Open redirect in Cotonti through 1.0.0 lets remote, unauthenticated attackers bounce victims to arbitrary attacker-controlled sites by supplying a hostname that merely begins with the legitimate site domain, defeating the cot_url_check() validation used by the ratings plugin and other redirect callers. Exploitation is constrained by required victim interaction - a user must follow a crafted link through a reachable redirect caller such as plugins/ratings/ratings.ajax.php - and yields only redirection to an attacker host, not code execution or data compromise, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N vector (CVSS 4.0 base 5.3). This is a low-severity, internally consistent issue with no public exploit identified at time of analysis; there is no evidence of active exploitation or KEV listing.
Log injection in IBM WebSphere Application Server 9.0 and 8.5 lets remote, unauthenticated attackers corrupt server log content by supplying a crafted LTPA token cookie that the application writes to its logs without neutralizing control characters. The impact is limited to integrity (CVSS 3.1 base score 3.7, I:L) with no confidentiality or availability loss and no code execution, and exploitation is rated high complexity because the injected content must survive into the log in a form a human or downstream log consumer then misinterprets. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; a vendor patch is available per the IBM advisory.
HCL BigFix Service Management exposes internal IP addresses through its own HTTP responses - response headers, error messages, or rendered page content - allowing anyone able to reach the instance to harvest RFC1918 addressing and infer the internal network topology behind it. The consequence is reconnaissance only: no data modification, no service disruption, and a low vendor base score of 3.1, making this a low-priority item rather than an urgent one. No public exploit code was identified at time of analysis and there is no KEV or EPSS signal in the supplied data. The vendor vector specifies PR:L (a valid session) while the description claims an unauthenticated attacker, so authentication requirements are not confirmed from available data; the vendor's AC:H also implies an additional non-trivial condition or timing is needed to elicit the leak.
Cross-site request forgery in the Cotonti CMS contact plugin (through version 1.0.0) lets an attacker auto-submit the contact form from an attacker-controlled page, sending forged messages into the administrator inbox that appear to originate from a logged-in victim (CWE-352, CVSS 4.0 base 5.3 / assessed CVSS 3.1 5.3). The submission handler never validates an anti-CSRF token, so any authenticated user who visits a malicious page while their session is active can be silently impersonated. Exploitation requires victim interaction and an enabled contact plugin, and the impact is limited to message forgery and inbox spam - no data disclosure or system compromise; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Cotonti through 1.0.0 allows unauthenticated remote attackers to forge rating submissions on behalf of an authenticated user when the ratings plugin is enabled. The attacker must lure a logged-in user with rating privileges to a malicious page that auto-submits a POST to the ratings AJAX handler, modifying stored rating data without the victim’s intent. A vendor patch is indicated and an upstream fix exists in GitHub PR 1900, but no public exploit was identified at time of analysis.
Missing integrity verification in spatie Scotty's self-update handler (SelfUpdater::update in app/Updater/SelfUpdater.php) allows a tampered release artifact to be downloaded and installed as the running application in versions up to and including 1.4.2. Because the updater fetches the phar without validating a signature or hash, an attacker who can substitute the distributed artifact - for example through a compromised GitHub release or maintainer credential, a malicious mirror, or interception of the download - gains execution of arbitrary PHP within the Scotty process once an operator triggers the self-update; CVSS 4.0 lists PR:N (unauthenticated) with UI:P, so user interaction is required but no prior authentication is. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-supplied CVSS 4.0 base score is 5.3, while our independent assessment rates it higher under CVSS 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) because of the high integrity and confidentiality impact of replacing the application binary.
Server-side request forgery in ArcadeDB versions before 26.9.1 allows an authenticated user to bypass the built-in SSRF guard by supplying hostnames that resolve to IPv6 transition addresses (NAT64, 6to4, or Teredo) which embed RFC 1918 or loopback IPv4 targets, causing IMPORT DATABASE and server commands to fetch internal-only resources on the attacker's behalf. Exploitation requires valid credentials and permission to invoke the URL-fetching command, and meaningful impact depends on reachable internal services - most notably a cloud instance metadata endpoint such as 169.254.169.254 - being network-accessible from the ArcadeDB host; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reflects low confidentiality and integrity impact with a scope change and no availability impact. No public exploit identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the vendor advisory notes that patches are available, making this a medium-priority credentialed issue rather than an urgent one.
