Missing authentication on update endpoints in jaychouchannel's Tourism-Management-System exposes write operations across 12 Spring controllers - including chat messages, forum posts, hotel/restaurant discussions, news, friend links, and bookmarks - to unauthenticated remote attackers. The root cause is confirmed by the patch commit (84d8ec3): the custom `@IgnoreAuth` annotation was incorrectly applied to update-path handlers, causing the authentication interceptor to skip those routes entirely. A public proof-of-concept exists via GitHub Issue #11; no CISA KEV listing has been issued.
Authentication bypass in vvbbnn00's WARP-Clash-API allows unauthenticated remote attackers to circumvent the `authorized` function by manipulating the SECRET_KEY argument, gaining unauthorized access to the API's proxy configuration management functions. All versions up to commit c7bf2360073959861219b422e51ae86411051b46 are affected, and no patch exists because the maintainer has abandoned the project and did not respond to disclosure. A public proof-of-concept exploit is available via a GitHub gist, lowering the bar for exploitation against any internet-exposed instance.
Improper access control in Rizwan17's PHP-based inventory-management-system exposes dashboard.php to unauthorized access via manipulation of the `userid` parameter, allowing remote unauthenticated attackers to access other users' data or bypass authentication controls. The affected codebase is identified by commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f and is distributed as a rolling release with no versioned patch available. A public proof-of-concept exploit has been published in a GitHub issue, and the maintainer has not responded to the responsible disclosure.
Unauthenticated remote attackers can register accounts with elevated (administrator) privileges in jaychouchannel Tourism-Management-System by manipulating the UsersEntity parameter during registration, bypassing role assignment controls. The commit diff reveals a broader scope than the description implies: at least 12 controller classes (ChatmessageController, multiple Discuss* controllers, ForumController, FriendController, FriendlinkController, NewsController, NewstypeController, StoreupController) had security() endpoints decorated with @IgnoreAuth, making those endpoints callable without any authentication. Publicly available exploit code exists; no active exploitation confirmed in CISA KEV.
Privilege escalation through parameter manipulation in Rizwan17's inventory-management-system allows remote unauthenticated attackers to register accounts with arbitrary privilege levels, including administrative roles, by supplying a crafted `usertype` value to the `createUserAccount` function in `register.php`. The vulnerability stems from the registration handler trusting client-controlled role values without server-side enforcement of permitted self-registration tiers. A public exploit is available via a GitHub issue report, and the vendor has not responded to the coordinated disclosure as of the time of reporting.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to read, modify, or delete database contents via the Category parameter in /bilal/save_class.php. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation. No KEV listing exists, but the combination of unauthenticated network access and a publicly available exploit makes this an active concern for any deployed instance.
Unconstrained memory allocation in TooTallNate Java-WebSocket 1.6.0-1.6.1 allows remote unauthenticated attackers to exhaust server heap memory by sending WebSocket frames with arbitrarily large declared payload lengths. The Draft_6455 fragmentation handler initialized maxFrameSize to Integer.MAX_VALUE (~2 GiB), so the library attempts to allocate the full declared frame size before any payload data is actually received. A publicly available proof-of-concept exists via GitHub issue #1508; the upstream fix is in PR #1509 but has not yet shipped in a tagged release.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows remote unauthenticated attackers to manipulate database queries via the `period` parameter of `/bilal/normal/pay_report.php`. A public proof-of-concept exploit has been published on GitHub (vuldb.com/submit/912055, github.com/zuojiu567/cve/issues/3), lowering the bar for exploitation significantly. No vendor patch has been identified at time of analysis, leaving deployments exposed with no vendor-supplied remediation path.
Uncontrolled resource consumption in evanchiu/serverless-todo (versions 1.0.3 and 2.0.0) allows remote unauthenticated attackers to exhaust compute or memory resources by sending crafted payloads to the API Todo Endpoint's saveTodos function. The vulnerability stems from unsanitized processing of the event.body argument in src/index.js without input size or rate limits. A public proof-of-concept is available via a GitHub issue; no patch has been released and the maintainer has not responded to the disclosure.
