Confused deputy exploitation in hawtio-operator on OpenShift allows a namespace-scoped edit user to claim arbitrary externally-routable Route hostnames that would normally require elevated cluster permissions. The operator holds a cluster-wide `routes/custom-host:create` privilege and blindly propagates the tenant-controlled `spec.routeHostName` field from Hawtio custom resources into OpenShift Route specs without validating whether the requesting user is authorized to claim that hostname. The captured subdomain can then be combined with the cluster's auto-grant OAuthClient to hijack OAuth redirect flows and steal tokens from legitimate users (PR:L, UI:R, C:H, CVSS 6.3). No public exploit code has been identified at time of analysis.
Information disclosure in Oracle Coherence 15.1.1.0.0 lets a low-privileged attacker with HTTP network access read critical data or the entire contents of Coherence-accessible caches, and because the CVSS vector reports a scope change, products built on top of that grid can be exposed as well. Oracle scores it 6.3 with high attack complexity, so it is not a trivial drive-by exploit; the feed contains no public exploit code and no CISA KEV entry, and the only remediation reference is Oracle's Critical Security Patch Update advisory. Authentication is required per the PR:L metric, meaning the attacker needs an existing low-privilege foothold rather than being an anonymous internet client.
Order access tokens in the J2Store/J2Commerce extension for Joomla (versions 1.0.0-3.3.2, 4.0.0-4.0.22, and 4.1.0-4.1.7) are derived predictably, so anyone who already knows the site's Joomla `secret` value can compute a valid token for any order on the store. This grants guest-level access to that order's details and any purchased digital downloads without the attacker ever placing an order. The token is never rotated, so the exposure survives even after the original secret-disclosure bug is patched unless the Joomla `secret` itself is changed. No public exploit tooling is identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); exploitation is non-trivial because it presumes a prior foothold or disclosure of the site secret (CVSS 4.0 AC:H).
Ingress Security ACLs applied to Switched Virtual Interfaces (SVIs) in shared mode on dual-switchcard Arista EOS platforms can silently stop filtering after the secondary switchcard forwarding agent restarts or a secondary switchcard is inserted, causing packets that should be denied to be permitted (and vice versa). The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-1419 incorrect resource initialization) and only affects modular chassis configured with dual switch cards plus shared-mode SVI ingress ACLs. Arista discovered the issue internally and states it is not aware of any malicious exploitation in customer networks; no public exploit code or CISA KEV listing is associated with this CVE.
Command injection in the D-Link DSL-3782 (firmware 2016-07-28) allows authenticated network attackers to execute arbitrary operating system commands by injecting shell metacharacters into the Addr argument of the Diagnostics web interface endpoint at /cgi-bin/New_GUI/Set/Diagnostics.asp. A public proof-of-concept exploit is available on GitHub, and the device is almost certainly end-of-life with no patch forthcoming from D-Link. The provided CVSS 4.0 score of 2.1 significantly understates the true impact, as command injection on embedded routers typically yields full root-level OS control of the device.
Tornado 6.5.5 through 6.5.7 allows attackers to inject arbitrary Set-Cookie attributes because the fix for CVE-2026-35536 only validated the documented lowercase keyword arguments (name/domain/path/samesite). The deprecated and still-live **kwargs path in RequestHandler.set_cookie writes values straight into the Morsel without character validation, and because Morsel.__setitem__ is case-insensitive, a capitalized kwarg such as Domain=, Path=, SameSite= or Max-Age= routes to the same reserved attribute while bypassing the filter. Any application that passes attacker-influenced data into a capitalized/legacy kwarg can be made to emit cookies with attacker-controlled Domain, Path, Secure, HttpOnly or SameSite directives; no public exploit code or CISA KEV entry has been identified at time of analysis.
Payara Server ships by default without any cap on failed authentication attempts, so its administrative console and application login endpoints can be hammered with unlimited password guesses. The issue is a classic missing-lockout / missing-rate-limit weakness (CWE-307) affecting Payara Server Enterprise 4.x, 5.x, 6.x and 7.x plus the Payara Server Community 7 line, with fixes published in releases 4.1.2.191.57, 5.89.0, 6.40.0, 7.2.0 and Community 7.2026.7. With a vendor CVSS of 6.3 (4.0 vector AV:A/AC:L/PR:N/UI:N, VC:L/SC:H), success depends on the operator enabling the bundled automatic attack protection; no public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided.