An authenticated, low-privilege ArcadeDB user can bypass per-type record ACLs and durably append graph edges to protected vertex types in versions before 26.9.1. The flaw is an incomplete fix of GHSA-c23x-pqcj-7hfm: the authenticated principal is bound only on the HTTP handler thread, while the async worker threads used by the parallel edge-connect phase of POST /api/v1/batch/{database} carry no current user, so LocalDatabase.checkPermissionsOnFile returns early and the CREATE_RECORD/UPDATE_RECORD checks on the target vertex type are never enforced. The attacker must already hold CREATE_RECORD on some edge type and submit an edge-load batch with parallelFlush left at its default of true; setting parallelFlush=false causes the request to be correctly rejected. Impact is confined to integrity of graph adjacency - no protected data is read and there is no denial of service - and no public exploit identified at time of analysis; a vendor patch is available in 26.9.1.
Unauthenticated remote attackers can query the Desktop API in Synology DiskStation Manager (DSM) to retrieve non-sensitive information, affecting DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and while no public exploit code or active exploitation has been identified at time of analysis, the flaw still offers reconnaissance value because no authentication or user interaction is required. Given the limited confidentiality impact and lack of integrity or availability effects, this is a low-priority issue, with risk primarily determined by whether the DSM management interface is internet-facing.
Improper encoding and escaping of output in the Auth API of Synology DiskStation Manager (DSM) lets remote, unauthenticated attackers retrieve information the vendor classifies as non-sensitive, affecting deployments before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4, and 7.4-90075. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) confirms exploitation needs no credentials, no user interaction, and no non-default configuration, so the only meaningful barrier is impact rather than access. There is no public exploit identified at time of analysis and no KEV listing, and because disclosure is limited to non-sensitive information, the practical value to an attacker is reconnaissance and fingerprinting rather than direct compromise; vendor-released patches exist in the fixed DSM builds published under Synology advisory SA_26_13.
Plaintext third-party AI provider API keys can be extracted from any WordPress site running the GPTranslate - Multilingual AI Translation Agent plugin at version 2.34.6 or earlier, because the plugin emits the stored credential into a public front-end JavaScript asset loaded by enqueue_frontend_scripts. The exposure is unauthenticated and requires no user interaction - an attacker only needs to fetch any public page and apply the inverse transformation that is itself bundled in the plugin's own public JavaScript to recover the key in cleartext (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3 Medium as published; our assessment raises the confidentiality component to High given that a raw billing-capable credential is disclosed, yielding 7.5). Keys for OpenAI, DeepL, xAI/Grok, Gemini, Claude, and Google Cloud Translation are all affected, and the default configuration (gpt-3.5-turbo in client mode) is vulnerable; only deepseek-* models and gpt-* models running in server-proxy mode correctly suppress key emission. No public exploit code was identified at time of analysis and the vulnerability is not listed in CISA KEV, though the recovery technique is trivially derivable from the plugin's own shipped assets, so treat exploitation as plausible and rotate credentials.
Unauthenticated arbitrary shortcode execution in the Divi theme for WordPress (all versions up to and including 5.11.1) allows remote attackers to invoke any registered shortcode by supplying an unvalidated value to do_shortcode through an action endpoint that lacks a proper authorization check (CWE-862). Rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the confirmed impact is integrity-only: no confidentiality or availability loss and no code execution is claimed. When the non-default 'Force Enable D4 Shortcode Framework' option is enabled, attackers can additionally abuse the et_pb_contact_form shortcode to send email to an attacker-chosen recipient with attacker-controlled content; sites without that option still permit arbitrary shortcode execution but not this specific email vector. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine but moderate-severity weakness rather than an actively exploited one.
