Stored cross-site scripting in the Translate WordPress with GTranslate plugin before 3.0.10 allows authenticated administrators to inject persistent JavaScript into front-end markup rendered to all site visitors. The plugin's bundled front-end scripts consume an unvalidated settings value and construct DOM markup from it without escaping, meaning a malicious or compromised admin can embed scripts that execute in every visitor's browser session. No public exploit has been reported as actively exploited in the wild; however, a proof-of-concept is publicly available via WPScan.
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level user to permanently delete charts created by other users, including administrators, by exploiting a missing per-chart ownership check on deletion requests. The plugin validates only a site-wide capability (confirming the user can edit content generally) but never verifies whether the requesting user owns the specific chart being deleted - a classic BOLA/IDOR pattern under CWE-862. A publicly available proof-of-concept from WPScan demonstrates trivial exploitation with any valid Contributor account. No public exploitation (KEV) status is confirmed at time of analysis.
Out-of-bounds read in PCRE2 before version 10.48 can be triggered in pcre2_match() when the PCRE2_MATCH_INVALID_UTF option is active and a subject string containing invalid UTF sequences is matched. The flaw occurs during backward scanning through invalid UTF data, where the lower buffer bound is not enforced, potentially crashing the calling application. The official CVSS score of 3.7 reflects high attack complexity and an impact limited to partial availability loss, with no confidentiality or integrity consequences confirmed. No public exploit has been identified at time of analysis.
Restricted API token authorization bypass in Forgejo before 16.0.4 (and before 15.0.8 on the 15.x branch) allows authenticated users holding limited-scope tokens to invoke the 'allow maintainer edit' pull-request feature beyond those tokens' intended permissions. The flaw is CWE-863 Incorrect Authorization: the endpoint responsible for toggling maintainer-edit access on PRs fails to enforce token scope boundaries, permitting a scoped token to reach an operation it should be barred from. No public exploit has been identified at time of analysis, and CVSS AC:H signals that specific token configuration conditions must be met to trigger the bypass.
Argument injection in Pardus Pen before version 4.2.1 allows a local, low-privileged user to inject unsanitized argument delimiters into an underlying command invocation, yielding limited integrity impact. The flaw (CWE-88) is strictly local in scope-CVSS AV:L/PR:L-and carries no confidentiality or availability consequence per the published vector. No public exploit code and no active exploitation have been identified; vendor-released patch 4.2.1 is available via the TR-CERT advisory.
Two-byte memory disclosure in PCRE2's pcre2_serialize_encode function exposes a small amount of potentially sensitive memory to local adversaries who already have some form of unsafe process access. All PCRE2 releases prior to 10.48 are affected across all supported platforms, per CPE cpe:2.3:a:pcre:pcre2:*:*:*:*:*:*:*:*. No public exploit code or active exploitation has been identified; the vendor advisory explicitly qualifies that exploitation occurs in contexts where the adversary's access is already unsafe, substantially constraining real-world impact beyond the minimal two-byte leak.
Out-of-bounds read in PCRE2 before 10.48 can produce a limited availability impact when an attacker supplies invalid UTF-encoded data to an application that JIT-compiled patterns for one match mode but then calls pcre2_match with a different mode, triggering a JIT fallback with inconsistent internal state. The flaw is tracked as GHSA-2p8c-ff85-vh9x and was corrected in the PCRE2 10.48 release alongside four other security fixes. No public exploit code and no active exploitation have been identified at time of analysis; the low CVSS score of 2.9 and high attack complexity reflect the narrow, configuration-dependent preconditions required.
Stored cross-site scripting in Flextype CMS 0.9.9 through 1.0.0-alpha.3 allows an attacker with write access to the server-side plugins directory to inject arbitrary scripts into administrators' browsers. The vulnerable sink is the dependency error page rendered by getValidPluginsDependencies() in Plugins.php, which reflects plugin directory names without HTML-encoding. Exploitation requires the attacker to first plant a malicious plugin directory name and then wait for an authenticated user to trigger a dependency validation failure; no public exploit or active exploitation has been identified at time of analysis.