A permission bypass in Google Android stemming from a side-channel information disclosure (CWE-203) allows a local attacker holding only low-privileged code execution to escalate privileges without any user interaction. The flaw yields high confidentiality impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N) by leaking observable discrepancies that undermine permission enforcement, though the vendor vector records no integrity or availability impact. It is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis.
An out-of-bounds read in the Pixel-specific physmem_extmem driver (physmem_extmem_linux.c) of the Android kernel lets a local process with low privileges read kernel memory that was never initialized, exposing potentially sensitive data. No user interaction or elevated execution privileges are required, and the impact is limited to confidentiality (CVSS 5.5, AV:L/PR:L/C:H). The issue is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified at the time of analysis.
An out-of-bounds read in ReadDataElement (common.c) within the Android platform allows a locally installed application to disclose sensitive memory contents without any additional execution privileges or user interaction. The flaw is a missing/incorrect bounds check on an attacker-influenced length or index value, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, C:H/I:N/A:N), so the practical impact is confidentiality loss rather than code execution. Affected builds are Android platform components referenced by the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is absent from the supplied data.
Memory corruption in GPAC's scenegraph node management routine `gf_node_list_insert_child` (in `scenegraph/base_scenegraph.c`) can be triggered by a remote attacker delivering a crafted MPEG-4/BIFS scene file, causing a process crash (DoS). A publicly available proof-of-concept exploit (`poc_18_nstatx.zip`) is distributed via GitHub, lowering the exploitation bar. All GPAC releases up to commit f1219cde are affected; version abi-16.23 resolves the issue. No confirmed active exploitation campaign (not in CISA KEV) has been identified at time of analysis.
Heap-based buffer overflow in GPAC's MPEG Video Reframer filter exposes users of versions up to commit f1219cde to memory corruption when processing a malformed MPEG video file. The vulnerable function mpgviddmx_process() in filters/reframe_mpgvid.c previously relied on gf_assert() to validate MPEG start codes without first confirming the buffer contains at least 3 bytes, enabling heap corruption on crafted input. A proof-of-concept exploit has been publicly disclosed via GitHub; no CISA KEV listing or confirmed active exploitation exists at time of analysis.
A resource-exhaustion (denial of service) flaw in vLLM's OpenAI-compatible /v1/chat/completions endpoint lets a caller- or model-supplied Jinja chat_template drive nested range() loops whose evaluation cost grows as O(N^depth), tying up a request-runtime worker thread for tens of seconds. vLLM releases up to and including 0.27.1 are affected (EUVD lists 0.27.0 and 0.27.1), with the CPE range expressed as vllm-project:vllm:* so earlier releases are plausibly in scope too. Publicly available exploit code exists, and CVSS 4.0 rates the issue only 2.1 with availability impact rated Low; a fix PR that introduces a minijinja evaluation 'fuel' budget is still awaiting acceptance.
Use-after-free in GPAC's scenegraph node handling allows a remote attacker to trigger memory corruption by delivering a crafted media file that is processed by the affected application. The vulnerability exists in `gf_node_get_name_and_id()` in `scenegraph/base_scenegraph.c`, where a node pointer could be dereferenced after being freed due to missing null/reference-count guards in the BIFS decoder's command assignment path. Exploitation requires user interaction (opening a malicious file), a publicly available proof-of-concept exists (poc_16_bt.zip), and no confirmed active exploitation is recorded in CISA KEV.
Stored/reflected cross-site scripting in code-projects Record Management System 1.0 allows an attacker to inject JavaScript through the 'desc' parameter processed by main/reg.php, which then executes in the browser of any user viewing the affected page. The flaw is remotely reachable without authentication, though it does require a victim to interact with the poisoned page or field. Publicly available exploit code exists (a GitHub write-up demonstrating the payload), but the issue is not listed in CISA KEV and no EPSS signal was supplied, so exploitation in the wild has not been confirmed. The CVSS 4.0 base score of 5.3 is moderate; the practical impact is limited to session theft, credential phishing, or defacement within the deployed instance rather than server compromise.
Unrestricted file upload in WuzhiCMS 4.0 and 4.1.0 allows an authenticated user to upload arbitrary files through the avatar upload handler (member::setAvatar at /index.php?m=member&f=user&v=setAvatar), which can lead to remote code execution if the uploaded file is a server-executable script placed in a web-accessible directory. The vendor was notified via a public issue report but has not responded, so no official fix exists. Public exploit code is available (GitHub issue 219), though the flaw is not listed in CISA KEV, so active exploitation is unconfirmed.