Authentication bypass in Cheshire Cat AI up to version 1.9.2 allows remote unauthenticated attackers to manipulate the `user_id` argument within the `_authorize_http_key` function to circumvent HTTP API key validation entirely. Any publicly exposed Cheshire Cat AI instance is at risk of unauthorized access to its AI agent API, enabling arbitrary interaction with the agent without valid credentials. A proof-of-concept exploit has been publicly disclosed via GitHub issue #1137, and the project maintainers had not responded to the disclosure at time of writing; no patch is available.
Insecure Direct Object Reference (IDOR) in PHPGurukul Bank Locker Management System 1.0 allows unauthenticated remote attackers to enumerate and view locker assignment records belonging to arbitrary customers by manipulating the `ltid` parameter in `/blms/view-assign-locker.php`. The application fails to verify whether the requesting party is authorized to access the referenced locker transaction record, exposing sensitive banking assignment data. A publicly available proof-of-concept exploit exists, though no CISA KEV listing indicates confirmed active exploitation at scale.
Hard-coded AES encryption in dromara orion-visor up to version 2.5.7 renders all SSH private keys and host passwords stored by the application recoverable by any attacker who can access the data store. The vulnerable function `HostKeyServiceImpl.encryptKey` in the asset-service module applies a fixed, unchanging key that is embedded in the publicly available GitHub source - making the key universally known to anyone who inspects the repository. A proof-of-concept demonstrating full plaintext recovery of stored SSH credentials has been publicly disclosed, and the maintainer has not responded to the issue report.
Default credential exposure in lenve vhr 1.0-SNAPSHOT allows unauthenticated remote attackers to authenticate as a privileged application user by submitting credentials embedded verbatim in the vhr.sql database seed file. A public proof-of-concept advisory (VHR-VULN-008) documents the specific credentials, removing any discovery barrier. The vendor did not respond to responsible disclosure, leaving no official patch available and the default credentials in place across all unmodified deployments.
SQL injection in SourceCodester School Registration and Fee System 1.0 exposes the student deletion endpoint (/bilal/normal/delete_stud.php) to remote unauthenticated attackers through an unsanitized PHP array parameter `selector[]`. A proof-of-concept exploit is publicly available via GitHub, enabling attackers to read or manipulate the underlying MySQL/MariaDB database. The CVSS 4.0 score of 6.9 (Medium) reflects per-axis Low impact across confidentiality, integrity, and availability, consistent with a PHP application database rather than a critical infrastructure system; no KEV listing indicates no confirmed mass exploitation at time of analysis.
Unauthenticated SQL injection in Feng Office's Legacy API allows remote attackers to manipulate the `auth` argument passed to the Contacts::instance->findAll function in application/models/CompanyWebsite.class.php, enabling partial read, write, and availability impact against the underlying database on versions up to and including 3.11.13.11. Publicly available exploit code has been disclosed on Google Drive, and the vendor did not respond to responsible disclosure contact prior to publication. No KEV listing exists, but the combination of PR:N attack surface and a live POC elevates practical risk above the moderate CVSS 4.0 score of 6.9.
Privilege escalation in the Simple Membership WordPress plugin before 4.7.8 allows authenticated members to obtain higher-tier memberships without paying the correct price. The plugin's PayPal IPN (Instant Payment Notification) handler accepts the membership level asserted in the payment notification without verifying it matches the level configured for the specific payment button that was purchased, enabling a low-cost membership purchase to be fraudulently upgraded to any higher tier. A publicly available exploit exists, and vendor patch 4.7.8 resolves the issue.
Unauthenticated information disclosure in the Bookit - Booking & Appointment Calendar WordPress plugin (versions before 2.6.0.1) exposes appointment records belonging to other customers via the availability-check endpoint. Any unauthenticated visitor can query this endpoint and receive free-text booking comments, personal contact information, and appointment details that belong to other registered users. A publicly available proof-of-concept exploit exists (documented by WPScan), lowering the skill barrier for abuse. No active exploitation has been confirmed in CISA KEV.
