Unauthenticated remote code execution in REDCap 13.3.0 and later allows an attacker who knows a valid public survey hash to reach an unintended controller route through the survey passthrough routing logic and then supply a crafted file-path/stream parameter to the Data Import processing logic, resulting in arbitrary code execution on the REDCap server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms remote, unauthenticated exploitation with no user interaction required, but the mandatory knowledge of a valid public survey hash is a meaningful prerequisite that rules out blind mass scanning and confines practical exposure to instances actively publishing public surveys. Exploitation status: no public exploit identified at time of analysis; the flaw was reported by Securifera.
Pre-authentication stack-based buffer overflow in the D-Link DIR-868L router running firmware 2.01b05 allows remote attackers to corrupt memory by sending crafted values in the id or password parameters to /webfa_authentication.cgi, potentially leading to crash or arbitrary code execution on the device. The attack requires only network reachability to the router's HTTP management interface, with no authentication or user interaction (PR:N/UI:N per both the vendor-supplied CVSS 4.0 vector and our independent CVSS 3.1 assessment). Publicly available exploit code exists - a proof-of-concept crash script (poc_crash.py) published on GitHub - but there is no confirmed actively exploited (CISA KEV) status, and the practical attack surface is limited because the web admin interface is typically LAN-only by default, with WAN-side exploitation requiring remote management to be enabled or the device to be internet-exposed; the CVSS 4.0 score of 10.0 conflicts sharply with the realistically constrained exposure and crash-only nature of the published PoC, so the finding warrants caution rather than alarm.
An unauthenticated stack-based buffer overflow in the web management interface of the Comfast CF-N1-S (firmware 2.6.0.1) allows a remote attacker to corrupt memory and potentially achieve arbitrary code execution or crash the device by sending a crafted request to the /cgi-bin/mbox-config CGI endpoint. The flaw resides in the get_css_path_from_uri function, which fails to bound-check attacker-supplied input before copying it onto the stack; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact across both the vulnerable system and subsequent systems) reflects a maximum 10.0 score, and our independent reassessment under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) likewise rates it critical. Publicly available exploit code exists (a proof-of-concept was disclosed via a public GitHub issue referenced by VulDB), though there is no confirmed active exploitation (no CISA KEV listing); practical exploitation is constrained by whether the management panel is reachable, since these devices are typically deployed behind a LAN, and reliable code execution versus a simple crash depends on the target's memory-protection configuration.
Unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension for Joomla (both the free and paid editions) below version 6.2.7 allows any anonymous visitor to inject SQL through the publicly published mod_osgallery_search search box and read arbitrary database content. The showSearchResult() and showSearchResultAjax() endpoints take the textsearch/searchText request parameter and concatenate it directly into a LIKE clause without quoting or escaping, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the accompanying CVSS:3.1 assessment (PR:N/UI:N) both confirm the attack needs no authentication, no user interaction, and no special client configuration. Impact is scoped primarily to data disclosure - the authoritative assessment scores C:H/I:L/A:N because the injection point is a SELECT's LIKE clause - and no public exploit code was identified at time of analysis; exploitation is limited to sites running an affected Gallery version that actually publish the search module. This is a genuine high-priority vulnerability, so prioritise inventory of Joomla sites with the extension and the search module enabled, and upgrade to 6.2.7 or later.
OS command injection in the D-Link R95 (BE9500) router running firmware BE9500_1.00.16 allows an attacker to execute arbitrary operating-system commands on the device by supplying a crafted NTPServer argument that the /bin/ssi binary handles on behalf of the DHMAPI component. Exploitation requires reaching and authenticating to the router's management interface (PR:H in both the CVSS 4.0 vector and our independent CVSS 3.1 assessment), so this is a post-authentication flaw that becomes dangerous when admin credentials are default, weak, or reused. Publicly available exploit code exists (a public GitHub proof-of-concept), but no CISA KEV entry confirms active exploitation; the vulnerability scores 8.5 High under CVSS 4.0, driven by full confidentiality, integrity, and availability impact on the device.