Oracle Contract Lifecycle Management for Public Sector — specifically the Wage Determination Online component of Oracle E-Business Suite 12.2.3 through 12.2.15 — can be abused by an unauthenticated, network-based attacker who persuades another user to interact with a crafted HTTP request, yielding unauthorized read plus update/insert/delete access to module data. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and the scope-change metric indicates the compromise may significantly impact additional products beyond the vulnerable module. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this reads as a patch-cycle priority rather than an emergency.
Unauthenticated attackers who can reach the Oracle Agile PLM Web Client over HTTP can read and tamper with a limited subset of PLM data, but only if they first persuade another user to interact with a crafted request. Oracle rates this 6.1 (medium) with a scope change, meaning a successful attack may also affect additional products reachable through the same component. No public exploit code, POC, or CISA KEV entry was identified in the supplied intelligence for this CVE.
Unrestricted file upload in SourceCodester Online Faculty Clearance System 1.0 allows authenticated remote attackers to upload arbitrary files - including PHP webshells - via the profile picture upload endpoint at production/edit_picture.php, leading to remote code execution on the host server. The vulnerability stems from PHP's move_uploaded_file() being called without validating file type or extension. A public proof-of-concept exploit exists (GitHub issue linked from VulDB). No KEV listing; EPSS data not provided in source intelligence.
Unrestricted file upload in SourceCodester College Notes Gallery Management System 1.0 allows an authenticated remote attacker to upload arbitrary file types through the profile image parameter at /dashboard/userprofile.php. Because the application is PHP-based, this flaw (CWE-434) creates a realistic path to remote code execution if a PHP webshell is uploaded to a web-accessible directory. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation. No active exploitation (CISA KEV) has been reported, and the affected product is a small educational PHP application with limited production footprint.
Improper access control in PHPGurukul Hostel Management System 3.0 allows an attacker to bypass authorization checks in the admin login handler /admin/includes/checklogin.php by manipulating the ID parameter, granting unauthorized access to administrative functionality. Exploitation is remotely reachable and publicly available exploit code exists (tracked via a GitHub PoC issue and VulDB entry), though the per-component impact is limited to low confidentiality, integrity and availability loss. EPSS/KEV signals are absent from the provided data, and the published CVSS 4.0 base metrics (AV:N/AC:L/PR:L/UI:N, all impacts Low) indicate a modest real-world risk rather than mass-exploitation potential.
Oracle VM VirtualBox 7.2.16 contains a Core-component flaw that lets an attacker who already has a logon on the host crash the hypervisor (complete denial of service) and make limited unauthorized modifications to VirtualBox-accessible data, provided they can induce a victim to perform a user action. The issue is local rather than network-reachable, requires no special privileges beyond an interactive session on the machine where VirtualBox runs, and is rated 6.1 on the CVSS 3.1 scale (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H). No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, but the integrity-plus-availability impact and the trivially low attack complexity make prompt patching worthwhile.
Cross-site scripting in the Trufflebox UI (trufflebox-ui) of BharatMLStack up to and including v1.3.0 allows injected script to run in a logged-in operator's browser when the affected GenericNumerixTable.jsx table view renders unsanitized data. Impact is confined to the victim's browser session - limited confidentiality and integrity (C:L/I:L) with no server-side code execution or availability impact (A:N) - and exploitation requires user interaction, meaning an operator must load the poisoned table view. Authentication requirements are not fully settled: the published vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, but the independent assessment rates it PR:L, since a stored/table-data injection path would first require authenticated write access to plant the payload. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and EPSS is 0.15% (4th percentile), indicating low real-world urgency.
A locally exploitable flaw in the Core component of Oracle VM VirtualBox 7.2.16 lets a low-privileged user who can log on to the host repeatedly crash the hypervisor process and tamper with some VirtualBox-accessible data. The issue requires only local logon with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N), no user interaction, and no network exposure, yielding a 6.1 base score driven by Availability (High) and Integrity (Low) impacts with no Confidentiality impact. There is no public exploit code identified and the CVE is not listed in CISA KEV, so current risk is concentrated in multi-user or shared-workstation deployments where untrusted users share a virtualization host.