Unauthenticated information disclosure in the 'Contact Form to Chat Apps | Click to Chat to Order' WordPress plugin before 2.15.8 exposes all submitted form entries to any anonymous HTTP client. The plugin registers a public WordPress AJAX action that performs no capability check, nonce verification, or session validation - three standard WordPress authorization layers - allowing any remote actor to dump contact form submissions. A publicly available proof-of-concept exploit exists, reported by WPScan, making opportunistic mass scanning trivial.
Open redirect in the User Registration & Membership WordPress plugin before 5.2.8 permits unauthenticated attackers to craft post-login redirect URLs pointing to arbitrary external domains, enabling phishing campaigns targeting site visitors. The plugin fails to validate the destination parameter before executing the redirect, meaning any visitor who follows a specially crafted login link is silently forwarded to an attacker-controlled page after authenticating. A publicly available proof-of-concept exists per WPScan, and a vendor patch was released in version 5.2.8.
Payment bypass in the Quads Ads Manager for Google AdSense WordPress plugin (versions before 3.0.5) allows any low-privilege authenticated user capable of placing an advertising order to obtain paid ad placements at no cost. The plugin fails to verify transaction completion with the configured payment gateway before updating an order's status to paid, representing a fundamental business logic failure in the purchase flow. A publicly available proof-of-concept exploit has been published by WPScan, and the vendor has released a fix in version 3.0.5.
Horizontal privilege escalation in rtMedia for WordPress, BuddyPress and bbPress plugin before version 4.7.12 allows any authenticated subscriber-level user to alter the privacy settings of other users' activities and attached media. The plugin's privacy-change endpoint validates only a WordPress nonce that is shared across all logged-in users, performing no ownership verification against the requesting account. A publicly available exploit for this flaw has been disclosed via WPScan, enabling unauthorized exposure of private media or suppression of public content across a community site's user base.
Path traversal in node-restify's serveStatic plugin exposes arbitrary server-side files to unauthenticated remote attackers on all versions up to and including 12.0.0. The serveStatic function in /lib/plugins/static.js fails to adequately sanitize user-controlled path segments, allowing traversal sequences to escape the intended static file root and return files from elsewhere on the filesystem. No vendor patch is available - the maintainer did not respond to responsible disclosure - leaving affected deployments without an official fix.
Unauthenticated file upload in Anil-matcha Open-Generative-AI (versions up to 1.0.11/2.0.0) allows any remote attacker to upload arbitrary files - including HTML, SVG, and executable types - to the application's S3 backend via the /api/upload-binary proxy endpoint. The endpoint accepted requests without any API key check and imposed no restrictions on file type or content, as confirmed by the patch commit f013270957f. No active exploitation or public proof-of-concept has been identified at time of analysis; EPSS data was not provided.
Unauthenticated access to the AWS API Gateway endpoint in simalexan/api-lambda-send-email-ses allows any remote attacker to invoke the SES.sendEmail Lambda function without credentials, abusing the deployer's AWS Simple Email Service account to send arbitrary emails. Affected deployments are those built from any commit up to bda6869aa81371d1e872242e74fe7d953edb818d, with no patched release available as the project uses rolling delivery and the maintainer has not responded to the disclosure. No public exploit code or CISA KEV listing exists, but exploitation requires only knowledge of the deployed API Gateway URL and a simple HTTP request.
The graphiti FastAPI-based graph memory REST API (getzep/graphiti ≤ 0.30.2) shipped its ingest and retrieve routers with zero authentication - no API key, no token, no session check of any kind. Any unauthenticated remote caller with network access to the service can read stored knowledge-graph episodes or inject and overwrite graph data by sending ordinary HTTP requests. No public exploit code has been identified, but the barrier to exploitation is effectively zero: the attack requires only HTTP client access and knowledge of endpoint paths. No KEV listing at time of analysis.
Integer overflow in embedded-graphics ≤0.8.2 allows remote attackers to trigger memory corruption or denial-of-service by supplying a crafted `width` argument to `ImageRaw::draw_sub_image` in `src/image/image_raw.rs`. Rust's release-mode silent integer wraparound means the overflow propagates into buffer size calculations or slice indexing, potentially causing out-of-bounds memory access on the target embedded device. No vendor patch exists; the project was notified via GitHub issue #821 but has not responded. No public exploit or CISA KEV listing identified at time of analysis.
