Unauthenticated information disclosure in the User Registration & Membership WordPress plugin (versions 5.0 through 5.2.7) exposes arbitrary users' email addresses, profile fields, roles, and membership order details to any visitor. The plugin's membership confirmation page performs no ownership verification - an attacker who supplies another user's identifier in the request receives that user's data if the site operator has configured user smart tags on the page's message template. No public exploit confirmed in CISA KEV, though a publicly available proof-of-concept is documented by WPScan.
Unsafe PHP deserialization in PHPGurukul Small CRM 4.0 exposes the login endpoint to object injection attacks via the uncontrolled `geopluginURL` parameter passed directly to `unserialize()` in `/crm/login.php`. A remote, unauthenticated attacker who can supply a crafted serialized payload to the login success handler may trigger arbitrary object instantiation, with actual impact constrained by available PHP gadget chains in the application. A public proof-of-concept exploit exists, though the vendor-reported CVSS 4.0 score of 2.9 and AC:H rating indicate exploitation is difficult and real-world impact is assessed as limited integrity degradation rather than full compromise.
Authorization bypass in jaychouchannel's Tourism-Management-System allows authenticated remote users to access or modify ticket order records belonging to other users by manipulating the ID parameter in CRUD operations against MenpiaodingdanController.java. This is a classic Insecure Direct Object Reference (IDOR) pattern where the application fails to verify that the requesting user owns the referenced resource. A publicly available proof-of-concept exists (GitHub issue #9), and a patch has been committed (d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86), though no versioned release is available due to the project's rolling-release approach.
Deserialization of untrusted data in the MailReceiver component of lenve vhr 1.0-SNAPSHOT enables authenticated remote attackers to manipulate application state and potentially execute arbitrary code via crafted serialized payloads. A YAKIT-based proof-of-concept exploit is publicly available on GitHub. The CVSS 4.0 score of 5.3 reflects low-privilege authentication as a prerequisite and limited per-component impact, though Java deserialization flaws can exceed their scored impact if exploitable gadget chains exist in the runtime classpath.
Authorization bypass in jaychouchannel's Tourism-Management-System (all Java/Spring Boot commits through 84d8ec384f) allows low-privileged authenticated users to invoke protected `security()` endpoints across 12 controllers by exploiting misapplied `@IgnoreAuth` annotations that instruct the AuthorizationInterceptor to skip permission enforcement entirely. The affected endpoints span chat, discussion, forum, friend, news, and store-bookmark controllers, exposing user security data and privileged actions to callers who lack the required roles. Publicly available exploit code exists via GitHub issue #12; the vendor has released a patch commit removing the offending annotations.
Improper access control in WARP-Clash-API (vvbbnn00) allows remote attackers to bypass key-based authorization in the Surge subscription handler, gaining unauthorized read and write access to subscription data. The affected function is get_surge_subscription in services/subscription.py, where manipulation of the key argument circumvents access control checks. A public proof-of-concept exploit exists on GitHub, and the product is abandoned with no upstream fix available or anticipated.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate database queries via the `firstname` parameter in `/pages/cust_pos_trans.php`. The flaw is a classic CWE-89 unsanitized input issue in a PHP-based point-of-sale and inventory management application. A publicly available proof-of-concept exploit exists; no public exploit identified as actively exploited in the wild (not in CISA KEV).
SQL injection in itsourcecode Sales and Inventory System 1.0 allows an authenticated remote attacker to manipulate backend database queries via the `firstname` parameter in `/pages/emp_transac.php?action=add`. A publicly available proof-of-concept exploit has been released via GitHub, confirming the attack path. The vulnerability arises from unsanitized user input being passed directly to a SQL query in a PHP-based web application, enabling data extraction or database manipulation depending on database permissions.
Improper authorization in lenve vhr 1.0-SNAPSHOT allows authenticated low-privilege users to change the password of any arbitrary employee record by supplying a manipulated `hrid` parameter to the `/hr/pass` endpoint, enabling horizontal privilege escalation and account takeover across the HR application. The flaw in `HrInfoController.updatePass` accepts the target employee identifier from client input without verifying that the requesting session holds rights over that specific record - a classic IDOR pattern classified under CWE-285. A public proof-of-concept exists via GitHub advisory; the vendor was unresponsive to coordinated disclosure, and no patch has been released.
Remote code execution in cym1102 nginxWebUI up to 4.4.2 is achievable by any authenticated user via the `autoUpdate` endpoint, which accepts an arbitrary `url` parameter and downloads and executes the resulting JAR file on the host OS without domain validation. A public proof-of-concept is disclosed in GitHub issue #213, and a fix exists only as an unmerged PR (#215) - no released patched version has been confirmed. The CVSS 4.0 low-impact metrics (VC:L/VI:L/VA:L) conflict materially with the actual RCE capability.