GNOME Shell fails to validate the declared dimensions of icons returned by a remote search provider over D-Bus against the actual icon data buffer, producing an out-of-bounds read when an oversized size is supplied. A malicious or compromised search provider registered in a user's session can crash the shell — terminating the desktop session — and may leak fragments of adjacent shell memory. Rated CVSS 6.1 (AV:L/UI:R/C:L/A:H) by Red Hat; no public exploit code or CISA KEV entry was identified at time of analysis, so exploitation currently requires a locally present hostile search provider rather than remote access.
Stored cross-site scripting in PHPGurukul Daily Expense Tracker System 1.1 allows an authenticated attacker to inject malicious JavaScript via the FullName parameter handled by /dets/includes/sidebar.php. Because sidebar content is rendered for other users viewing the application, the payload executes in victims' browsers, enabling session hijacking or credential theft against other authenticated users or administrators. A public proof-of-concept is available via GitHub, though no active exploitation has been confirmed in CISA KEV.
A locally reachable denial-of-service flaw in Oracle VM VirtualBox 7.2.16 (Core component) lets an attacker who already holds a high-privileged logon on the host crash or repeatedly hang the hypervisor, taking down all hosted virtual machines. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, base 6.0) confirms the impact is availability-only and confined to already-privileged local users, but the scope-change flag indicates the resulting outage can extend to other workloads running on the same infrastructure. No EPSS score, KEV listing, or public exploit evidence was present in the supplied intelligence, so exploitation status is unknown and the flaw should be treated as a privilege-gated local availability risk rather than a remotely exploitable emergency.
Denial of service in Oracle VM VirtualBox 7.2.16 allows an attacker who already holds high privileges and can log on to the machine running the hypervisor to crash the product through its Core component, producing a hang or repeatable crash. The flaw is rated CVSS 3.1 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H), so it is purely an availability issue with no confidentiality or integrity impact, but the scope change flag means a successful attack can degrade other workloads running alongside VirtualBox — typically guest VMs and co-resident services. It is not remotely exploitable, no public exploit code or CISA KEV entry was identified at time of analysis, and the affected build is confirmed as 7.2.16 by both the vendor advisory and ENISA EUVD.
Denial of service in Oracle VM VirtualBox 7.2.16 (Core component) lets a locally logged-on attacker with high privileges hang or repeatedly crash the hypervisor, with the CVSS scope-change metric indicating the disruption can extend beyond VirtualBox to other products on the same host. Exploitation requires logon access to the infrastructure running VirtualBox and high privileges (PR:H, AV:L), so it is an insider/administrator-privileged availability attack rather than a remote one. No public exploit code has been identified and the flaw is not listed in CISA KEV; EPSS data was not supplied with this record.
Affected versions of Arista EOS can write plaintext TACACS+ shared secrets into a location an operator can read, exposing the secret that protects authentication traffic between the switch and its AAA servers. Exploitation is not remote: it requires a highly privileged local session (CVSS PR:H), a non-default/specific set of circumstances (AC:H), and a user action (UI:R), which is why the score sits at 6.3 despite high confidentiality, integrity, and availability metrics. There is no public exploit code identified and the issue is not listed in CISA KEV, so this is a hardening/credential-hygiene issue rather than an actively attacked one; note that a leaked TACACS+ secret is high-value for lateral movement across network infrastructure.
Cleartext user passwords can be written into Arista EOS log files when specialized, non-standard debugging trace levels are explicitly enabled on the device. Only operators who already hold authenticated local administrative shell access and who have turned on these unusual trace levels are exposed, and a user must actually authenticate while tracing is active for credentials to be recorded. Arista discovered the flaw internally, states it is not aware of any malicious exploitation, and no public exploit code or CISA KEV entry has been identified; vendor advisory SA-0153 documents the fix
Arista EOS switches can write plaintext private keys into log files when specialized, non-standard debugging trace levels are explicitly enabled on the device. Exploitation requires an attacker to already hold authenticated local administrative access to the device shell and to have those special debug trace levels turned on, so the practical exposure is primarily insider or post-compromise rather than remote. Arista discovered the flaw internally (SA-0153), states it is unaware of malicious exploitation in customer networks, and the issue is not listed in CISA KEV and no public exploit code has been identified.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways lets an attacker who can reach the appliance's exposed services interrupt normal operation and take the gateway's services offline, disrupting WAN connectivity for dependent sites. Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1 and 9.7.0.0, reported by HPE's own security-alert address. CVSS is 5.9 with a high attack-complexity qualifier and availability-only impact, and no public exploit code or confirmed active exploitation was identified at time of analysis.