Authenticated command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows a low-privileged user of the web management interface to execute arbitrary shell commands on the device through the Traceroute Diagnostic Feature. The flaw is rooted in the 'url' argument passed to /usr/bin/network_tools, which is consumed without shell sanitization (CWE-77); because the underlying binary runs on an embedded Linux platform, successful exploitation typically yields root-level code execution, giving the attacker full control of the router (CVSS 4.0 base 8.6, AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact). Publicly available exploit code exists (a public disclosure write-up is referenced), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis. Exploitation is not confirmed as active in the wild (not listed in CISA KEV), but requires only network reachability to the management interface plus a valid low-privilege account.
Authenticated back-office users of NivoCart (through 2.4.0) holding only view-only privileges can upload and execute arbitrary PHP, turning a low-privilege admin account into full remote code execution on the hosting web server. The flaw is in the File Manager multi() upload endpoint, which skips file-extension validation whenever a new filename is supplied or the chunks parameter is set to 2 or higher, letting a .php payload land in the web-accessible image/data/ directory where it can simply be requested. Exploitation requires a valid low-privileged back-office session and no non-default configuration, there is no CISA KEV entry and no public exploit identified at time of analysis, and the available data does not name an exact fixed version, so exposure hinges on whether an attacker already holds or can obtain a view-only admin account.
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an attacker holding low-privilege credentials on the device's management interface to execute arbitrary operating-system commands by supplying a crafted ipv4 value to the LAN IP Configuration Handler in /usr/bin/network_tools. Rated CVSS 4.0 8.6 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H), the flaw yields full confidentiality, integrity and availability impact on the device and can pivot toward the surrounding network; publicly available exploit code exists, so weaponization effort is low, though no CISA KEV entry confirms active exploitation at time of analysis. Exploitation requires authenticated or at least low-privileged access to the management interface and is realistically reachable from the local network (and only from the internet if the admin interface is exposed), which materially narrows exposure compared with an unauthenticated flaw.
Authenticated code execution in the Forminator Forms WordPress plugin (before 1.57.2.1) lets a user who holds the plugin's forms-management capability abuse unrestricted class instantiation during deserialization of an XML-RPC value, ultimately writing a file of the attacker's choosing and executing arbitrary code on the server. That capability is granted to administrators by default, so sites that have not delegated it through Forminator's own settings are materially less exposed, but any lower role given forms-management can reach the flaw; exploitation also depends on a reachable XML-RPC interface and a usable PHP gadget chain, which is reflected in the high attack-complexity component of the 8.5 CVSS score (PR:L, AC:H). Publicly available exploit code exists, and a vendor patch shipping in 1.57.2.1 is available, so sites running affected versions should upgrade promptly.
Authentication bypass in the SAML Single Sign On WordPress plugin (versions 4.8.43 through <6.0.0) lets a remote, unauthenticated attacker log in as any WordPress user, including an administrator. The plugin ignores whatever account-linking criterion the administrator configured (email, NameID, etc.) and always resolves the SAML identity by login name, so an attacker who can get the site's trusted Identity Provider to assert a login name of their choosing - for example via an IdP that allows self-service registration or user-controlled username attributes, or a compromised or attacker-operated IdP - authenticates as that account without proving ownership of it. Publicly available exploit code exists, and while the CVSS vector scores the flaw at 8.1 with PR:N, the AC:H rating reflects the significant prerequisite of influencing the trusted IdP's assertions; sites whose IdP strictly controls the asserted login-name attribute are much harder to exploit.
PHP object injection in the Unlimited Elements For Elementor WordPress plugin (versions before 2.0.20) lets authenticated attackers with subscriber-level access inject arbitrary PHP objects through an AJAX action that lacks a capability check and deserializes stored data. Exploitation requires open user registration (or any low-privilege account), and full impact-such as remote code execution or file/database manipulation-depends on a usable PHP POP gadget chain being loaded by WordPress core, Elementor, or another active plugin (hence the AC:H rating). Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the 2.0.18-2.0.19 releases only partially mitigate by raising the required privilege to editor-level.
