Remote code execution in Xuxueli xxl-job up to version 3.4.2 allows authenticated low-privileged users to execute arbitrary code on the executor host via the GLUE mode Groovy script handler in GlueFactory.java. The root cause is that GroovyClassLoader.parseClass processes attacker-supplied Groovy source directly, compiling and running it without a restrictive sandbox. A public proof-of-concept exploit targeting v3.4.2 has been released on GitHub, and the vendor did not respond to the coordinated disclosure.
Improper privilege management in xxl-job admin up to version 3.4.2 exposes the `loadById` endpoint of `JobGroupController.java` to unauthorized access by low-privileged authenticated users, leaking executor group configuration data. The vulnerability resides in the admin web interface's job group management controller and allows users who should lack access to read job group details via direct endpoint calls. A public proof-of-concept exploit exists; no vendor patch has been released following disclosure, as the vendor did not respond.
MFA weakening in SEP sesam before 5.2.0.24 allows a low-privileged attacker to register a second OTP authenticator for the same Active Directory account by exploiting a case-sensitivity mismatch between SEP sesam (case-sensitive) and Active Directory (case-insensitive) username handling. When AD authentication and MFA enforcement are both configured, an attacker can create a duplicate SEP sesam account using a differently-cased variant of an existing AD username, then attach a separate OTP credential to that account - effectively establishing an additional authentication path that circumvents the intended MFA control. No public exploit code exists and the issue is not listed in CISA KEV, but the fix is confirmed in release 5.2.0.24.
Insecure direct object reference in the Masteriyo LMS WordPress plugin (versions 1.14.0 through <3.4.1) allows authenticated users holding the instructor role to retrieve full content and metadata of arbitrary WordPress posts - including private and draft courses authored by other instructors - by supplying arbitrary post IDs in download requests. The plugin neither verifies that the requesting instructor owns the target record nor restricts the post types eligible for retrieval. No active exploitation is confirmed (EPSS 0.13%, not in CISA KEV), and the CVSS score of 2.7 reflects the high-privilege prerequisite; however, the real-world business impact - exposure of unpublished course intellectual property between competitors on a shared platform - exceeds what the low numerical score suggests.
Authenticated low-privilege users of the BEAR WordPress plugin (before 1.2.2) can read competing sellers' private product data by substituting arbitrary product identifiers in several unprotected API handlers that lack ownership validation. The flaw (CWE-639, IDOR) exposes protected downloadable file URLs and private product metadata - commercially sensitive data in multi-vendor marketplace deployments. No public exploit code has been identified, and EPSS sits at 0.13% (3rd percentile), reflecting low current exploitation pressure.