The API endpoint exposed by HPE Networking EdgeConnect SD-WAN Gateways can be queried by an unauthenticated remote attacker in a way that returns sensitive information, with successful exploitation yielding data that could be reused to reach other network services. Affected firmware spans the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, and exploitation is rated high complexity (AC:H) even though no authentication is required. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a targeted-risk disclosure bug rather than a mass-exploitation event.
Path-traversal guard bypass in moment.js 2.29.2-2.30.1 allows a remote unauthenticated attacker (in server-side Node.js contexts) to supply a crafted non-string object to moment.locale() that satisfies the string-assuming guard via a custom match() method while its toString() returns a traversal path - delivering attacker-controlled path segments to an internal require() call. This is an incomplete fix for CVE-2022-24785 and is resolved in version 2.31.0; no public exploit has been identified at time of analysis.
DigestAuth replay protection in http4s mishandles the nonce-count it stores, so the server's counter can lag behind the highest value it has actually accepted; a passive network observer who captures one legitimate Digest Authorization header can therefore replay it repeatedly before the counter catches up. Successful replays are executed as the captured user and include state-changing requests, defeating the replay resistance that Digest authentication is supposed to provide over Basic auth. Only applications that explicitly mount the DigestAuth middleware are affected, versions 0.23.x before 0.23.35 and 1.0.0 milestones M1 through M46 are impacted, and the flaw is fixed in 0.23.35 and 1.0.0-M47. No public exploit code or active exploitation has been identified at time of analysis.
The FollowRedirect client middleware in http4s strips Authorization and Cookie headers only when a redirect crosses to a different authority, ignoring URI scheme changes; a same-host redirect from HTTPS to HTTP therefore re-sends credentials in cleartext over the network. Applications using http4s client versions prior to 0.23.35 or 1.0.0-M47 and following attacker-influenced redirects can leak bearer tokens, basic-auth credentials, and session cookies to anyone able to observe the plaintext connection. The flaw is fixed in 0.23.35 and 1.0.0-M47; no public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires the attacker to influence a redirect target and sit on the network path.
Cross-site scripting (CWE-79) in PHPGurukul Hostel Management System 3.0 lets an attacker inject script through the admin-side /admin/manage-students.php page, which is then rendered without adequate output encoding. Publicly available exploit code exists, so a working payload is already circulating against a target set that is mostly small institutional or academic deployments. The CVSS 4.0 score of 1.9 is low because the vector requires high privileges (PR:H) and user interaction (UI:P), with only a limited integrity impact and no confidentiality or availability loss recorded.
A null pointer dereference in GNU Binutils 2.47 lets a locally-supplied malformed ELF object crash the toolchain when the linker or related BFD-consuming utilities reach the elf_x86_allocate_dynrelocs() dynamic-relocation allocator in bfd/elfxx-x86.c. Only availability is impacted — the fault aborts the affected utility and no memory corruption, information disclosure, or code execution has been demonstrated, which is consistent with the CVSS 4.0 base score of 1.9 (AV:L/PR:L, VA:L only). Publicly available exploit code exists in a GitHub proof-of-concept repository linked from the NVD record, but there is no indication of active exploitation or CISA KEV listing; upgrading to Binutils 2.48 resolves the issue.
A null pointer dereference in GNU Binutils 2.47 allows a local attacker to crash affected utilities by supplying a crafted ELF file. The flaw resides in elf_x86_64_common_section_index() in bfd/elf64-x86-64.c, part of the ELF section-handling path, and only denies availability of the tool process - there is no confidentiality or integrity impact. Publicly available proof-of-concept code exists and the issue is fixed in version 2.48, but real-world risk is low given the local attack vector, minimal impact, and low EPSS-relevant severity.
A NULL pointer dereference in GNU Binutils 2.47 lets a locally-supplied, malformed ELF object crash BFD-based tools such as ld, objdump or readelf when they parse the crafted symbol tables. Only availability is affected — the process dies with a segmentation fault and there is no confidentiality or integrity impact. Publicly available exploit code exists (a PoC is published in a GitHub repository referenced from the Sourceware bug report), but there is no CISA KEV listing and no vendor patch at the time of analysis, since the project has reportedly not yet responded to the bug report.
