Unauthenticated visitors can force a WordPress site running the TikTok plugin (versions 1.2.0 through before 1.4.2) to redeem an attacker-chosen sign-in code against the TikTok advertising platform using the site's own stored credentials. The vulnerable callback is registered to run on every request to the site rather than only during the administrator's sign-in flow, and it compares the supplied URL loosely, so merely similar-looking URLs also trigger it; no authentication or user interaction is required (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Publicly available exploit code exists, and the practical impact is integrity-only, confined to the site's TikTok advertising connection, with no read access to site data and no availability impact - making this a genuinely low-priority issue despite being remotely reachable without credentials.
Authenticated WordPress users who hold only the gallery-management capability of the plugin Photo Gallery, Sliders, Proofing and Themes can save site-wide image-sizing settings they are not entitled to change, because versions before 4.5.0 omit a capability check before writing those options. Only sites running the plugin at a version below 4.5.0 are affected, and the attacker must already have been granted the delegated gallery-management role by an administrator - this is a privilege-boundary erosion between two internal roles, not an unauthenticated compromise, and the impact is limited to the integrity of image-sizing configuration (no data disclosure, no availability loss). Severity is genuinely low (CVSS 3.1, assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and publicly available exploit code exists; there is no CISA KEV listing and therefore no confirmation of active exploitation in the wild.
Authenticated users who have been granted the plugin's gallery-management capability can overwrite the stored settings of any gallery on a WordPress site running the 'Photo Gallery, Sliders, Proofing and Themes' plugin before 4.5.0, including galleries belonging to other users and each gallery's stored filesystem path, because the save routine never checks that the submitted gallery ID belongs to the requesting account (CWE-639, IDOR). Impact is integrity-only and rated Low (CVSS 3.1); the flaw is not reported as actively exploited, but publicly available exploit code exists, and the vendor has released 4.5.0 to correct it. Note that the attacker is not an anonymous visitor - the actor must already hold a capability an administrator deliberately delegated, and must know the IDs of galleries they do not own.
Information disclosure in the Meow Gallery WordPress plugin before 5.5.5 lets authenticated users holding Author-level access or higher pull back metadata - titles, authors, dates and publish statuses - belonging to other users' draft and private posts. The vulnerable post-data retrieval routine performs neither a proper capability check nor owner-scoping of results, so a low-trust Author account on a multi-author site can enumerate unpublished content it was never meant to see; post bodies themselves are not exposed and there is no write, modify or denial-of-service impact. A publicly available exploit code exists, but the flaw is not confirmed actively exploited (no CISA KEV listing), and the risk is genuinely low-priority: it is not reachable by anonymous visitors, requires a valid Author-or-higher login (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N in our assessment), and matters mainly on sites where lower-trust Author accounts coexist with genuinely sensitive unpublished material.
Missing object-level authorization in the Photo Gallery, Sliders, Proofing and Themes WordPress plugin before 4.5.0 allows authenticated users with the Contributor role or higher to read the stored metadata of any image on the site, including images that belong to other users' galleries; publicly available exploit code exists. Exploitation requires an authenticated Contributor+ account on a site running an affected version (3.59.5 through 4.5.0), needs no user interaction or special configuration, and is impossible for anonymous visitors, which caps the practical impact at low confidentiality loss. The disclosed data is limited to the image's stored EXIF subset (camera make and model, capture timestamp) plus internal checksums and identifiers that the plugin's own capability-gated read path normally reserves for administrators, so no image files, credentials, or user PII are exposed and overall priority is minor.
Path traversal in 0215AndrewFeng ACE-MCP through 4.10.8 lets an authorized MCP tool client read arbitrary files from the host via the get_file_snippet tool: the attacker supplies both projectRootPath and filePath, and because projectRootPath is treated as trusted, setting projectRootPath=/etc with filePath=hosts satisfies the isPathInsideProjectRoot guard and exposes /etc/hosts. Exploitation requires the ability to invoke the MCP server's tool interface (authenticated, CVSS PR:L), needs no user interaction or special server configuration, and yields read-only confidentiality impact (no write or code execution). Publicly available exploit code exists and the issue was reported to the vendor, which has not responded or shipped a fix; the independent assessment rates confidentiality impact High, materially higher than the 2.1 CVSS 4.0 base score in the report, and no CISA KEV entry indicates confirmed active exploitation at time of analysis.