Unauthenticated comment deletion in the Tripzzy WordPress plugin (versions 1.1.8 through before 1.5.1) lets any remote attacker permanently delete arbitrary comments on an affected site with a single crafted request. The plugin's AJAX action is registered for unauthenticated users by design but performs neither an authorization/capability check nor validation of the comment identifier being removed, so it is a textbook missing-authorization plus IDOR weakness (CWE-284, CVSS 3.1 7.5 HIGH, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Publicly available exploit code exists, but the impact is bounded: exploitation only yields permanent integrity/data loss of comment content, with no code execution, privilege escalation, or data exfiltration, and the vendor has shipped a fix in version 1.5.1.
Unauthenticated attackers on the local network can bypass authentication and gain full control of D-Link DIR-X1860 and DIR-X1860Z routers (firmware up to 1.0.2.220120.165402) by manipulating the passwd_set argument in the /ubus interface of the routerd component. Publicly available exploit code exists, and the vulnerability has a CVSS 4.0 score of 7.4, though it is not confirmed as actively exploited (no KEV).
Arbitrary file write - escalating to remote code execution on hosts that execute PHP from upload directories - affects the WordPress plugin Photo Gallery, Sliders, Proofing and Themes in all versions before 4.5.0. The flaw sits in the archive-extraction routine: a variable is reused as a loop counter, so the filename-extension check always passes and a user who has been granted the plugin's gallery-management capability by an administrator can place an attacker-controlled file (including a .php payload) into a web-accessible gallery directory; the CVSS vector (PR:H, UI:N) confirms this is an authenticated, elevated-privilege path rather than a subscriber or anonymous one. Publicly available exploit code exists, so exploitation is realistic for any site where a non-administrator holds the gallery-management role, and full code execution depends on the host actually serving PHP out of the upload path - on hardened hosts the impact is limited to arbitrary file write.
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create_users capability but not promote_users to change roles of existing users, including promoting them to administrator, via the plugin's front-end import functionality. The flaw is exploitable where create_users is delegated to lower-privileged roles; it does not require administrator access or victim interaction. Publicly available exploit code exists, and this is a genuine privilege-escalation-to-full-takeover issue that merits prompt patching.
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2) lets an authenticated user who holds only the create_users capability assign administrator roles during a CSV import, enabling creation of new admin accounts or promotion of existing users. Publicly available exploit code exists, though there is no KEV confirmation of active exploitation. Exploitation requires a non-default role configuration where create_users is delegated without promote_users and the attacker can reach the plugin's CSV import function; default WordPress installs are not affected because only administrators hold create_users and already hold promote_users.
Stored cross-site scripting in the Kirki WordPress plugin affects versions 6.0.0 through 6.3.0, which allow SVG files to be uploaded site-wide without sanitization; an authenticated user with Author-level access or higher can upload an SVG carrying embedded JavaScript that is then served from the site's own origin. When a victim - ideally an administrator - opens or views that file, the script runs in their session, giving the attacker same-origin script execution with high confidentiality and integrity impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H), and publicly available exploit code exists. This is a genuine but conditionally-gated stored-XSS priority rather than a mass-exploitation emergency: it requires an authenticated Author-level account and a victim interacting with the uploaded file, and it is fully mitigated by upgrading to 6.3.1.
Stored cross-site scripting in the Master Slider WordPress plugin (versions through 3.11.2) lets an authenticated user with the Contributor role or higher inject script payloads via unsanitised shortcode attributes that are written into an inline script when a post is rendered. The payload fires only when a victim - a higher-privileged user or any site visitor - views the affected post, so exploitation hinges on a crafted post combined with victim interaction; publicly available exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing) and no vendor-released patch. Because lower-trust accounts on multi-author sites can typically create posts containing the ms_slider shortcode, the practical risk is concentrated on sites that grant Contributor access to untrusted users.