Integer overflow in the embedded-graphics Rust library (versions through 0.8.2) affects the bytes_per_row calculation inside ImageRaw::new on 32-bit compilation targets, causing incorrect buffer stride values that can lead to out-of-bounds memory access when processing crafted image data. The flaw was disclosed through GitHub issue #820, but the project had not responded with a fix at time of reporting. No public exploit code or active exploitation has been identified at time of analysis; remote reachability depends entirely on whether the consuming application ingests network-sourced image data.
The Storm UI topology REST endpoint (`GET /api/v1/topology/{id}`) in Apache Storm 3.0.0 returned a merged Nimbus daemon and topology configuration without credential redaction, exposing ZooKeeper authentication payloads and TLS keystore/truststore passwords to any principal holding topology read-only access. This privilege gap is significant because the dedicated `getNimbusConf` API already redacted these secrets and required elevated `nimbus.users` membership, yet the topology page - which merges in strictly more daemon state - was unprotected. No public exploit is identified at time of analysis, but exploitation requires only a single authenticated HTTP GET call, making the effective complexity trivially low for any principal with read-only cluster access.
Two authorization and redaction failures in Apache Storm 3.0.0 expose credential-bearing cluster configuration to under-privileged or entirely ungated callers. The Nimbus `getNimbusConf` Thrift API serves the full daemon configuration-including ZooKeeper authentication payloads and TLS keystore and truststore passwords-after only a user-level authorization check, silently omitting the credential masking applied everywhere else in the product. The Storm UI REST endpoint `/api/v1/cluster/configuration` is worse: the missing `@AuthNimbusOp` annotation causes the authorization filter to treat the endpoint as ungated, proxying requests under the UI daemon's own principal so that any caller passing `ui.filter` receives the full unredacted configuration regardless of their privilege level. No public exploit has been identified and this CVE is not in CISA KEV.
Path traversal in Zettlab D6 Ultra NAS (versions before 1.7.0) permits a low-privileged local user to mount arbitrary host paths - including /etc/passwd and /etc/shadow - into a container with read-write access by embedding '../' sequences in Docker Compose volume declarations. An attacker with compose-file write privileges can exfiltrate password hashes or overwrite authentication files, enabling full host privilege escalation. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; version 1.7.0 resolves the issue.
Prototype pollution in hapijs/joi's messages compilation function allows network-reachable attackers to replace an object's prototype chain by supplying `__proto__` as an error-code key in custom validation messages. Affected versions are joi before 17.13.8 and before 18.2.9. Applications that pass externally-controlled data (e.g., JSON request bodies) to `.messages()` or `.prefs({ messages: ... })` can have downstream code silently broken when it relies on standard `Object.prototype` methods. No public exploit identified at time of analysis, though the patch commit ships a working proof-of-concept test file.
Null pointer dereference in Systerel S2OPC through version 1.7.3 enables authenticated remote clients to crash the OPC-UA server by inducing heap allocation failures during subscription publish cycles. The defect in `msg_subscription_publish_bs__alloc_notification_message_items()` silently overwrites a NULL returned by a failed DataChangeNotification allocation with the result of a subsequent EventNotificationList allocation, masking the first failure and causing a deferred NULL dereference that terminates the server process. No public exploit or active exploitation has been identified; a vendor patch is available via GitLab commit 8848f051.
SQL injection in LuxSoft LuxCal through version 5.3.4L allows unauthenticated remote attackers to extract data from the underlying database by sending crafted requests to two public-facing PHP endpoints: rssfeed.php and common/retrieve.php. The vulnerability is reachable without authentication, as RSS and data-retrieval endpoints are typically exposed to anonymous visitors. A researcher has published proof-of-concept details, making exploitation straightforward for any attacker with network access to a LuxCal instance. No public exploit identified at time of analysis beyond the researcher disclosure.