Server-side request forgery in Mealie up to 3.25.1 lets an authenticated user with permission to create or edit Recipe Actions coerce the server into making outbound HTTP requests to an arbitrary url argument, with no destination validation applied. Because Recipe Actions are outbound webhook POSTs, the flaw is effectively blind SSRF, so the primary risk is reaching internal-only services or the cloud metadata endpoint rather than directly exfiltrating data back to the attacker. Publicly available exploit code exists, and upgrading to 3.26.0 resolves the issue.
Improper privilege management in samanhappy MCPHub up to 1.0.32 lets any authenticated non-admin user import a configuration template that defines a 'privileged' server (a stdio server, any config carrying command/args, or any config with no remote target), which MCPHub then spawns locally as an operating-system command - resulting in arbitrary command execution as the MCPHub process. Exploitation only requires a valid low-privilege login and access to the Template Import Endpoint (CVSS 4.0 vector shows PR:L), and publicly available exploit code exists via GitHub issue #1094, so the practical risk is higher than the vendor's 5.3 score suggests; this assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw is fixed in MCPHub 1.0.33, where importTemplate enforces the admin-only privileged-config policy.
Missing OAuth token validation in Pixelfed up to 0.12.11 allows an authenticated user without a valid OAuth token to reach the /api/v1 instancePeers endpoint and enumerate federated peer instances, a low-sensitivity information exposure tracked as CWE-306. Publicly available exploit code exists, and the vendor has released a patch (v0.12.10, commit 68dca5097305fa0065d029587b2233524636025a) with a GitHub issue and PR. The independent assessment treats this as low priority: the CVSS vector requires PR:L (authenticated) access, the exposed peer list is often publicly available anyway, and there is no user-data confidentiality, integrity-write, or availability impact beyond peer enumeration.
Path traversal (CWE-22) in the 00Kisumi00 mcp-file-analyzer MCP tool allows authenticated remote attackers to read arbitrary files by supplying a crafted filename to the analyze_csv_data function implemented in main.py's ControlFlowNode. Publicly available exploit code exists, but the vulnerability is low severity (CVSS 5.3; assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and the project is a rolling-release hobby tool with near-zero deployment. No vendor patch has been released and the maintainer has not responded to the issue report.
Filter bypass in PHP-FTS (olivier-ls/php-fts) through version 1.1.3 allows an authenticated remote attacker to defeat document-scoping filters used by consuming applications for ownership or multi-tenant isolation, exposing search results the application intended to hide. The flaw resides in SearchEngine::matchesSingleFilter in src/SearchEngine.php, where filter values were compared with loose `==` and non-strict `in_array()`; because PHP treats any non-empty string as equal to boolean true, a filter value of true matched every document with a non-empty value in that field, and the string '42' matched the integer 42, enabling retrieval of other users' or tenants' records. Publicly available exploit code exists (a proof-of-concept write-up is referenced alongside the CVE from VulDB and a GitHub PoC repository), and the issue is not listed in CISA KEV, so no confirmed active exploitation is known; the risk is context-dependent and moderate, materializing only where the application relies on PHP-FTS filters as an access-control boundary and passes untyped request input directly into filter construction.
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows unauthenticated remote attackers to inject arbitrary script through the 'full name' argument processed by /drug_recommender/index.php, with the payload executing in a victim's browser once the unsanitized value is rendered. Publicly available exploit code exists - a GitHub proof-of-concept README documents the injection path (profile XSS) - but there is no evidence of confirmed active exploitation, and the vendor/analyst scoring places this at 5.3 (CVSS 4.0 AV:N/AC:L/PR:N/UI:P, with the independent assessment using CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting integrity-limited impact with no confidentiality or availability loss. Overall this is a low-to-moderate risk issue: it requires victim interaction and an internet-reachable deployment of an obscure PHP application unlikely to be exposed in production.
Denial of service in OpenClaw up to and including 2026.9.5 allows a remote attacker with low-privileged authenticated access to exhaust server memory by requesting large files through the Canvas Host Route, which buffers entire files into memory via readFile() in src/canvas/serve.runtime.ts with no streaming or size cap. Publicly available exploit code exists (a PoC report is published on GitHub), but there is no indication of confirmed active exploitation (not in CISA KEV). Impact is limited to transient availability degradation of the canvas extension's HTTP serve path - no data exposure, integrity loss, or code execution - and every signal, including the assessed CVSS:3.1 vector of 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) and the vendor's CVSS 4.0 base score of 2.1, points to a genuinely low-priority issue.