An authenticated user holding the quiz-import capability in the Forminator Forms WordPress plugin (versions 1.57.0 through before 1.57.2.1) can escalate to full site control by embedding a role-assigning registration form inside an imported quiz and publishing it, granting any role - including administrator - to anyone who submits the public form. The plugin enforces role validation in the ordinary form editor and ordinary form import paths but omits that check in the quiz-import code path, making the nested-quiz route the only viable bypass; the identical form is rejected through both normal routes. A vendor patch is available (1.57.2.1) and publicly available exploit code exists, so although the vendor scores this 6.6 (AC:H/PR:H), the assessed vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) is materially higher given that a non-administrator with delegated import rights can achieve complete site compromise.
Unauthenticated attackers can invoke arbitrary registered shortcodes on WordPress sites running the Meow Gallery plugin before version 5.5.5, due to insufficient sanitization of a user-supplied value concatenated into a shortcode string on a publicly reachable endpoint. This allows disclosure of non-public gallery content, but does not permit code execution or availability impact; publicly available exploit code exists, and the vendor has released a patch (5.5.5).
Heap-based buffer overflow in Kamailio's CDP (C Diameter Peer) module allows a remote party that can deliver a malformed Diameter message to a peer socket to corrupt shared-memory (shm) heap state and potentially disrupt or compromise the process. Affected builds are Kamailio up to 5.8.8, 6.0.7, 6.1.4 and 6.2.0-dev1 that actually load the cdp module; SIP-only deployments are not exposed. Publicly available exploit code exists (referenced from a public GitHub issue, with the fix in PR 4877), and while the vendor's CVSS 4.0 base score is 5.5, an independent assessment scores it CVSS:3.1 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H), reflecting full availability impact on the affected process; no confirmed active exploitation (CISA KEV) was identified at time of analysis.
Path traversal in the create_file tool served by the 03-lovepreetSingh MCP application's /api/mcp route lets remote, unauthenticated attackers supply a crafted filePath that escapes the intended base directory and write attacker-controlled content to arbitrary locations on the host filesystem. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:L) reflects a high integrity impact with a limited availability impact, and publicly available exploit code exists via the project's own issue tracker (GitHub issue #3); there is no evidence of confirmed active exploitation (CISA KEV). Because the project is unversioned, the maintainer has not responded to the report, and no fixed release exists, the only realistic limit on real-world risk is deployment scarcity: this is a hobby MCP implementation with negligible confirmed production footprint, though any internet-reachable instance is trivially testable.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to alter SQL queries through the Course parameter of /reviewer_0/admins/assessments/course/btn_functions.php, enabling data disclosure along with limited integrity and availability impact. Publicly available exploit code exists via a GitHub PoC issue, but there is no evidence of active exploitation, and the feed CVSS 4.0 score of 6.9 overstates practical risk. The independent assessment rates this as LOW priority because the affected product is a niche educational PHP application with a single known version, negligible internet-facing deployment, and an unverified access-control prerequisite, consistent with an assessed CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L.
Server-side request forgery in vas3k TaxHacker up to and including 0.8.5 lets an attacker who can reach the LLM-provider configuration function force the server to issue requests to an arbitrary URL of their choosing. The flaw lives in the testLLMProviderAction server action in app/(app)/apps/settings/actions.ts, where the attacker-supplied baseUrl is used as the destination of an outbound HTTP request without validation; publicly available exploit code exists and the project has not responded to the reported issue. Independent assessment places the realistic severity lower than the vendor's CVSS 4.0 score of 5.5: because TaxHacker is a self-hosted, login-gated application, practical exploitation requires an authenticated session and a working LLM-configuration screen, and the achievable impact is limited to confidentiality (reading responses from internal endpoints the server can reach) rather than code execution or data modification.
Server-side request forgery in NonceGeek dim-sum-app's Deno backend lets remote, unauthenticated attackers redirect outbound requests to an arbitrary host by supplying a crafted supabase_url query parameter to the textSearchV2Handler endpoint (deno/main.tsx). Because the handler builds a Supabase client from that attacker-controlled URL and passes the deployment's SUPABASE_SERVICE_ROLE_KEY as the credential, a successful attack both forces the server to issue requests to attacker-chosen destinations and discloses the service-role key to that endpoint, which in standard deployments can be leveraged for full privileged access to the backing Supabase project and, from there, potential impact on any data or services reachable with that key. The issue is confirmed with publicly available exploit code (disclosed via the project's GitHub issue tracker) but is not listed in CISA KEV, so no confirmed in-the-wild exploitation is established; the vendor has published a fix commit.