Unauthenticated password reset in jaychouchannel's Tourism-Management-System allows any remote attacker to overwrite an arbitrary user's credentials by supplying only a known username to the resetPass endpoint - no current password, token, or session is required. All three Java Spring controllers (UsersController, DaoyouController, YonghuController) share the vulnerable pattern, enabling forced account lockout or, if the API response includes the newly generated random password, full account takeover. Publicly disclosed exploit code exists and the upstream fix is available via commit 9cb6215.
Hard-coded API token in dromara orion-visor through version 2.5.7 allows remote unauthenticated attackers to bypass the ExposeApi authentication gate enforced by ExposeApiAspect.beforeExposeApi. The static token is now publicly documented in a proof-of-concept writeup on GitHub after the vendor failed to respond to the responsible-disclosure issue report. No public exploit confirmed in CISA KEV at time of analysis, but a POC is available, materially lowering the bar for exploitation.
SQL injection in SourceCodester School Registration and Fee System 1.0 allows unauthenticated remote attackers to manipulate database queries via the Status parameter in /bilal/normal/save_stud.php. The vulnerability enables unauthorized data access, modification, and potential full database compromise through crafted HTTP requests. A public proof-of-concept exploit has been disclosed via a GitHub issue, raising immediate exploitation risk for any exposed instances.
Reflected XSS in Kagi Smallweb's query string rendering allows injection of JavaScript into HTML form action attributes across three server-rendered templates. Jinja2's |safe filter was applied to the raw Werkzeug request.query_string value in flag_panel.html, mobile_more.html, and reactions.html, bypassing auto-escaping when unencoded double-quote characters appear in the query string. Exploitation is technically feasible but practically constrained: standard browsers percent-encode double-quotes as %22, so delivery requires raw HTTP clients such as curl or netcat rather than crafted URLs sent to victims. No public exploit or active exploitation (CISA KEV) has been identified; the fix is patch commit 00b68144.
Heap memory exhaustion in Zephyr RTOS mcumgr SMP settings handlers allows unauthenticated attackers to trigger a monotonic heap leak by sending settings read, write, or delete commands that the application access hook rejects, ultimately depleting the kernel heap until the device must be rebooted. The three affected handlers - settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c - allocate buffers via k_malloc() but execute a direct return bypassing the end: cleanup label whenever CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK rejects a request via MGMT_CB_ERROR_RC. The vulnerability is availability-only with no memory corruption or information disclosure; no public exploit code or CISA KEV listing exists at time of analysis.
Reflected or stored cross-site scripting in the Order Printing component of Exrick xmall allows remote attackers to inject malicious scripts into victim browsers via the order-print.jsp template. The affected file is xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp, which fails to sanitize user-controlled input before rendering it in HTML context. Successful exploitation requires victim interaction (e.g., a privileged user viewing or printing a crafted order), making this a realistic attack against administrative personnel in e-commerce deployments using this platform.
Stored cross-site scripting in quequnlong shiyi-blog up to version 1.2.1 allows unauthenticated remote attackers to inject arbitrary JavaScript via the body.content parameter of the Add Message API, which executes in the browser of any administrator who later views submitted messages in the blog-admin panel. The affected file blog-admin/src/views/message/message/index.vue fails to sanitize message body content before rendering it, meaning a crafted submission persists until an admin reviews it. No vendor patch exists - the maintainer has not responded to the Gitee issue report (IK5RF6), and no public exploit has been identified at time of analysis.
Stored cross-site scripting in Open-Generative-AI's studio history components (ImageStudio.js, CinemaStudio.js, LipSyncStudio.js, VideoStudio.js) allows an authenticated low-privileged user to inject arbitrary HTML and JavaScript into the history panel by crafting a malicious generation prompt or URL, which then executes in any victim's browser session when the history panel is viewed. Versions up to 1.0.11 and 2.0.0 are affected per CPE and VulDB reporting. No public exploit has been identified at time of analysis, and no KEV listing exists, but the technique is trivially reproducible given the unguarded innerHTML interpolation pattern visible in the patch diff.