Server-side request forgery in the pdf-tools-mcp MCP server bundled with the 0717376/cowork_bench project lets an attacker who can call its ControlFlowNode tool supply a crafted pdf_file_path argument and cause the server to issue requests to attacker-chosen destinations, yielding low confidentiality, integrity, and availability impact. The repository is a rolling-release personal project with no tagged versions, so all revisions up to commit d943e75bc0fc8e3b27141979300cd8cbcd1e890d are presumed affected, and the CVSS 4.0 vector (PR:L, E:P) indicates the tool interface requires some authenticated or privileged access rather than fully anonymous reach. Publicly available exploit code exists (published in a separate GitHub proof-of-concept repository), but there is no evidence of confirmed active exploitation, and the practical risk is heavily constrained by the product's negligible deployment footprint and the maintainer's failure to respond to the original issue report.
SQL injection in AdithyaYelloju Restaurant Management System allows an authenticated attacker with low-privilege admin panel access to execute arbitrary SQL commands via the item, price, image, or type parameters in admin/add_menu.php, leading to potential data theft or modification. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV); the independent assessment rates confidentiality and integrity impact as high and availability as low. Exploitation requires obtaining an authenticated session on the admin interface, and because the product is a niche self-hosted project with no version pinning, real-world exposure depends on the rare deployment being internet-reachable, making this a low-real-world-priority finding.
SQL injection in itsourcecode Leave Management System 1.0 lets an authenticated attacker with a low-privilege session (PR:L per the CVSS vectors) read and tamper with database contents through the ID parameter of /module/department/index.php; our independent assessment rates confidentiality impact high and integrity impact low. Publicly available exploit code exists, and the attack is network-reachable with no user interaction and no non-default configuration required. Real-world risk is moderate-to-low despite the published exploit, because the vulnerable endpoint sits inside the authenticated department administration module and the product itself is a rarely deployed hobbyist PHP application.
SQL injection in itsourcecode Leave Management System 1.0 allows an authenticated user to manipulate the DEPTID argument of /module/department/controller.php and inject arbitrary SQL into the application's backend queries. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the primary impact is high confidentiality loss with limited integrity effect, and exploitation requires a valid application session (PR:L) - no user interaction or non-default configuration is needed beyond the department module being reachable. Publicly available exploit code exists (a public proof-of-concept is referenced at github.com/VivianQYW/cve/issues/2 and the VulDB entry 407922), so the technical barrier to weaponization is low, though real-world risk is tempered by the product's very small deployment footprint; there is no indication of confirmed active exploitation (CISA KEV).
SQL injection in the admin/add_table.php endpoint of AdithyaYelloju Restaurant Management System allows authenticated attackers to inject arbitrary SQL through the table, members, and price parameters. The vulnerability requires a valid admin session (CVSS PR:L) and has publicly available exploit code, but its low severity score (5.3) and the product's rarity make it a genuine yet low-priority issue; no fixed build exists because the project uses rolling releases and has not responded to the report.
Path traversal in 06ketan slideshot through 4.4.0 allows manipulation of the htmlPath argument in the render_slides function of packages/cli/src/renderer.ts, enabling low-impact confidentiality exposure via traversal outside the intended rendering path. The CVSS 4.0 vector indicates network reachability, low privileges required (PR:L), and only low confidentiality impact (VC:L), which supports the independent assessment of LOW real-world risk despite the 5.3 score. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV); the project was reportedly notified through an issue but has not responded.
Stored cross-site scripting (XSS) in Newbee Mall (newbee-ltd newbee-mall) up to version 1.0.0 allows an authenticated low-privileged user to inject arbitrary JavaScript via the goodsName parameter on the Goods Save endpoint (controller/common/UploadController.java), which can be persisted and executed when a victim views the poisoned content if user uploads are served through the /upload/** static mapping. Exploitation requires authentication (PR:L) and victim interaction (UI:P), and publicly available exploit code exists; the independent assessment rates this as low-to-moderate real-world risk given the required privileges, user interaction, and the niche demo-project deployment base.