Server-side request forgery in vas3k TaxHacker up to 0.8.5 lets an attacker control the businessLogo argument passed to the generateInvoicePDF function in /apps/invoices/actions.ts and force the server-side invoice PDF renderer to fetch an arbitrary URL. The independent assessment rates this as moderate severity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with exploitation requiring an account on the self-hosted instance that can configure business branding and trigger invoice generation, rather than an anonymous internet attacker. Publicly available exploit code exists, the issue was reported to the project early via GitHub issue #186 without a vendor response, and no CISA KEV listing was identified - impact is limited to low confidentiality, integrity, and availability with no code execution.
The certificate validation route in Nginx Proxy Manager through 2.15.1 (internalCertificate.validate in backend/internal/certificate.js) is reachable without authentication, letting any remote caller submit arbitrary certificate material to the backend. Publicly available exploit code exists, but the project has not responded to the early issue report, so no fixed release is confirmed; the practical impact is constrained because the endpoint parses and echoes back only the certificate the caller supplied rather than returning stored data, leaving malformed-input handling in the OpenSSL parsing path as the main residual concern. As our independent assessment notes, this is a moderate-priority issue and the raw 6.9 CVSS 4.0 score somewhat overstates the real-world risk.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers inject arbitrary SQL through the courseID argument handled by /reviewer_0/admins/assessments/course/btn_functions.php, giving read access to backend data and limited ability to modify or disrupt it (integrity and availability impact rated Low, confidentiality High in our independent assessment). Publicly available exploit code exists - a proof-of-concept has been published via the GitHub issue referenced by VulDB - and the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) claims unauthenticated, no-interaction exploitation. Despite the 6.9 score, real-world risk is bounded: exploitation requires that the script be reachable, and because it lives under an /admins/ directory, practical unauthenticated access depends on the deployment lacking a session or authorization guard on that path, a common but unverified trait of SourceCodester projects. No CISA KEV entry or confirmed in-the-wild exploitation was identified at time of analysis.
SQL injection in SourceCodester Drug Recommendation System 1.0 lets a remote attacker manipulate the SQL query behind /drug_recommender/Admin/edit_user.php by tampering with the ID parameter, enabling unauthorized read and modification of backend data. The vulnerability carries a publicly available exploit (proof-of-concept published on GitHub), so exploitation is trivial for anyone who can reach the endpoint, though no confirmed active exploitation (CISA KEV) has been reported. Scoring is split: the CNA/VulDB vector rates it CVSS 4.0 at 6.9 with PR:N, while our independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, because the /Admin/ path strongly suggests an authenticated administrative session is normally required, which markedly reduces the realistic attack surface and real-world priority despite the alarming-looking technical impact.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows remote attackers to manipulate the ID parameter in /Admin/edit_symptom.php, causing the application to execute attacker-influenced SQL against its backend database and potentially read or alter symptom records. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation; independent assessment treats this as a lower real-world priority because the /Admin/ endpoint is normally protected by an admin login and the product's deployment base is very small. The vendor's CVSS 4.0 vector rates it 6.9 with PR:N, while the independent CVSS 3.1 assessment requires admin-level authentication (PR:L) and assigns high confidentiality and integrity impact with limited availability impact.
SQL injection in the Admin Login Form of Code-Projects Internship Management System 1.0 lets remote attackers manipulate the Password parameter of /admin/login.php to inject arbitrary SQL into the backend database query. Per the CVSS 4.0 vector the flaw is reachable without authentication (PR:N, AV:N, AC:L), and publicly available exploit code exists - a public proof-of-concept write-up is referenced in the CVE record - so exploitation requires no special conditions against a default installation. The practical risk is tempered by deployment scarcity: this is an obscure open-source PHP student-style project that is rarely exposed on production internet-facing hosts, and there is no indication of confirmed active exploitation (not listed in CISA KEV).