Code injection in sanjevirau gsubs (Electron application) up to version 1.0.3 allows remote attackers to execute arbitrary code by manipulating the filename argument passed to the showQuerySuccessPage function in renderer/index.js. The vulnerability exists in the Electron renderer process and requires passive user interaction to trigger. A public proof-of-concept exploit has been published on GitHub; no patch has been released and the vendor was unresponsive during coordinated disclosure.
Authorization bypass via IDOR in jaygajera17's Spring Boot e-commerce project allows any authenticated user to overwrite an arbitrary user's profile by supplying a foreign integer `userid` to the `updateUserProfile` endpoint in `UserController.java`. The `updateUserProfile()` method never compares the supplied `userid` against the authenticated principal, so a low-privilege session can silently modify any account's username, password, or profile fields. A public Python proof-of-concept exploit is available; a corrective pull request exists but has not yet been merged.
Server-side request forgery in FlowiseAI Flowise up to version 3.0.2 allows authenticated users to redirect internal server-side HTTP requests by supplying attacker-controlled Host and X-Forwarded-Proto headers to the Evaluations endpoint, causing the server to construct the axios.post base URL from untrusted input rather than a trusted server-side value. The flaw enables the Flowise server to be leveraged as a proxy for reaching internal network resources, cloud metadata services, or adjacent microservices invisible to the external attacker. A publicly available proof-of-concept exists (GitHub issue #6687), and vendor-released patch 3.1.3 is available, though all affected versions (≤3.0.2) have been designated end-of-life by the maintainer.
Missing authorization in wxiaoqi Spring-Cloud-Platform's OnlineController allows authenticated low-privileged users to invoke getOnlineInfo without proper access checks, exposing session and online-user data beyond their intended permission scope. Affected versions are 1.0, 2.2, and 3.0 of the ace-admin module. A public proof-of-concept exploit (poc_vuln2_session_exposure.zip) has been released, though no vendor patch exists and the project has not responded to the coordinated disclosure via GitHub issue #65.
Missing authorization in wxiaoqi Spring-Cloud-Platform 3.0.1 and 3.1.0 enables remote authenticated attackers to bypass permission enforcement via the `checkUserPermission` function in the Permission Service RPC component. A proof-of-concept exploit (`poc_vuln1_failopen_authz.zip`) is publicly available on GitHub, lowering the barrier to exploitation. The vendor has not responded to the issue report filed at the project repository, leaving affected deployments without an official patch.
Unrestricted file upload in PHPGurukul Bank Locker Management System 1.0 exposes authenticated banker-role users' ability to upload arbitrary file types via the `addressproof` parameter in `/blms/banker/add-locker-form.php`, a pattern (CWE-434) that in PHP applications commonly enables remote code execution by uploading a PHP webshell to a web-accessible directory. A publicly available proof-of-concept exploit exists per the GitHub issue linked in references, elevating practical risk above what the assigned CVSS 4.0 score of 5.3 suggests. No active exploitation is confirmed in CISA KEV at time of analysis.
SQL injection in itsourcecode Sales and Inventory System 1.0 allows authenticated remote attackers to manipulate the `ID` parameter in `/pages/inv_edit1.php` to execute arbitrary SQL against the backend database. A public exploit has been disclosed via GitHub, lowering the skill barrier for opportunistic abuse. No vendor-released patch has been identified at time of analysis; the CVSS 4.0 score of 5.3 with E:P maturity reflects partial but confirmed exploitability.
Unrestricted file upload in lenve vhr 1.0-SNAPSHOT allows any authenticated user to upload arbitrary file types through the avatar upload endpoint, bypassing server-side validation entirely. The vulnerable function FastDFSUtils.upload at the /hr/userface endpoint accepts multipart file submissions without enforcing file-type or content-type restrictions, enabling upload of web shells or other malicious payloads to the FastDFS distributed storage backend. A proof-of-concept exploit is publicly available and the vendor has not responded to disclosure, leaving no official patch in place.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the `/pages/sup_edit1.php` endpoint to database manipulation via an unsanitized `ID` parameter, enabling a low-privileged remote attacker to read or modify arbitrary backend database contents. A publicly available exploit (POC on GitHub) confirms the technique is reproducible with minimal skill. The vulnerability is no public exploit identified in CISA KEV, but the combination of network accessibility, a published POC, and trivial exploitation mechanics elevates practical risk for any instance exposed to the network.