Authenticated privilege escalation in CodeAstro QR Code Attendance Management System 1.0 lets a logged-in, low-privileged user manipulate the role_id argument in the UserController Save action to assign elevated roles, up to administrator, to any account they control. The flaw is an improper privilege management weakness (CWE-269) exposed through the PHP web interface, and publicly available exploit code exists (a GitHub proof-of-concept), though there is no CISA KEV entry confirming active exploitation. Severity is modest and consistent with the raw numbers: vendor CVSS 5.1 with low confidentiality, integrity and availability impact, and independently assessed as requiring an authenticated session (PR:L) against this single, obscure application at version 1.0.
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows an authenticated user with access to the User Management add_user function to inject malicious script via the txtname, txtemail, or txtpassword parameters, which then executes in the browser of any user who views the affected page. Publicly available exploit code exists, though exploitation requires authentication (PR:L per the assessed CVSS 3.1 vector) and victim interaction (UI:P), and the target is a niche application with essentially no production deployment, making the real-world risk low. The assessed impact is limited to browser-context integrity (VI:L) with no confidentiality or availability effect.
Stored/reflected cross-site scripting in code-projects Assessment Management 1.0 allows an authenticated lecturer to inject arbitrary script through the mark argument handled by lecturer/add-single-mark.php, which then executes in the browser of any user who renders the affected page. Exploitation is constrained: the attacker must hold a valid low-privilege lecturer-level account and a victim must interact with (view) the crafted page, so this is not a zero-click remote compromise, and the affected software is a niche academic PHP project rather than a widely deployed platform. Publicly available exploit code exists and may be utilized, but there is no CISA KEV listing, so there is no confirmed active exploitation; the 5.1 CVSS 4.0 score corresponds to a low-to-moderate real-world risk.
Unsafe deserialization in dmlc DGL (Deep Graph Library) up to and including 2.1.0 allows arbitrary code execution when a victim loads a crafted DGL graph info artifact through the load_info / _read_torch_data path in utils.py, which hands an attacker-influenced 'path' to torch.load and therefore to Python's pickle machinery. Per the authoritative assessment this is an untrusted-input/supply-chain scenario rather than a network-service exploit: no memory-safety trigger exists and DGL exposes no network-facing listener by default, so the attacker must deliver a malicious serialized file (shared dataset, model artifact, or downloaded graph) and induce the user to open it, which is why the assessed vector requires user interaction. A publicly available exploit code exists (linked to GitHub issue dmlc/dgl#7932) and the maintainers were notified via issue report but had not responded at the time of analysis; note that CVE-2026-94092 is not listed in CISA KEV, so there is no confirmation of active exploitation. Vendor data records a CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/E:P), while our independent assessment rates the practical impact higher (CVSS:3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because successful unpickling yields full code execution in the victim's context.
Deserialization of untrusted data in gensim's SaveLoad.load (gensim/utils.py) lets an attacker execute arbitrary code on any host that loads a crafted model file, affecting gensim versions up to and including 4.4.0 as well as the current develop HEAD. The flaw is reachable through the public model-loading API and requires the victim to load an attacker-supplied serialized model or vector file (no authentication is needed to craft or deliver the file; the assessed CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:R with high confidentiality, integrity and availability impact, while the vendor-feed CVSS 4.0 score of 5.1 reflects a lower PR:L/E:P reading of the same issue). Publicly available exploit code exists, and because the maintainer closed issue #3663 without a comment, PR, or fix, no vendor patch is available and defense currently depends entirely on refusing to load untrusted files or wrapping the load path in a restricted unpickler.
Stored cross-site scripting in code-projects Assessment Management 1.0 allows an authenticated administrator to inject arbitrary script through the user-editing form at admin/edit-user.php, where the name, sname, email, username, password, and id parameters are written into the database or rendered without proper output encoding. The payload executes in the browser of any user who later views the manipulated record, so exploitation requires both prior access to the admin interface (PR:H) and victim interaction (UI:P/UI:R), which caps the incremental privilege gained by the attacker. Publicly available exploit code exists and has been disclosed via a GitHub proof-of-concept, but there is no indication of confirmed active exploitation (CISA KEV) and no EPSS score was supplied; the disclosed CVSS 4.0 base score is 4.8, and this is best treated as a low-priority, high-noise hardening issue rather than an emergency.
