Unauthenticated remote code execution in REDCap 13.3.0 and later allows an attacker who knows a valid public survey hash to reach an unintended controller route through the survey passthrough routing logic and then supply a crafted file-path/stream parameter to the Data Import processing logic, resulting in arbitrary code execution on the REDCap server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms remote, unauthenticated exploitation with no user interaction required, but the mandatory knowledge of a valid public survey hash is a meaningful prerequisite that rules out blind mass scanning and confines practical exposure to instances actively publishing public surveys. Exploitation status: no public exploit identified at time of analysis; the flaw was reported by Securifera.
Pre-authentication stack-based buffer overflow in the D-Link DIR-868L router running firmware 2.01b05 allows remote attackers to corrupt memory by sending crafted values in the id or password parameters to /webfa_authentication.cgi, potentially leading to crash or arbitrary code execution on the device. The attack requires only network reachability to the router's HTTP management interface, with no authentication or user interaction (PR:N/UI:N per both the vendor-supplied CVSS 4.0 vector and our independent CVSS 3.1 assessment). Publicly available exploit code exists - a proof-of-concept crash script (poc_crash.py) published on GitHub - but there is no confirmed actively exploited (CISA KEV) status, and the practical attack surface is limited because the web admin interface is typically LAN-only by default, with WAN-side exploitation requiring remote management to be enabled or the device to be internet-exposed; the CVSS 4.0 score of 10.0 conflicts sharply with the realistically constrained exposure and crash-only nature of the published PoC, so the finding warrants caution rather than alarm.
An unauthenticated stack-based buffer overflow in the web management interface of the Comfast CF-N1-S (firmware 2.6.0.1) allows a remote attacker to corrupt memory and potentially achieve arbitrary code execution or crash the device by sending a crafted request to the /cgi-bin/mbox-config CGI endpoint. The flaw resides in the get_css_path_from_uri function, which fails to bound-check attacker-supplied input before copying it onto the stack; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, with high confidentiality, integrity and availability impact across both the vulnerable system and subsequent systems) reflects a maximum 10.0 score, and our independent reassessment under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) likewise rates it critical. Publicly available exploit code exists (a proof-of-concept was disclosed via a public GitHub issue referenced by VulDB), though there is no confirmed active exploitation (no CISA KEV listing); practical exploitation is constrained by whether the management panel is reachable, since these devices are typically deployed behind a LAN, and reliable code execution versus a simple crash depends on the target's memory-protection configuration.
Unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension for Joomla (both the free and paid editions) below version 6.2.7 allows any anonymous visitor to inject SQL through the publicly published mod_osgallery_search search box and read arbitrary database content. The showSearchResult() and showSearchResultAjax() endpoints take the textsearch/searchText request parameter and concatenate it directly into a LIKE clause without quoting or escaping, and the CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the accompanying CVSS:3.1 assessment (PR:N/UI:N) both confirm the attack needs no authentication, no user interaction, and no special client configuration. Impact is scoped primarily to data disclosure - the authoritative assessment scores C:H/I:L/A:N because the injection point is a SELECT's LIKE clause - and no public exploit code was identified at time of analysis; exploitation is limited to sites running an affected Gallery version that actually publish the search module. This is a genuine high-priority vulnerability, so prioritise inventory of Joomla sites with the extension and the search module enabled, and upgrade to 6.2.7 or later.
Authenticated remote code execution in OrdaSoft Joomla Gallery (both the free and commercial editions) for Joomla below version 6.2.7 lets anyone holding a privileged Joomla backend account execute arbitrary PHP functions on the underlying server. The extension's updateOSGallery() handler, invoked through task=update_osgallery, takes a JSON body and calls the supplied 'method' value as a live PHP function with the 'package' value as its only argument, with no is_callable() check or allow-list, so functions such as system, exec, shell_exec and passthru are directly reachable. Rated CVSS 9.4 (CVSS 4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; independently assessed as CVSS 3.1 scope-changed with C:H/I:H/A:H); exploitation requires authentication with a high-privilege role, which is the main limiting factor - this is not reachable by anonymous internet users, and no public exploit code was identified at time of analysis.
Remote code execution in the OrdaSoft Joomla Gallery extension (both the free and the commercial editions) before version 6.2.7 lets an authenticated Joomla backend user holding the core.manage permission upload a .php file into a web-accessible directory and execute it simply by requesting the resulting URL, giving full control of the Joomla host under the web server's account. The root cause is the extension's saveWatermark() routine, which stores the client-supplied filename exactly as sent with no extension check, no content check and no filename sanitisation, so a spoofed image Content-Type header is sufficient to smuggle a PHP payload through the upload path. Scoring is severe (vendor-assigned CVSS 9.4; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and although exploitation is gated on a privileged authenticated role rather than an anonymous visitor, no public exploit code has been identified at time of analysis.
Use-after-free in Suricata before 8.0.7 can crash the HTTP/2 inspection engine when a transaction is inspected by rules that use http.response_header both with and without a transform. The flaw is remotely triggerable by HTTP/2 server responses traversing the sensor, requires no authentication per the CVSS vector, and the vendor has released 8.0.7 as the fix. No public exploit code or confirmed active exploitation was identified at time of analysis; the assessed impact is primarily denial of service and limited memory disclosure, not confirmed code execution, and exploitation depends on the specific dual-rule HTTP/2 configuration.
Suricata 8.x before 8.0.7 contains a type confusion vulnerability in the DoH2 (DNS over HTTPS version 2) parser that can result in an invalid free, leading to memory corruption. An unauthenticated remote attacker can trigger this by sending a crafted DoH2 request that performs an HTTP1-to-HTTP2 upgrade through a monitored network, potentially causing a crash or arbitrary code execution. The vulnerability is exploitable by default in 8.x sensors because the doh2 app-layer protocol is enabled out-of-the-box; no public exploit code has been identified at time of analysis, but the severity is high.
Administrative account takeover in NivoCart through 2.4.0 is possible because the forgotten.php password-reset flow derives recovery codes from PHP's non-cryptographic mt_rand() and MD5, allowing unauthenticated remote attackers who know a valid administrator email address to predict or brute-force the 10-hex-character token and reset the administrator password. No authentication or user interaction is required per the assessed vectors (PR:N/UI:N), and the absence of rate limiting and token expiration materially lowers the effort; CVE metadata scores this 9.2 under CVSS 4.0 and the independent assessment confirms high severity. No public exploit identified at time of analysis, but the vulnerable code path and affected version are publicly documented.