Retained OAuth refresh tokens on hex.pm allow a user whose organization membership or session has ended to keep reading that organization's private packages and documentation tarballs. Refresh tokens are issued with the same issuer, audience and repository:<org> scope claims as access tokens, and the CDN that serves private repositories validates only the JWT signature and time claims, performing no membership lookup and unable to tell the two token types apart, so revocation takes effect only when the 30-day refresh token expires instead of at the 30-minute access-token lifetime. The actor must be an authenticated party who was a member when the token was granted, access is read-only and limited to organizations the account belonged to at grant time, and no public exploit has been identified at time of analysis; CVSS 4.0 base score is 2.3 (independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
SQL injection in TDuckCloud tduck-platform through version 5.3 lets an authenticated user inject arbitrary SQL through the orders[0].column sort parameter of paginated listing endpoints, which MyBatis-Plus concatenates directly into the ORDER BY clause. Successful exploitation primarily enables inferential (blind) reading of database contents, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N profile and the vendor's CVSS 4.0 score of 5.3 with PR:L and uniformly Low impacts. Proof-of-concept exploitation is publicly available (E:P, matching VulDB's 'exploit publicly available' note), but there is no CISA KEV entry, so confirmed active exploitation in the wild has not been established; no EPSS score was supplied for this record.
Code injection in mtrano APENCMS (rolling release, all builds up to commit 6546096d354153309693efabb9a0d824628ed4f5) lets a remote attacker who already holds high-privilege template or site administration access reach a PHP eval() call in cms/weasel.php through the $_CMS['site'] argument and execute arbitrary code on the server. Publicly available exploit code exists, while the vendor was contacted and did not respond, so no fixed build and no published version boundaries are available. The CNA's CVSS 4.0 base score of 1.9 (Low, all impacts rated VC:L/VI:L/VA:L) understates the technical severity: with attacker-controlled input flowing into eval(), successful exploitation is effectively full server-side code execution, and the attacker must already control the template/site variable (PR:H), consistent with template or site administrator rights rather than an unauthenticated default-configuration attack.