Cross-site scripting in shiyi-blog's search component allows an authenticated attacker to inject malicious scripts via crafted post titles or summaries, which execute in the browsers of other users who trigger search results containing the poisoned content. The `highlightKeyword` function in `blog-web/src/components/Search/index.vue` renders the title and summary fields without sanitization, making DOM injection trivial for any low-privilege content creator. No public exploit code has been identified at time of analysis; the vendor was notified via responsible disclosure through a Gitee issue report.
Stored cross-site scripting in Mogu Blog v2 through version 5.2 allows authenticated low-privileged users to inject arbitrary JavaScript via the `sortName` parameter of the `BlogSortServiceImpl.addBlogSort` function, rendered unsanitized through the FreeMarker template `info.ftl`. Any user who subsequently views the affected blog sort page becomes a victim of the injected script. No patch exists at the time of analysis; the project was notified via a Gitee issue but has not responded.
Stored cross-site scripting in the comment rendering layer of bbs-springboot 3.0.0 allows an authenticated low-privileged user to inject arbitrary HTML and JavaScript that executes in the browsers of other users who view the affected comment sections. The root cause, confirmed by the patch diff, is the Vue.js frontend's use of the `v-html` directive in `ChildComment.vue` and `LatestComment.vue`, which renders comment content as raw HTML rather than escaped text. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Cross-site scripting in shiyi-blog 1.0.0-1.2.1 allows authenticated remote attackers to inject arbitrary JavaScript through the `chat_msg` argument of the chat sendMsg endpoint, with execution triggered when another user loads the chat history via `SysChatMsgMapper.getChatMsgList`. The vulnerability resides in the Vue.js frontend component `blog-web/src/views/chat/index.vue` due to improper output encoding of user-supplied chat content. No vendor patch is available; the project has not responded to the responsible disclosure filed on Gitee.
Stored cross-site scripting in DataEase up to version 2.10.26 allows an authenticated attacker to inject arbitrary JavaScript through the `tooltip.backgroundColor` parameter of the Symbolic Map chart component, executing in the browser of any user who views the affected visualization. The injection point is the `buildTooltip` function in `symbolic-map.ts`, where user-controlled chart styling attributes are rendered without sanitization. No patch has been released; the vendor had not responded to the responsible disclosure issue at time of reporting, and no public exploit code has been identified.
Cross-site scripting in TDuckApp tduck-platform affects the Form Write View component (tduck-front/src/views/form/write/index.vue) through the unsanitized submitShowCustomPageContent parameter in all versions up to and including 5.3. An authenticated remote attacker can inject malicious script content into form submission custom page configurations, which then executes in victims' browsers when they load the affected form view. No vendor patch has been released; the project maintainers were notified via Gitee issue IK5RJD but have not responded.
Stored cross-site scripting in linlinjava litemall versions 1.4.0 through 1.8.0 allows a high-privileged attacker to inject malicious scripts via the `detail` argument processed by `AdminGoodsService.validate` in the Product Detail admin component. Exploitation requires admin-level credentials to write the payload and passive interaction from a second user viewing the poisoned product detail page. No public exploit has been identified at time of analysis, and the project maintainer has not responded to the responsible disclosure issue filed on Gitee.
Stored cross-site scripting in linlinjava litemall's admin topic management panel allows a high-privileged attacker to inject malicious scripts via the AdminTopicController.validate function, which are then executed in the browsers of other users who view the affected topic page. Versions 1.5.0 through 1.8.0 are affected. No vendor patch is available; the project has not responded to the responsible disclosure filed in Gitee issue IK5SUU. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stack buffer overflow in alsa-lib through 1.2.16.1 allows local low-privilege attackers to crash any process consuming ALSA control-element identifiers by supplying a name= field of 64 or more characters via saved state files or command-line arguments. The off-by-one condition in __snd_ctl_ascii_elem_id_parse() (ctlparse.c:216-241) writes one byte past a 64-byte stack buffer, corrupting adjacent stack memory and causing process termination. No public exploit is identified at time of analysis; modern stack-canary mitigations further limit exploitation beyond DoS.