SQL injection in GongShengyue OnlineBooks allows authenticated remote attackers to manipulate database queries through the `column` parameter of the listSplit interface in BooksServlet.java. The vulnerability enables partial data extraction, modification, and potential availability impact against the backend database. A public proof-of-concept exploit has been published on GitHub, raising near-term exploitation probability for any internet-exposed deployments.
Cross-site request forgery in Rizwan17's PHP inventory-management-system allows remote attackers to perform unauthorized state-changing actions by tricking an authenticated victim into visiting a malicious page. The vulnerability exists in includes/process.php and results in limited integrity impact - an attacker can manipulate inventory data on behalf of a logged-in user without the user's knowledge. A publicly available proof-of-concept exploit (poc_idor_updateuser.py) exists; however, no KEV listing indicates no confirmed active exploitation at time of analysis.
Memory corruption in davenardella snap7 up to version 1.4.3 allows a network-accessible, high-privileged attacker to corrupt memory by supplying a malformed DataLen argument to the TSnap7MicroClient::opUpload function in src/core/s7_micro_client.cpp. The affected library is used for communicating with Siemens S7 PLCs in industrial control environments, making the confidentiality, integrity, and availability of PLC upload sessions potentially compromised. A public proof-of-concept exists via a GitHub issue report, and the project maintainer has not yet responded or issued a patch.
Authenticated SQL injection in Feng Office's reorder handler functions exposes the backend database to partial read and write access by privileged users. The vulnerability exists in `update_system_module_order` and `update_dimension_order` within `MoreController.class.php`, where the `modules` and `dims` arguments are interpolated into SQL queries without sanitization. All versions up to 3.11.13.11 are affected, a public proof-of-concept exploit exists, and the vendor has not responded to disclosure, leaving no patch available.
Cross-site scripting in the Anchor Tag Handler of Totolink A3002MU firmware version Hh-B20211125.1046 allows network-accessible attackers with low-privilege credentials to inject malicious scripts into the router's web management interface, which execute in a victim's browser upon interaction. A public proof-of-concept exploit has been published on GitHub, lowering the technical barrier for exploitation. No vendor-released patch has been identified in the available intelligence, and the firmware timestamp (November 2021) suggests this is a long-unsupported build unlikely to receive a security update.
Stored cross-site scripting in stilleshan ServerStatus 1.0 and 2.0 allows a remote authenticated attacker to inject malicious JavaScript via the `custom` argument processed in the Stats Generation component (server/src/main.cpp). When an administrator or other user subsequently views the affected stats page, the stored payload executes in their browser session, enabling session hijacking or credential theft. A public proof-of-concept exploit exists as a documented PDF on GitHub; the vendor did not respond to coordinated disclosure.
Cross-site scripting in Fengoffice Feng Office up to version 3.11.13.11 allows an authenticated low-privilege user to inject malicious JavaScript via the og_objects.name argument processed by the getTitle() function in the Task Title Output component. When a victim user subsequently views the affected task, the unsanitized payload executes in their browser. No vendor patch exists - the vendor did not respond to coordinated disclosure - and a public proof-of-concept exploit is available.
Heap buffer overflow in GPAC MP4Box's `gf_node_get_field()` function (scenegraph/base_scenegraph.c) allows local low-privilege attackers to corrupt heap memory by supplying a crafted MP4 file containing malformed MPEG-4 scenegraph data. The root cause, visible in the fix commit, is misaligned field entries across multiple MPEG-4 node struct definitions in nodes_mpeg4.h - specifically `GF_ChildNodeItem` fields misassigned between struct pairs (OctreeImage/XXParticles, SolidRep/SubdivisionSurface, PointTextureV2/SBVCAnimationV2) - causing `gf_node_get_field` to compute incorrect byte offsets and write outside intended heap allocations. A public proof-of-concept exists; no active exploitation (CISA KEV) has been confirmed.
Use-after-free in GPAC's MP4Box multimedia tool (all versions through commit f1219cde) allows a local low-privileged attacker to corrupt heap memory via the gf_list_count function in utils/list.c, resulting in application crashes and potentially limited code execution within the process. The fix released in abi-16.23 (commit 49dee5cad329) addresses multiple interrelated UAF and null-dereference conditions across the scenegraph manager, BIFS memory decoder, and AV1 reframer subsystems. A public proof-of-concept exploit exists; no active exploitation has been confirmed via CISA KEV.