Stored cross-site scripting in Aureus ERP through 1.6.0 lets an authenticated user who holds the payment-term create permission (create_account_payment::term) persist arbitrary JavaScript in the Payment Term note field of the Accounting plugin, which then executes in the browser of any other user who opens that Payment Term record. Exploitation requires a privileged account plus a victim opening the affected infolist view (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, assessed base 5.1 under CVSS 4.0), so impact is bounded by that privilege gate and the required user interaction; there is no public exploit identified at time of analysis and no CISA KEV listing. An upstream fix exists as GitHub pull request #1562, which sanitizes the note field, but no tagged patched release is confirmed in the provided data.
Cotonti CMS (often branded simply as Cotonti) through version 1.0.0 stores page bodies beginning with the `redir:` prefix as redirects without validating the destination, letting an authenticated user who can create or edit pages point visitors from a trusted Cotonti-hosted page to an arbitrary external site for phishing. Exploitation requires a valid account holding page creation or edit permissions (CVSS vector PR:L) and depends on a victim opening the crafted page (UI:P), with impact limited to redirecting visitors - no server-side code execution or data compromise is possible. There is no indication of active exploitation in the wild and no public exploit code identified at time of analysis; EPSS and KEV data were not provided. The vendor/upstream fix is PR #1901, which adds a `cot_url_check` guard rejecting external `http`/`ftp` destinations.
Stored cross-site scripting in SveltyCMS 0.0.6 allows an authenticated user who can upload media to plant a malicious SVG that executes in the browser of anyone who later views it. The flaw sits in src/utils/media/media-service.server.ts, where the large-file/streaming upload path bypassed the sanitizeSvg / bufferAndSanitizeSvg routine and the MAX_SVG_BYTES size cap, so unsanitized SVG markup reaches storage and is served back to victims; the supplied vector (AV:N/PR:L/UI:P) confirms exploitation requires a media-upload-capable account and victim interaction, and no public exploit code or confirmed active exploitation was identified at time of analysis. Scored 5.1 in CVSS 4.0 terms, this is a moderate-severity stored XSS confined to SveltyCMS 0.0.6 prior to the referenced fix commit.
Stored cross-site scripting in the profile management functionality of T-Systems' TAO 2.0 suite lets an authenticated user plant malicious HTML or JavaScript inside their own personal-data fields, which is then persisted unsanitised and rendered to whoever views that profile - including administrative staff. Because the payload executes in the viewer's browser under their own session context, the attacker can read session-available information and perform actions with the victim's permissions; server-side data remains out of scope per the assessed vector (S:C with C:L/I:L only on the subsequent system). Exploitation requires a valid TAO 2.0 account with permission to edit profile fields (PR:L) plus a second party actually opening the tainted profile (UI:P), so it is a real but modest-priority issue rather than a self-propagating or unauthenticated attack, and no public exploit code or active exploitation is identified at time of analysis.
Unauthenticated tenants can read other organizations' uploaded files in CordysCRM (1Panel-dev) versions prior to 1.7.4, because the Shiro-configured anonymous routes /attachment/preview/{id} and /pic/preview/{id} resolve attachments through AttachmentService.getResource with a bare primary-key lookup and no ownership, organization, or permission check. Exploitation requires the attacker to know, guess, or observe a valid IDGenerator.nextStr file id; the ids are not sequentially predictable, which raises attack complexity, but ids leaked through shared preview links, logs, or browser history permit direct retrieval. The issue is read-only disclosure of stored files and is fixed in 1.7.4; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis. This is a genuine unauthenticated broken-access-control (IDOR) flaw but a moderate real-world priority, not a critical emergency.
Cross-tenant data exposure in HCL BigFix Service Management allows an authenticated user with a valid account in one tenant to read restricted data elements belonging to other tenants because of improper access controls. Affected deployments are those operated in shared or multi-tenant mode; the impact is limited to confidentiality (unauthorized viewing), with no modification or disruption of data, and no user interaction is required on the victim's side (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, base 5.0). Exploitation requires a legitimate authenticated foothold in at least one tenant, so this is not remotely exploitable by unauthenticated attackers, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Local information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 allows an authenticated local attacker who can enumerate other users' process arguments to read guest VM installation credentials such as rootPassword and userPassword. The credentials are passed by install_machine.py as a JSON command-line argument during VM creation, so exposure is limited to the window while an administrator's installation workflow is running and depends on the host's process-visibility policy (e.g. /proc without hidepid=2). Publicly available exploit code exists, but there is no confirmed active exploitation; the issue requires local access plus a concurrently active install and cannot be triggered remotely or unauthenticated.