Unauthenticated SQL injection in the /employer/login.php login form of code-projects Internship Management System 1.0 lets remote attackers inject arbitrary SQL through the Password parameter, potentially reading or altering the underlying database. The flaw is remotely reachable without credentials or user interaction, and publicly available exploit code exists (VulDB-reported, with a public PoC write-up linked from the CVE record); no CISA KEV listing indicates confirmed active exploitation. Although the independent assessment rates the technical severity as high (CVSS 3.1 8.3-adjacent vector: AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact), real-world priority is low because the application is a niche, code-projects.org PHP teaching/demo system with a very small internet-facing deployment footprint.
Unauthenticated SQL injection in the /login.php login form of code-projects Internship Management System 1.0 allows remote attackers to manipulate the Password parameter and inject arbitrary SQL into the backend query, with public exploit code already available (no CISA KEV confirmation of active exploitation). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the independent 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) both confirm this is a pre-authentication, network-reachable flaw requiring no credentials and no user interaction, which materially raises risk versus a post-auth injection. Practical exposure is limited mainly by prevalence: this is a niche hobbyist-style PHP project, and successful data extraction depends on the backend DBMS and query structure, so exploitation in the wild against internet-facing production deployments is plausible but constrained.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows remote attackers to manipulate the ID parameter of /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove and execute attacker-controlled SQL against the application's backend database, potentially exposing or altering stored records. Publicly available exploit code exists (a public proof-of-concept referenced from VulDB and a public GitHub issue), which lowers the skill barrier, but there is no confirmed actively exploited (CISA KEV) status and no EPSS estimate was supplied. Impact is bounded rather than catastrophic: the vendor vector rates confidentiality, integrity and availability impact as low (VC:L/VI:L/VA:L, E:P), and our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L - a classic low-real-priority SQL injection for a niche PHP project despite a mid-range base score, with the main open question being whether the administrative script is actually reachable without a valid admin session.
Authenticated remote code execution in OrdaSoft Joomla Gallery (both the free and commercial editions) for Joomla below version 6.2.7 lets anyone holding a privileged Joomla backend account execute arbitrary PHP functions on the underlying server. The extension's updateOSGallery() handler, invoked through task=update_osgallery, takes a JSON body and calls the supplied 'method' value as a live PHP function with the 'package' value as its only argument, with no is_callable() check or allow-list, so functions such as system, exec, shell_exec and passthru are directly reachable. Rated CVSS 9.4 (CVSS 4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; independently assessed as CVSS 3.1 scope-changed with C:H/I:H/A:H); exploitation requires authentication with a high-privilege role, which is the main limiting factor - this is not reachable by anonymous internet users, and no public exploit code was identified at time of analysis.
Remote code execution in the OrdaSoft Joomla Gallery extension (both the free and the commercial editions) before version 6.2.7 lets an authenticated Joomla backend user holding the core.manage permission upload a .php file into a web-accessible directory and execute it simply by requesting the resulting URL, giving full control of the Joomla host under the web server's account. The root cause is the extension's saveWatermark() routine, which stores the client-supplied filename exactly as sent with no extension check, no content check and no filename sanitisation, so a spoofed image Content-Type header is sufficient to smuggle a PHP payload through the upload path. Scoring is severe (vendor-assigned CVSS 9.4; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and although exploitation is gated on a privileged authenticated role rather than an anonymous visitor, no public exploit code has been identified at time of analysis.
Use-after-free in Suricata before 8.0.7 can crash the HTTP/2 inspection engine when a transaction is inspected by rules that use http.response_header both with and without a transform. The flaw is remotely triggerable by HTTP/2 server responses traversing the sensor, requires no authentication per the CVSS vector, and the vendor has released 8.0.7 as the fix. No public exploit code or confirmed active exploitation was identified at time of analysis; the assessed impact is primarily denial of service and limited memory disclosure, not confirmed code execution, and exploitation depends on the specific dual-rule HTTP/2 configuration.
