OS command injection in the D-Link R95 (BE9500) router running firmware BE9500_1.00.16 allows an attacker to execute arbitrary operating-system commands on the device by supplying a crafted NTPServer argument that the /bin/ssi binary handles on behalf of the DHMAPI component. Exploitation requires reaching and authenticating to the router's management interface (PR:H in both the CVSS 4.0 vector and our independent CVSS 3.1 assessment), so this is a post-authentication flaw that becomes dangerous when admin credentials are default, weak, or reused. Publicly available exploit code exists (a public GitHub proof-of-concept), but no CISA KEV entry confirms active exploitation; the vulnerability scores 8.5 High under CVSS 4.0, driven by full confidentiality, integrity, and availability impact on the device.
Authenticated command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows a low-privileged user of the web management interface to execute arbitrary shell commands on the device through the Traceroute Diagnostic Feature. The flaw is rooted in the 'url' argument passed to /usr/bin/network_tools, which is consumed without shell sanitization (CWE-77); because the underlying binary runs on an embedded Linux platform, successful exploitation typically yields root-level code execution, giving the attacker full control of the router (CVSS 4.0 base 8.6, AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact). Publicly available exploit code exists (a public disclosure write-up is referenced), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis. Exploitation is not confirmed as active in the wild (not listed in CISA KEV), but requires only network reachability to the management interface plus a valid low-privilege account.
Authenticated back-office users of NivoCart (through 2.4.0) holding only view-only privileges can upload and execute arbitrary PHP, turning a low-privilege admin account into full remote code execution on the hosting web server. The flaw is in the File Manager multi() upload endpoint, which skips file-extension validation whenever a new filename is supplied or the chunks parameter is set to 2 or higher, letting a .php payload land in the web-accessible image/data/ directory where it can simply be requested. Exploitation requires a valid low-privileged back-office session and no non-default configuration, there is no CISA KEV entry and no public exploit identified at time of analysis, and the available data does not name an exact fixed version, so exposure hinges on whether an attacker already holds or can obtain a view-only admin account.
Command injection in the Netcore NBR200V2 router (firmware 1.3.241127.071246) allows an attacker holding low-privilege credentials on the device's management interface to execute arbitrary operating-system commands by supplying a crafted ipv4 value to the LAN IP Configuration Handler in /usr/bin/network_tools. Rated CVSS 4.0 8.6 (assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H), the flaw yields full confidentiality, integrity and availability impact on the device and can pivot toward the surrounding network; publicly available exploit code exists, so weaponization effort is low, though no CISA KEV entry confirms active exploitation at time of analysis. Exploitation requires authenticated or at least low-privileged access to the management interface and is realistically reachable from the local network (and only from the internet if the admin interface is exposed), which materially narrows exposure compared with an unauthenticated flaw.
Authenticated code execution in the Forminator Forms WordPress plugin (before 1.57.2.1) lets a user who holds the plugin's forms-management capability abuse unrestricted class instantiation during deserialization of an XML-RPC value, ultimately writing a file of the attacker's choosing and executing arbitrary code on the server. That capability is granted to administrators by default, so sites that have not delegated it through Forminator's own settings are materially less exposed, but any lower role given forms-management can reach the flaw; exploitation also depends on a reachable XML-RPC interface and a usable PHP gadget chain, which is reflected in the high attack-complexity component of the 8.5 CVSS score (PR:L, AC:H). Publicly available exploit code exists, and a vendor patch shipping in 1.57.2.1 is available, so sites running affected versions should upgrade promptly.
Authentication bypass in the SAML Single Sign On WordPress plugin (versions 4.8.43 through <6.0.0) lets a remote, unauthenticated attacker log in as any WordPress user, including an administrator. The plugin ignores whatever account-linking criterion the administrator configured (email, NameID, etc.) and always resolves the SAML identity by login name, so an attacker who can get the site's trusted Identity Provider to assert a login name of their choosing - for example via an IdP that allows self-service registration or user-controlled username attributes, or a compromised or attacker-operated IdP - authenticates as that account without proving ownership of it. Publicly available exploit code exists, and while the CVSS vector scores the flaw at 8.1 with PR:N, the AC:H rating reflects the significant prerequisite of influencing the trusted IdP's assertions; sites whose IdP strictly controls the asserted login-name attribute are much harder to exploit.