Local information disclosure in the cockpit-machines package on Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 lets an unprivileged local user capture a Red Hat Subscription Management (RHSM) offline token that is passed as a command-line argument to a helper script during token validation. Rated 5.0 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N), the impact is confidentiality-only: a local account that can read other processes' metadata (for example /proc/<pid>/cmdline via ps) must catch the brief window in which a privileged operator runs the validation, and the stolen token can then be exchanged for RHSM access tokens. There is no public exploit code identified at time of analysis and no CISA KEV entry; Red Hat tracks the issue as CVE-2026-92745 (EUVD-2026-83260).
Authenticated SQL injection in the NEX-Forms - Ultimate Forms Plugin for WordPress (all versions up to and including 9.3.0) allows a user holding the plugin's 'custom-level' capability or above to inject arbitrary SQL through the 'additional_params' parameter and read sensitive data out of the underlying WordPress database. The injection sits in the plugin's records/dashboard query path, where the tainted array is forwarded from get_table_records() into get_total_records() without the operator allowlist being re-applied to the SQL sink, and no user interaction or non-default configuration is required beyond the plugin being installed. Impact is confidentiality-only - an attacker can extract data such as user records and other stored content, but cannot modify or destroy it, and no public exploit code and no confirmed active exploitation were identified at time of analysis; this is a genuine but mid-tier priority issue that is primarily constrained by the high privilege level required.
Arbitrary file read in the WordPress plugin Store Exporter (woocommerce-exporter) through version 2.8.0 allows an authenticated attacker holding shop-manager-level access or above to supply a crafted 'filename' parameter and retrieve the contents of any file readable by the web server. The traversal is confined to disclosure - there is no write, no code execution, and no path to privilege escalation beyond the account already required - and the high-privilege prerequisite (CVSS PR:H, score 4.9) keeps this a genuine but low-priority issue rather than an urgent one. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; exploitation is only reachable from the plugin's export handler by a user who already holds elevated store-management rights.
HTTP request smuggling in IBM WebSphere Application Server and WebSphere Application Server Liberty - as bundled in IBM CICS TX Advanced per the affected CPE - lets remote attackers desynchronize request framing between a front-end intermediary and the WebSphere back end, enabling request tampering or response poisoning. Exploitation requires the server to sit behind a reverse proxy, load balancer, or CDN that parses Content-Length/Transfer-Encoding framing differently than the back end; no authentication or user interaction is needed (PR:N/UI:N), but attack complexity is high (AC:H) because the attacker must find and reliably trigger a specific parser discrepancy in the real deployed chain, and a directly exposed server with no divergent front-end parser is not smuggle-able. Impact is bounded to low confidentiality and integrity with no availability effect (CVSS 3.1 base 4.8); this is a genuine but modest-severity issue rather than a top priority, and no public exploit was identified at time of analysis.
HTTP request smuggling in IBM WebSphere Application Server Liberty - the runtime bundled with IBM CICS TX Advanced 10.1 - lets remote, unauthenticated attackers desynchronize HTTP message framing between an upstream HTTP parser and the Liberty backend, so a smuggled request can be processed as if it came from the trusted front-end, with low confidentiality and integrity impact on subsequent requests sharing the connection. Exploitation requires a multi-tier topology (reverse proxy, load balancer, or CDN in front of or behind Liberty) where the two parsers disagree on Content-Length/Transfer-Encoding or chunked framing, and is rated high complexity because the specific parsing gap must be discovered and precisely crafted while connection reuse must be achievable; no user interaction is required. Risk is moderate and consistent with the vendor CVSS of 4.8 (Medium); no public exploit identified at time of analysis, and patch is available from the vendor.