Suricata 8.x before 8.0.7 contains a type confusion vulnerability in the DoH2 (DNS over HTTPS version 2) parser that can result in an invalid free, leading to memory corruption. An unauthenticated remote attacker can trigger this by sending a crafted DoH2 request that performs an HTTP1-to-HTTP2 upgrade through a monitored network, potentially causing a crash or arbitrary code execution. The vulnerability is exploitable by default in 8.x sensors because the doh2 app-layer protocol is enabled out-of-the-box; no public exploit code has been identified at time of analysis, but the severity is high.
Unauthenticated attackers can tamper with arbitrary bookings on any internet-reachable WordPress site running the Tripzzy plugin in versions 1.3.4 through 1.5.0, because its administrative booking-management actions perform no capability or ownership checks and are gated only by a token the plugin hands to any anonymous visitor on request. Exploitation allows alteration of booking contents, stored totals, and notes (integrity impact only; no confidentiality or availability impact was assessed), and publicly available exploit code exists - the WPScan entry is tagged as an exploit reference. No special configuration is required, no credentials or user interaction are needed, and there is no indication of confirmed active exploitation in CISA KEV at the time of analysis; EPSS data was not provided.
Administrative account takeover in NivoCart through 2.4.0 is possible because the forgotten.php password-reset flow derives recovery codes from PHP's non-cryptographic mt_rand() and MD5, allowing unauthenticated remote attackers who know a valid administrator email address to predict or brute-force the 10-hex-character token and reset the administrator password. No authentication or user interaction is required per the assessed vectors (PR:N/UI:N), and the absence of rate limiting and token expiration materially lowers the effort; CVE metadata scores this 9.2 under CVSS 4.0 and the independent assessment confirms high severity. No public exploit identified at time of analysis, but the vulnerable code path and affected version are publicly documented.
OS command injection in getID3 versions before 1.9.26 allows an attacker who controls the filename passed to the library's shell-out handlers to execute arbitrary operating-system commands with the privileges of the embedding process. The vulnerable code paths build shell command lines around filenames using simple double quotes instead of escaping them, and they are reached through the shorten audio analyzer (module.audio.shorten.php) and the Vorbis comment / MetaFLAC write helpers (write.vorbiscomment.php, write.metaflac.php). Practical exposure is constrained: the host application must call those write or shorten routines and must have the vorbiscomment, metaflac, or shorten helper binaries installed and on GETID3_HELPERAPPSDIR or PATH, and low-privilege access to the embedding application is required per the vendor vector; the flaw is fixed in 1.9.26, and no public exploit code has been identified at time of analysis.
Account takeover is possible in the ZTE SmartLife (ZTESW) app on builds ZTE_SL_V2.8.2_ABROAD and earlier, where an attacker can reset the password of any registered user by spoofing the app's dynamically generated authentication parameters against the backend /account/verify.serv interface. After extracting the client-side auth parameters through a one-time reverse-engineering or instrumentation step, an attacker who knows a target's registered email address can resolve the real account ID and then submit a forged password-reset request, giving full control of the victim account without any victim interaction; the independent assessment rates this unauthenticated over the network (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity and availability impact. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, but the weak-signal situation does not reduce the severity, and only ZTE_SL_V2.8.2_ABROAD and prior builds are affected.
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. Exploitation requires a valid low-privilege account (CVSS 4.0 vector PR:L) plus passive user interaction when the malicious template is rendered (UI:P), and it is not possible against patched instances (2026.1.0+) which enforce SAFER_RESOLVER; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS is modest (0.92%, ~58th percentile), consistent with a high-severity but authentication-gated issue.
Authenticated SQL injection in the OrdaSoft Joomla Gallery extension (both Free and commercial editions) for Joomla versions below 6.2.7 allows a user holding the delegated core.manage permission for the gallery component to execute arbitrary SQL against the site's database, including UNION-based extraction of #__users password hashes and full read/write access to stored data. Exploitation requires a valid Joomla account with that scoped gallery-management right - there is no unauthenticated path - so exposure is concentrated on sites that delegate gallery administration to non-fully-trusted users. No public exploit code or confirmed active exploitation was identified at the time of analysis, and no EPSS or KEV data was supplied; severity is assessed as high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor-published CVSS 8.6).