Null pointer dereference in GPAC's MP4Box scenegraph engine crashes the application when processing malformed MPEG-4 BIFS scene data. The flaw resides in gf_node_list_add_child within base_scenegraph.c, reachable when node registration encounters a zero instance count or a null node pointer in gf_node_unregister() and gf_node_get_name_and_id(). A public proof-of-concept exploit exists and a vendor-released patch (abi-16.23) is available; no active exploitation is recorded in CISA KEV.
Null pointer dereference in GPAC's MP4Box tool crashes the process when parsing crafted MPEG-4/VRML scene graph data containing a malformed MFURL field, triggering the flaw inside gf_sg_mfurl_del() during scene graph cleanup. Local, low-privileged users can cause a denial of service by feeding MP4Box a specially crafted file; there is no confidentiality or integrity impact. A public proof-of-concept is available and the CVSS 4.0 vector confirms Exploit maturity of Proof-of-concept (E:P), making this straightforward for local attackers to reproduce, though impact remains limited to application crash.
Race condition in vvbbnn00's WARP-Clash-API Save Account Job component allows authenticated low-privilege remote attackers to exploit improper synchronization during concurrent account-state operations, yielding limited confidentiality, integrity, and availability impacts. The project has been abandoned by its maintainer, who did not respond to disclosure, and operates on a rolling release model with no versioned releases - meaning no patch will be issued. A publicly available proof-of-concept exploit exists on GitHub, though the CVSS 4.0 score of 1.3 and high attack complexity rating indicate that reliable exploitation is difficult in practice.
Race condition in the `doUpdateLicenseKey` function of vvbbnn00/WARP-Clash-API allows authenticated remote attackers with low privileges to exploit concurrent state manipulation for limited confidentiality, integrity, and availability impacts. The affected product is an abandoned, unsupported open-source Cloudflare WARP license key management tool with no versioning scheme and an unresponsive maintainer. A public proof-of-concept exploit exists on GitHub, though the high attack complexity (AC:H) and requirement for prior authentication substantially limit real-world risk.
Absolute path traversal in the Zettlab D6 Ultra NAS firmware before version 1.7.0 permits authenticated network-adjacent users to navigate outside their designated personal folder and read files from arbitrary directories on the device. The vulnerability stems from insufficient sanitization of user-supplied file paths, allowing the personal-folder boundary to be bypassed using absolute path references. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is confirmed in version 1.7.0.
Command injection in LB-LINK AC1900_AZ2 router firmware V1.0.2 allows adjacent-network actors to inject OS commands through shell metacharacters passed to the bs_SetLimitCli_info function within libshare.so, triggered via a POST request to /goform/set_LimitClient_cfg. The vulnerability is notable for an internal contradiction: the CVSS vector assigns PR:H (administrative privileges required), yet the description explicitly frames the attack scenario as one where the actor lacks administrative access but can reach the endpoint - suggesting the endpoint may be accessible to lower-privilege or unauthenticated callers in certain deployments. No patch has been identified and no public exploit is confirmed at time of analysis beyond the researcher's GitHub write-up.
Link spoofing in Floodlight SDN controller (commit 71fe8a7) enables adjacent-network attackers to inject false topology information, causing the controller to misclassify a boundary port as a non-boundary port and disrupting legitimate host communication. The vulnerability targets OpenFlow-based topology discovery, requires adjacent network positioning and low privileges (AV:A/PR:L), and carries a low CVSS base score of 3.0 with a scope change (S:C) reflecting cross-component impact on the controller's global network view. No public exploit code and no active exploitation have been identified at time of analysis.
Out-of-bounds read in FFmpeg's WMA audio encoder (libavcodec/wmaenc.c) before version 9.0 allows a process crash when encoding WMA audio with crafted extradata parameters. The root cause is missing required padding bytes in the extradata buffer allocation path, permitting a read operation to extend past the buffer boundary (CWE-125). With a CVSS score of 2.9 and impact limited to availability, no public exploit identified at time of analysis, and no CISA KEV listing, this is a low-severity issue with narrow real-world exposure.
Out-of-bounds read in FFmpeg's MOV container parser (mov_read_iacb in libavformat/mov.c) crashes the process when handling IACB atoms containing insufficiently padded extradata, affecting all releases before 9.0. The vendor-assigned CVSS score of 2.9 (Low) with AV:L/AC:H reflects a local, high-complexity attack limited to a process crash with no confidentiality or integrity impact. No active exploitation has been identified; an upstream fix is available in FFmpeg 9.0 via commit 8439e020 and PR 22988.