HTTP request smuggling (CWE-444) in IBM WebSphere Application Server 8.5, 9.0, and Liberty lets an authenticated, low-privileged remote attacker desynchronize HTTP request framing between WebSphere and an intermediary so that one user's request boundaries are misattributed on a shared connection. The issue only manifests when WebSphere sits behind or in front of a second HTTP parser (reverse proxy, load balancer, or CDN) that disagrees with WebSphere on Content-Length versus Transfer-Encoding chunked handling; a standalone WebSphere instance with no fronting or backend HTTP hop is not affected, and the 4.2 score reflects high attack complexity, partial confidentiality and integrity impact, and no availability or scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available per IBM's advisory.
Memory resource limits configured for ImageMagick are not enforced by the PCD coder (and, per the upstream advisory, the CUBE and HALD coders) when a specific command-line option is supplied, so a local user who can control ImageMagick invocation arguments can push the process past its intended policy limit and cause additional memory allocation. Impact is confined to limited availability degradation - no code execution, no data exposure, no integrity change - and the path is local-only with low privileges required (AV:L/PR:L in the assessed vector). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the issue is rated low priority; vendor fixes 7.1.2-31 (7.x) and 6.9.13-56 (6.x) are available, and environments that invoke ImageMagick with fixed, non-user-controlled arguments are not exposed.
Arbitrary file read in NetBackup Flex OS (versions before 6.4) lets an authenticated user who can reach the appliance's management shell read files outside the intended scope - including sensitive system configuration and credential material - by supplying a specially crafted path argument to a diagnostic command. The issue carries a CVSS 4.0 base score of 4.8 and is classified as CWE-347 (improper verification of cryptographic signature), with the advisory's associated tags pointing to an information-disclosure / JWT-style attack path. Exploitation requires valid management-shell credentials and local access to the appliance, so it is not reachable over the network without an existing account; no public exploit code has been identified at time of analysis, the CVE is not listed in CISA KEV, and vendor patches are available.
Cross-site scripting in the Synology DiskStation Manager (DSM) Theme API lets a remote attacker who already holds DSM administrator privileges inject script that executes in another DSM user's authenticated session, enabling limited file read and write through that session. Exploitation requires the privileged attacker to inject the payload and a separate victim to interact with the affected web page (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, base score 4.8); the scope change reflects that the injected script can act outside the attacker's own session, but the confidentiality and integrity impact remain limited. Only DSM builds prior to 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 are affected, and there is no public exploit identified at time of analysis. This is a low-priority, defense-in-depth issue rather than an urgent one, since the attacker must already be an administrator before the flaw grants anything.
ICMPv6 error generation in Zephyr RTOS 1.14.0 through 4.4.1 omits two of the three RFC 4443 §2.4 suppression rules, letting an attacker on the same IPv6 link turn a single spoofed packet into link-wide traffic reflection. Because an unrecognized next-header packet sent to ff02::1 with a spoofed source causes every node on the link to answer the victim, the flaw acts as a reflector whose amplification factor equals the number of listening nodes; alternatively, a unicast packet with a multicast source address makes the node emit its ICMPv6 error straight to that multicast group, flooding the link. Impact is limited to availability degradation of the shared link and the reflection victim plus source-address obfuscation for the attacker (CVSS 4.7, AV:A/PR:N, scope-changed, availability-only), with no memory-safety or data-exposure consequence; no public exploit identified at time of analysis.
Stored cross-site scripting in the WordPress plugin CSS & JavaScript Toolbox (all versions up to and including 12.0.6) lets an authenticated user with Administrator-level access persist arbitrary JavaScript through the plugin's Assignment Engine fields - Expressions, URLs, and Advanced assignment data - which is later executed when an administrator opens the CJT block edit screen in wp-admin. Because the injection prerequisite is already Administrator-level access, and an Administrator can legitimately place script and CSS content through this plugin's intended functionality, the marginal impact is small, making this a low-priority issue despite the stored XSS classification. No public exploit code has been identified at time of analysis, and the flaw maps to CWE-79 (improper neutralization of input during web page generation).