XML external entity injection in getID3 1.9.26 and earlier allows an attacker who can get a crafted media file parsed by the library's XML2array helper to read local files, potentially trigger server-side request forgery, and cause denial of service through entity expansion. The flaw only manifests on PHP versions earlier than 8.0, where libxml does not disable external entity loading by default and getID3's error-suppressed libxml_disable_entity_loader() call can fail silently; on PHP 8.0 and later the vulnerable code path does not trigger at all. No authentication or user interaction is required once those preconditions hold - the only requirement is that the application ingests attacker-influenced media metadata - and no public exploit identified at time of analysis, though the vendor has published a fix. Independent assessment rates the dominant impact as high-confidentiality local file disclosure (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L), with integrity impact absent and availability impact limited.
Sign-up Sheets WordPress plugin versions before 2.4.0 allows an attacker to delete sign-up records via a forged cross-site request when a logged-in user with deletion privileges is tricked into loading a malicious link or page. The vulnerability (CWE-352) has publicly available exploit code, and a vendor patch is available in version 2.4.0. Exploitation requires user interaction and a victim with the appropriate capability, resulting in only a low integrity impact (CVSS 4.3).
Improper authorization in the WordPress plugin Photo Gallery, Sliders, Proofing and Themes before version 4.5.0 lets a user who has been granted the plugin's gallery-management capability delete, copy, and re-tag images that belong to other users' galleries. The flaw is an IDOR-class (CWE-639) authorization bypass that requires an authenticated WordPress account already holding that capability (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L per our independent assessment; the published score is 4.2 with a more conservative AC:H vector), so anonymous visitors cannot reach it. Publicly available exploit code exists (WPScan), but there is no confirmed active exploitation (CISA KEV) and vendor-released patched version 4.5.0 is available.
Server-side request forgery in the WordPress plugin Import and Export Users and Customers (versions before 2.4.5) causes the server to fetch an attacker-supplied URL during a CSV import because the plugin fails to validate that URL before making the request. Exploitation is gated behind a high-privileged, authenticated WordPress user with the capability to run the plugin's user/customer CSV import (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N), so a successful attack yields read-only SSRF probing and limited data reflection rather than code execution or data modification. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and the practical impact depends entirely on whether internal services or a cloud metadata endpoint are reachable from the web server - making this a genuinely low-priority issue.
Unauthenticated visitors can force a WordPress site running the TikTok plugin (versions 1.2.0 through before 1.4.2) to redeem an attacker-chosen sign-in code against the TikTok advertising platform using the site's own stored credentials. The vulnerable callback is registered to run on every request to the site rather than only during the administrator's sign-in flow, and it compares the supplied URL loosely, so merely similar-looking URLs also trigger it; no authentication or user interaction is required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Publicly available exploit code exists, and the practical impact is integrity-only, confined to the site's TikTok advertising connection, with no read access to site data and no availability impact - making this a genuinely low-priority issue despite being remotely reachable without credentials.
Replayed TOTP passcodes stay valid in mayswind ezBookkeeping before 2.0.0, so an attacker who already holds a victim's valid primary credentials and has captured a live TOTP code can resubmit that same code against the two-factor authorization or OAuth2 callback endpoint instead of being rejected after its first use. The window of abuse is bounded by the server's TOTP acceptance period (roughly 90 seconds, reflecting adjacent 30-second time steps), and only accounts with TOTP-based two-factor authentication enabled on pre-2.0.0 releases are exposed; interception must happen in real time via a phishing proxy, MITM position, or direct observation. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R (7.6), and although PR:N indicates no privileges are required on the vulnerable component, practical exploitation presupposes stolen credentials plus a captured code, so this is a conditional weakness rather than a default-install compromise - no public exploit identified at time of analysis, and the vendor fixed it in 2.0.0.