Heap-based buffer over-read in TinyEXIF before 1.1.0 allows an attacker who can supply a crafted JPEG image to crash applications that use the library for EXIF metadata parsing. EntryParser::Fetch methods compute SubjectArea IFD entry offsets without validating them against the actual buffer length, producing out-of-bounds reads when processing malformed tags. No public exploit exists and no CISA KEV listing is present; impact is limited to availability and assessed as Low severity.
Terminal escape sequence injection in procs (the Rust-based `ps` replacement by dalance) through version 0.14.12 enables a local attacker to embed ANSI, CSI, or OSC control sequences in process argv that are rendered unfiltered into other users' terminals when they run procs. The Command column in `src/columns/command.rs` only stripped literal newlines and tabs, leaving ESC bytes and derived sequences intact; a victim running procs on the same host will have those sequences interpreted by their terminal emulator, enabling clipboard overwrite via OSC 52, screen manipulation via CSI, or hyperlink spoofing. No public exploit exists beyond the fix-commit unit test, and the CVSS 4.0 score of 2.4 (Low) accurately reflects the narrow, local-only, limited-integrity impact.
OS command injection in webgjc web_robot versions 2.4.0, 2.5.0, and 2.8.0 enables remote attackers to execute arbitrary operating system commands by supplying malicious input through the case_name parameter handled by the controller_listen or controller_recover functions in py/web.py. A publicly disclosed proof-of-concept exploit exists, the vendor failed to respond to responsible disclosure, and no patch has been released. The reported CVSS 4.0 base score of 5.3 reflects conservative impact ratings that appear inconsistent with the true scope of OS command injection on an unpatched host.
Improper privilege assignment in PHPGurukul Bank Locker Management System 1.0 allows remote authenticated attackers to bypass access controls by manipulating the `UserType` parameter in `sidebar.php`. The server fails to validate the supplied privilege level against the authenticated session, permitting lateral or vertical privilege escalation within the application. A public proof-of-concept exploit has been released per the VulDB disclosure, though the CVSS 4.0 base score of 2.1 reflects limited actual impact across confidentiality, integrity, and availability dimensions.
Privilege escalation via mass assignment in lenve vhr 1.0-SNAPSHOT allows an authenticated remote user to manipulate restricted fields - including role or privilege-level attributes - through the HrInfoController.updateHr endpoint by injecting unexpected parameters alongside the Password argument in HrMapper.xml. The vulnerability stems from improper privilege management (CWE-266), enabling a low-privilege HR system user to elevate their own account permissions without authorization. A public proof-of-concept has been disclosed; no vendor patch is available and the vendor has not responded to the disclosure.
Stored cross-site scripting in Xuxueli xxl-job up to version 3.5.0 permits an authenticated low-privileged user to inject malicious script content via the name or author parameters of the /jobinfo/insert endpoint, which is later rendered unsanitized to other users who view the job listing interface. The CVSS 4.0 score of 2.0 reflects the constrained real-world impact: exploitation requires a valid account and passive victim interaction, with impact limited to low integrity effect and no confidentiality or availability consequence. A public proof-of-concept is available, but no vendor patch exists as the vendor did not respond to coordinated disclosure.
Stored JavaScript injection through the Home Page editor in Grav 1.7.50.2 permits an authenticated administrator to embed script content that executes in a victim's browser when the page is viewed. However, NVD's own description includes a formal dispute: Grav's administrator role already grants unfettered access to modify templates, install plugins, and upload arbitrary executable content, meaning this JavaScript injection path adds no incremental attack capability beyond what the role inherently permits. NVD assigned a base score of 1.8 (AV:L/AC:H/PR:H/UI:R), and no active exploitation or public exploit code has been identified at time of analysis.
Missing authorization in Chengdu Qilu Technology Ludashi 6.1026.4715.714 allows a local high-privileged attacker to bypass protection controls enforced by the ProtectFilter64.sys kernel driver. The MessageNotifyCallback function within the Message Dispatch Handler processes messages without adequate authorization checks, enabling unauthorized manipulation of integrity and availability controls. A public proof-of-concept exploit has been released; the vendor was unresponsive to coordinated disclosure.
Information disclosure in Chengdu Qilu Technology Ludashi 6.1026.4715.714 allows a local high-privileged attacker to read arbitrary physical memory by sending a crafted IOCTL with a manipulated PhysicalAddress argument to the kernel driver ComputerZ_x64.sys. The vulnerable function sub_11008 exposes physical memory read capability to user-mode callers without adequate address validation, a classic pattern in poorly designed Windows kernel drivers that can expose sensitive in-memory data such as credentials or cryptographic material. A public exploit has been published; no vendor patch exists as the vendor did not respond to coordinated disclosure.