Policy evasion in Zscaler Internet Access File Type Control can allow a file to be improperly evaluated or attributed, potentially bypassing file-type enforcement in rare circumstances. The issue affects organizations using ZIA with File Type Control actively enforcing policies and requires a malicious file transfer through the ZIA tenant, low privileges (PR:L), and user interaction (UI:R). Impact is limited to low confidentiality/integrity policy-control evasion with no availability impact or code execution; no public exploit identified at time of analysis, and vendor-managed remediation is applied centrally by Zscaler.
WordPress sites running the WP Easy Pay - Payment and Donation Form Builder for Square plugin through version 4.5.0 allow any authenticated user, including a subscriber-level account, to force-delete arbitrary posts, pages, and custom post types (bypassing the trash) or silently revert any published post to draft status. The root cause is CWE-862 missing authorization: the plugin's action handlers in wpep-setup.php perform no capability or nonce verification before invoking destructive WordPress content operations. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, so the practical risk is moderate and concentrated on sites that permit self-service or open user registration, where a low-privilege account is trivially obtainable and no further interaction or configuration is required.
Authenticated course authors or staff holding course-import permission in Open edX Studio (CMS) can break out of the intended extraction directory by importing a crafted .tar.gz archive, because openedx/core/lib/extract_archive.py validated archive member paths with a string `startswith` comparison instead of a segment-aware containment check. The impact is limited to cross-tenant file corruption: an archive member whose path extends a sibling course staging directory's base64 name as a string prefix can be written into that neighbouring staging area, and the advisory does not establish arbitrary filesystem writes, file reads, or code execution. The flaw affects Open edX releases from Aspen.1 up to but not including Ulmo and Verawood.1, requires PR:L (authenticated) network access per the CVSS vector, scores 4.3, and there is no public exploit identified at time of analysis; while the ingested tags include an 'RCE' label, our assessment confirms that no code-execution primitive is demonstrated by the advisory.
Missing catalog-level authorization in the Kyoo self-hosted media server before 5.1.0 lets an authenticated user who holds the core.play permission read uncataloged files beneath the media directory by submitting a base64-encoded filesystem path to the transcoder API. The flaw is a CWE-639 authorization bypass through a user-controlled key, and exploitation requires both a privileged account and knowledge or successful guessing of the target path, which confines the assessed impact to low-confidentiality, read-only disclosure inside the SafePath subtree. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine but modest-severity authorization defect rather than an emergency.
Sensitive information exposure in IBM Common Licensing Agent 9.0 through 9.0.0.2 and IBM Administration and Reporting Tool (ART) 9.0 through 9.0.0.2 allows an authenticated low-privilege user to cause error messages to reveal environment, user, or associated data details. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (CVSS 4.3), so exploitation requires valid authentication, has low complexity, and yields only reconnaissance-grade confidentiality impact with no integrity or availability impact. No public exploit was identified at time of analysis, and this is a low-priority information-disclosure issue rather than an actively exploited flaw.
IBM Cognos Analytics versions 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 embed sensitive information within source code delivered to clients, allowing an authenticated user with access to that code to harvest data that can be used to mount further attacks against the system. The flaw carries a CVSS base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and requires a valid Cognos Analytics account, so exploitation is gated behind existing credentials or a foothold rather than being openly reachable; impact is limited to low confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis, and the issue has not been confirmed actively exploited (CISA KEV); vendor-released remediation is available, making this a low-priority hardening item rather than an urgent threat.
Authenticated users on the IBM TS4300 tape library management interface can degrade the appliance's email notification service by triggering requests faster than it can handle, due to missing interaction-frequency (rate) controls in firmware versions 1.1.0.1 through 1.7.1.1. The impact is confined to availability of the email/alerting subsystem (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L); the data path, stored data, and integrity are unaffected, and valid credentials are a hard prerequisite. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a low-priority, patch-available hardening issue.