PHP object injection in the Unlimited Elements For Elementor WordPress plugin (versions before 2.0.20) lets authenticated attackers with subscriber-level access inject arbitrary PHP objects through an AJAX action that lacks a capability check and deserializes stored data. Exploitation requires open user registration (or any low-privilege account), and full impact-such as remote code execution or file/database manipulation-depends on a usable PHP POP gadget chain being loaded by WordPress core, Elementor, or another active plugin (hence the AC:H rating). Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the 2.0.18-2.0.19 releases only partially mitigate by raising the required privilege to editor-level.
Unauthenticated comment deletion in the Tripzzy WordPress plugin (versions 1.1.8 through before 1.5.1) lets any remote attacker permanently delete arbitrary comments on an affected site with a single crafted request. The plugin's AJAX action is registered for unauthenticated users by design but performs neither an authorization/capability check nor validation of the comment identifier being removed, so it is a textbook missing-authorization plus IDOR weakness (CWE-284, CVSS 3.1 7.5 HIGH, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Publicly available exploit code exists, but the impact is bounded: exploitation only yields permanent integrity/data loss of comment content, with no code execution, privilege escalation, or data exfiltration, and the vendor has shipped a fix in version 1.5.1.
Unauthenticated attackers on the local network can bypass authentication and gain full control of D-Link DIR-X1860 and DIR-X1860Z routers (firmware up to 1.0.2.220120.165402) by manipulating the passwd_set argument in the /ubus interface of the routerd component. Publicly available exploit code exists, and the vulnerability has a CVSS 4.0 score of 7.4, though it is not confirmed as actively exploited (no KEV).
Arbitrary file write - escalating to remote code execution on hosts that execute PHP from upload directories - affects the WordPress plugin Photo Gallery, Sliders, Proofing and Themes in all versions before 4.5.0. The flaw sits in the archive-extraction routine: a variable is reused as a loop counter, so the filename-extension check always passes and a user who has been granted the plugin's gallery-management capability by an administrator can place an attacker-controlled file (including a .php payload) into a web-accessible gallery directory; the CVSS vector (PR:H, UI:N) confirms this is an authenticated, elevated-privilege path rather than a subscriber or anonymous one. Publicly available exploit code exists, so exploitation is realistic for any site where a non-administrator holds the gallery-management role, and full code execution depends on the host actually serving PHP out of the upload path - on hardened hosts the impact is limited to arbitrary file write.
Privilege escalation in the Import Export Users WordPress plugin before 2.5.2 allows authenticated users with the create_users capability but not promote_users to change roles of existing users, including promoting them to administrator, via the plugin's front-end import functionality. The flaw is exploitable where create_users is delegated to lower-privileged roles; it does not require administrator access or victim interaction. Publicly available exploit code exists, and this is a genuine privilege-escalation-to-full-takeover issue that merits prompt patching.
Privilege escalation in the Import and export users and customers WordPress plugin (versions 2.4.16 through before 2.5.2) lets an authenticated user who holds only the create_users capability assign administrator roles during a CSV import, enabling creation of new admin accounts or promotion of existing users. Publicly available exploit code exists, though there is no KEV confirmation of active exploitation. Exploitation requires a non-default role configuration where create_users is delegated without promote_users and the attacker can reach the plugin's CSV import function; default WordPress installs are not affected because only administrators hold create_users and already hold promote_users.
OS command injection in getID3 versions before 1.9.26 allows an attacker who controls the filename passed to the library's shell-out handlers to execute arbitrary operating-system commands with the privileges of the embedding process. The vulnerable code paths build shell command lines around filenames using simple double quotes instead of escaping them, and they are reached through the shorten audio analyzer (module.audio.shorten.php) and the Vorbis comment / MetaFLAC write helpers (write.vorbiscomment.php, write.metaflac.php). Practical exposure is constrained: the host application must call those write or shorten routines and must have the vorbiscomment, metaflac, or shorten helper binaries installed and on GETID3_HELPERAPPSDIR or PATH, and low-privilege access to the embedding application is required per the vendor vector; the flaw is fixed in 1.9.26, and no public exploit code has been identified at time of analysis.
