieves precise heap-pointer control during the overflow, introducing a limited integrity impact on cached DNS data. nscd's isolated execution context (unprivileged user, no shell) constrains any post-crash impact, and no active exploitation has been identified.
live-boot at commit ff8867c silently skips dm-verity root hash signature verification when the .verity file is absent from the live medium, allowing a physically present attacker to boot a tampered or unsigned root filesystem image that bypasses integrity enforcement. The flaw undermines the dm-verity-enforce-roothash-signature kernel protection intended to guarantee boot-time filesystem authenticity on Debian live systems. No public exploit code has been identified at time of analysis; the CVSS 4.0 physical-access vector (AV:P) and attack-requirement condition (AT:P) significantly constrain real-world exploitability.