LatePoint, a WordPress appointment booking and scheduling plugin, allows remote attackers to enumerate and read arbitrary customer records through the plugin's step-handling endpoint because the customer[id] parameter is trusted without any ownership or identity check (CWE-639). All versions up to and including 5.6.9 are affected, and the exposure is decisive only on sites configured with customer authentication disabled (guest checkout enabled), where the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N applies - unauthenticated, no user interaction, and trivially automatable by iterating integer IDs. The result is disclosure of personally identifiable information including first name, last name, email address and phone number; there is no write, code execution or denial-of-service impact, and no public exploit code has been identified at time of analysis. Sites that require customers to log in before booking are not reachable through the unauthenticated path, which is the primary limiting factor on real-world exposure.
Denial of service in Apache Neethi (org.apache.neethi:neethi) before 3.2.4 allows a malicious or compromised remote policy server to stall a WS-Policy fetch indefinitely, tying up the calling thread for as long as the server keeps trickling bytes. Deployments are exposed only where an application uses Neethi to resolve a remote PolicyReference over HTTP; applications that consume locally embedded or bundled policy documents are not affected. The issue is availability-only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), rated moderate severity, and no public exploit identified at time of analysis.
File-system information disclosure in IBM WebSphere Application Server 9.0 and 8.5 lets an attacker positioned on an adjacent network segment query the FileTransfer servlet and learn details about the server's file system, such as file and directory names or paths. Per the vendor-supplied vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 4.3), the flaw is rated unauthenticated and requires no user interaction, but the adjacent-network precondition means the attacker must already sit on the same management/admin LAN or WebSphere Network Deployment segment rather than reaching the service from the open Internet, and impact is limited to low-confidentiality disclosure with no integrity or availability effect. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV; overall this is a low-priority issue, though it is notable because WebSphere is widely deployed in large enterprises.
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly validated, allowing an attacker-controlled web page to issue credentialed cross-origin requests and read or manipulate protected resources and restricted APIs using an already-authenticated victim's session. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, base 3.1) confirms the attacker needs no account on the application, but the attack only succeeds against a victim who is currently logged in to BigFix Service Management and is lured into visiting the malicious page in the same browser, which is why it is rated high complexity (AC:H). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; combined with the niche deployment of this HCL ITSM module, the practical risk is low, with limited integrity impact and no confirmed confidentiality impact in the published scoring (our internal assessment scopes confidentiality slightly higher, at low).
An out-of-bounds read in Zephyr RTOS's gPTP (IEEE 802.1AS) announce-qualification routine lets an unauthenticated attacker with layer-2 adjacency to a vulnerable device send a single crafted Announce frame that drives the stack about 2 KB past the end of the received network buffer, potentially faulting the networking RX thread and causing a denial of service. The flaw affects only builds that enable the opt-in, experimental CONFIG_NET_GPTP option used in TSN/AVB deployments (Zephyr 1.13.0 up to before 4.4.2 per EUVD); default configurations are not vulnerable, and because gPTP frames go to a non-routed link-local multicast address, internet or routed exploitation is not possible. The impact is bounded by the assessed CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, and no public exploit has been identified at time of analysis.
Server-side request forgery in the PersonMail API of Synology DiskStation Manager (DSM) allows an authenticated low-privilege user to coerce the appliance into making arbitrary requests, potentially retrieving non-sensitive information from internal or external endpoints. The flaw affects DSM versions before 7.2.1-69057-10, 7.2.2-72806-7, and 7.3.2-86009-2, and carries a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis, and the vendor rates the confidentiality impact as limited to non-sensitive data with no integrity or availability effect.
Path traversal in the Audio API of Synology DiskStation Manager (DSM) allows remote authenticated users to read files outside the intended directory, though the vendor explicitly scopes the exposed content as non-sensitive information. Affected are DSM installations before 7.2.1-69057-10, before 7.2.2-72806-7, and before 7.3.2-86009-2; the flaw is network-reachable (AV:N) but requires a valid DSM account (PR:L) and needs no user interaction, and it carries no write or availability impact (CVSS 3.1 base 4.3). There is no public exploit identified at time of analysis, and the combination of the authentication prerequisite with the non-sensitive nature of the disclosed data keeps realistic risk low.