Account takeover is possible in the ZTE SmartLife (ZTESW) app on builds ZTE_SL_V2.8.2_ABROAD and earlier, where an attacker can reset the password of any registered user by spoofing the app's dynamically generated authentication parameters against the backend /account/verify.serv interface. After extracting the client-side auth parameters through a one-time reverse-engineering or instrumentation step, an attacker who knows a target's registered email address can resolve the real account ID and then submit a forged password-reset request, giving full control of the victim account without any victim interaction; the independent assessment rates this unauthenticated over the network (AV:N/AC:L/PR:N/UI:N) with high confidentiality, integrity and availability impact. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, but the weak-signal situation does not reduce the severity, and only ZTE_SL_V2.8.2_ABROAD and prior builds are affected.
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. Exploitation requires a valid low-privilege account (CVSS 4.0 vector PR:L) plus passive user interaction when the malicious template is rendered (UI:P), and it is not possible against patched instances (2026.1.0+) which enforce SAFER_RESOLVER; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS is modest (0.92%, ~58th percentile), consistent with a high-severity but authentication-gated issue.
Authenticated SQL injection in the OrdaSoft Joomla Gallery extension (both Free and commercial editions) for Joomla versions below 6.2.7 allows a user holding the delegated core.manage permission for the gallery component to execute arbitrary SQL against the site's database, including UNION-based extraction of #__users password hashes and full read/write access to stored data. Exploitation requires a valid Joomla account with that scoped gallery-management right - there is no unauthenticated path - so exposure is concentrated on sites that delegate gallery administration to non-fully-trusted users. No public exploit code or confirmed active exploitation was identified at the time of analysis, and no EPSS or KEV data was supplied; severity is assessed as high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, vendor-published CVSS 8.6).
XML external entity injection in getID3 1.9.26 and earlier allows an attacker who can get a crafted media file parsed by the library's XML2array helper to read local files, potentially trigger server-side request forgery, and cause denial of service through entity expansion. The flaw only manifests on PHP versions earlier than 8.0, where libxml does not disable external entity loading by default and getID3's error-suppressed libxml_disable_entity_loader() call can fail silently; on PHP 8.0 and later the vulnerable code path does not trigger at all. No authentication or user interaction is required once those preconditions hold - the only requirement is that the application ingests attacker-influenced media metadata - and no public exploit identified at time of analysis, though the vendor has published a fix. Independent assessment rates the dominant impact as high-confidentiality local file disclosure (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L), with integrity impact absent and availability impact limited.
Replayed TOTP passcodes stay valid in mayswind ezBookkeeping before 2.0.0, so an attacker who already holds a victim's valid primary credentials and has captured a live TOTP code can resubmit that same code against the two-factor authorization or OAuth2 callback endpoint instead of being rejected after its first use. The window of abuse is bounded by the server's TOTP acceptance period (roughly 90 seconds, reflecting adjacent 30-second time steps), and only accounts with TOTP-based two-factor authentication enabled on pre-2.0.0 releases are exposed; interception must happen in real time via a phishing proxy, MITM position, or direct observation. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R (7.6), and although PR:N indicates no privileges are required on the vulnerable component, practical exploitation presupposes stolen credentials plus a captured code, so this is a conditional weakness rather than a default-install compromise - no public exploit identified at time of analysis, and the vendor fixed it in 2.0.0.
Information disclosure in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 lets any authenticated user with a low-privilege account read billable timesheet records they are not authorized to see, via the whitelisted endpoints get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet. The affected code paths ran raw SQL that skipped Timesheet and Project doctype permission checks, exposing project names, billing amounts, currencies, activity types, and free-text work descriptions. Exploitation requires a valid ERPNext session (PR:L) but no admin rights, user interaction, or special configuration; there is no public exploit identified at time of analysis, and the assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) with no data modification or denial of service.