Stored cross-site scripting in the admin symptom-management form (drug_recommender/Admin/add_symptom) of SourceCodester Drug Recommendation System 1.0 lets a user supply malicious content through the txtname argument that is later rendered in a browser without proper output encoding. The attack is remote but gated behind a high-privilege administrator account (CVSS PR:H) and requires a victim to view the affected admin page (UI:P/UI:R), which effectively restricts exploitation to the admin context - closer to self-XSS than a cross-privilege attack - and makes this a low real-world priority despite a public exploit. Publicly available exploit code exists (a GitHub PoC walkthrough linked from the CVE record); there is no indication of confirmed active exploitation (not in CISA KEV), and the independent assessment rates the overall real-world risk as low.
Signed 32-bit integer overflow in SerenityOS LibGfx's BMP decoder can crash the decoder when a victim opens a crafted BMP whose height field is INT32_MIN, affecting BMPLoader.cpp's decode_bmp_pixel_data and related DIB parsing. Publicly available exploit code exists, but exploitation requires user interaction and high complexity, and the realistic impact is minor availability loss only, with no code execution or data disclosure demonstrated. The CVSS 4.0 score of 2.3 and the independent assessment agree this is a low-priority issue.
Non-privileged applications running on a ZTE nubia Z80 Ultra (NX741J) smartphone can retrieve the device's Wi-Fi MAC address by querying the read-only factory_mac_address field exposed through the Android Settings.Secure content database, defeating the platform's normal restriction on hardware MAC address access. The issue is purely local (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N, base score 3.3, C:L/I:N/A:N), requires an attacker-supplied app to already be installed and executing on the handset, and leaks only a single low-sensitivity hardware identifier whose main value is device tracking rather than data compromise. According to available intelligence, no public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; deployment is limited to a single consumer handset model, which keeps overall risk low.
Command injection in the nexus_reauth MCP tool of 0-Gaurav-0/nexus-mcp lets an attacker who can invoke that tool and control its 'url' argument run arbitrary operating-system commands through the unsanitized child_process.exec call in src/auth/browser.ts. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), the project was notified via an issue report but has not responded, and because the project uses a rolling release model no fixed version is identified; the CNA scores the issue 2.1 under CVSS 4.0 while our independent assessment rates it 8.8 under CVSS 3.1, reflecting high confidentiality, integrity and availability impact on successful injection. Exploitation requires the nexus_reauth tool to be reachable and invokable and, per the PR:L vector, some low-level tool-invocation privilege rather than fully unauthenticated access, and the practical remote (AV:N) reach depends on whether the MCP server is actually network-exposed instead of local stdio only.
Unsafe pickle deserialization in the core load APIs of DLR-RM stable-baselines3 up to 2.9.0 lets an attacker who supplies a crafted model, replay buffer, or VecNormalize artifact achieve arbitrary code execution when a victim loads it via PPO.load, load_replay_buffer, or VecNormalize.load. The flaw is a CWE-502 pickle deserialization issue with no safe-mode gate or opt-in guard in these functions, and publicly available exploit code exists; the practical attack path is sharing or publishing a poisoned reinforcement-learning checkpoint that the victim is induced to load. Our assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - remote delivery is possible but exploitation still hinges on a victim choosing to load the malicious file, and successful loading grants full confidentiality, integrity, and availability impact in the victim's process.
Self-cross-site scripting (XSS) in SourceCodester Drug Recommendation System 1.0 allows an authenticated admin to inject arbitrary script via the txtoldpassword and txtnewpassword parameters in the Password Change form, but the impact is limited to the user's own browser session (self-XSS) with no path to attack other users. The vulnerability requires user interaction to submit the crafted form and has a CVSS 4.0 base score of 2.0 (Low). Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV).
Cross-site scripting in code-projects Assessment Management 1.0 allows an attacker who already holds an authenticated administrator session to inject script into the admin/add-user.php endpoint via the 'level' parameter, which is rendered back into the page without adequate output encoding. Exploitation requires user interaction - a privileged user must load the manipulated page - and the independent assessment rates the practical impact as low (integrity-limited script execution in the browser, no direct loss of confidentiality or availability). Public exploit code is available (a proof-of-concept writeup is linked from the NVD/VulDB references), but there is no indication of confirmed active exploitation in the wild.