Integer overflow in the File Operation component of Synology DiskStation Manager (DSM) allows remote authenticated users to trigger a limited denial-of-service condition against affected NAS appliances. Only systems running DSM versions prior to 7.2.1-69057-10, 7.2.2-72806-7, or 7.3.2-86009-2 are affected; the vulnerability requires a valid DSM account with rights to invoke File Operation, matching the CVSS vector's PR:L (authenticated) rating. Impact is confined to low availability loss with no confidentiality or integrity effect, no public exploit code has been identified at time of analysis, and EPSS/KEV data do not indicate active exploitation, making this a low-priority issue despite the network attack vector.
Insecure Direct Object Reference in the LatePoint calendar booking plugin for WordPress (all versions up to and including 5.6.3) lets an authenticated LatePoint Agent-level user - or anyone with a higher role - read bookings and customer PII belonging to other agents and delete arbitrary bookings simply by supplying any booking ID, because the booking key is user-controlled and never checked against the caller's ownership. The CVSS vector (PR:L) confirms authentication is required, and the flaw is only reachable when an administrator has explicitly turned on the plugin's Abilities API toggles (latepoint_abilities_api plus latepoint_abilities_api_delete and/or latepoint_abilities_api_edit), which are not enabled by default and therefore substantially limit real-world exposure. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); independent assessment rates this as a real but modestly-scoped, low-to-moderate priority issue affecting confidentiality and integrity within the agent population.
Authorization bypass in the WordPress plugin Magazine Blocks (Blog Designer, Magazine & Newspaper Website Builder) through version 1.8.6 lets any authenticated user with Contributor-level access or above demote administrator-authored Site Builder templates - header, footer, front page, single, archive, 404 and search - to draft status and substitute their own block content, which is then rendered site-wide. The result is site defacement, phishing content injection and SEO spam on affected sites, with no user interaction required and no non-default configuration beyond having the plugin active and admin-authored templates present to overwrite. Exploitation requires a valid Contributor account (CVSS vector PR:L), so the practical exposure is limited to sites that grant contributor privileges, but the issue is real and should be patched; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) matches a modest-priority hardening fix rather than an emergency.
Authorization bypass in the Filter Gallery plugin for WordPress (versions up to and including 1.1.4) lets any authenticated user with subscriber-level access or higher rewrite the title and content of arbitrary posts, write the _wp_attachment_image_alt meta key on arbitrary posts, and create or overwrite arbitrary ufg_gallery_* options. The flaw is a missing capability/nonce check in the plugin's AJAX-style handlers (CWE-862), so no user interaction and no non-default configuration are required beyond the plugin being installed and active; the practical prerequisite is a low-privilege account, which is trivial on sites with open registration but a real barrier where self-registration is disabled. Impact is integrity-only - no confidentiality or availability loss and no code execution - and no public exploit code has been identified at time of analysis.
Missing authorization checks in the Foxtool All-in-One plugin for WordPress (all versions up to and including 2.5.3) allow any authenticated subscriber-level user to modify arbitrary subkeys of the plugin's foxtool_settings option, including the media-up3 toggle that enables site-wide SVG uploads - a change that can be chained into stored cross-site scripting through a malicious SVG file rendered by a victim. The settings modification itself is unauthenticated only in the sense that no additional user interaction is required once a low-privileged account exists; exploitation therefore matters mainly on sites with open registration or untrusted subscriber accounts. Real-world risk is moderate-to-low: the direct impact is a limited integrity violation (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the XSS escalation is conditional on a second step, and no public exploit code or active exploitation was identified at time of analysis.
An authenticated user on a Nextcloud instance running the Deck app can set board-scoped configuration keys for arbitrary board IDs via the Deck config API, because the endpoint does not verify that the caller owns or has manage permission on the referenced board. Only Deck 1.16.0 through 1.18.0 are affected, and the impact is confined to configuration integrity of the targeted board - there is no data disclosure or availability loss - making this a low-to-moderate priority authorization flaw rather than a high-urgency issue. Exploitation requires a valid account on the instance (the assessed vector is PR:L, i.e. authenticated, with no user interaction), and the attacker must know or enumerate target board IDs; no public exploit code has been identified at time of analysis.