Denial of service in GNU Binutils 2.47: running a BFD-based utility such as objdump, readelf, nm, or ld against a crafted ELF object drives execution into the .eh_frame ('Eh Frame Handler') parsing path, where _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c dereferences a NULL pointer and crashes the process. The vector is local only - a victim must be induced to process an attacker-supplied malformed binary - and the outcome is limited to availability loss of that single tool invocation, with no confidentiality or integrity impact, which is why the supplied CVSS v4.0 base is only 1.9 and EPSS sits at 0.11% (2nd percentile). Publicly available exploit code exists (referenced from the VulDB entry and a public GitHub proof-of-concept write-up), but there is no evidence of active exploitation and the issue is not in CISA KEV; CISA's SSVC framework classifies it as poc / not automatable / partial technical impact, and no vendor-released patch has appeared because the upstream bug report (sourceware bug 34446) has not yet been answered.
Denial of service in HPE Networking EdgeConnect SD-WAN Gateways lets an authenticated local attacker with low privileges destabilize the appliance operating system and disrupt traffic forwarding. Affected builds span the 9.4.x, 9.5.x, 9.6.x and 9.7.x branches — up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively — and the trigger is both local-only and high-complexity, which keeps the CVSS score at 5.8 despite the High availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, so the practical priority is patch hygiene on devices where local or delegated accounts exist.
Authenticated attackers holding Admin privileges on HPE Networking EdgeConnect SD-WAN Gateways can send a crafted request to an API endpoint and trigger a classic buffer overflow (CWE-120), potentially achieving arbitrary command execution on the appliance's underlying operating system. ENISA EUVD lists affected builds across the 9.4.x, 9.5.x, 9.6.x and 9.7.x release branches, with the HPE advisory as the sole authoritative reference. No public exploit code and no CISA KEV entry were reported at time of analysis, and the vendor's 5.5 CVSS score omits any confidentiality impact despite the description claiming full OS-level command execution.
Improper authentication in the admin Dashboard controller of PHPGurukul Blood Donor Management System 1.0 lets a remote, unauthenticated attacker reach administrative functionality by calling the controller's constructor route directly, bypassing the login/session check. Successful abuse exposes donor and blood-stock data and allows modification of records, giving low but real confidentiality, integrity and availability impact. Publicly available exploit code exists and the vendor has not published a fixed release, so every internet-facing deployment of version 1.0 should be assumed reachable by automated scanners.
Improper privilege assignment in SourceCodester College Notes Gallery Management System 1.0 allows unauthenticated remote attackers to self-assign elevated roles during account registration by manipulating the `role` parameter in signup.php. An attacker who registers with a crafted request can gain administrative access to the application without authorization. A public exploit has been disclosed, lowering the bar for exploitation significantly.
A buffer overflow in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways allows an authenticated administrator to crash or destabilize the appliance, producing a denial-of-service condition. All maintenance branches 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 are affected per ENISA EUVD tracking. The CVSS base of 5.5 with PR:H reflects that high administrative privileges are required, so this is not an unauthenticated remote outage; no public exploit code or CISA KEV listing was identified at time of analysis.
SQL injection in PHPGurukul Blood Donor Management System 1.0 lets remote attackers inject arbitrary SQL through the fromdate and todate parameters handled by /application/controllers/admin/Report.php, exposing or altering the underlying donor database. Publicly available exploit code exists and the vendor has published no fixed release, so any internet- or intranet-exposed deployment of this teaching/demo application remains vulnerable. CVSS 4.0 base is 5.5 with an exploit-maturity rating of Proof-of-Concept, indicating limited but real opportunistic risk rather than mass exploitation.
A SQL injection in SourceCodester Online Faculty Clearance System 1.0 lets remote attackers manipulate the 'haydi' argument handled by /update_requirement_status.php to inject arbitrary SQL into backend queries. The CVSS 4.0 vector reports AV:N/AC:L/PR:N/UI:N, so exploitation does not require prior authentication or user interaction, and the impact is scored as Low across confidentiality, integrity and availability. Publicly available exploit code exists (referenced via a public GitHub issue and the VULDB submission), and the vendor has published no patch - the product is a downloadable PHP demo application rather than a maintained commercial platform.
SQL injection in SourceCodester/katojkalemba Online Food Ordering System 1.0 allows remote unauthenticated attackers to manipulate the `id` parameter in `/web/order.php` to inject arbitrary SQL, achieving partial read and write access to the underlying database. The CVSS 4.0 vector carries an E:P modifier confirming public exploit code is available, lowering the barrier to exploitation significantly. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists.