Improper neutralization of URL values in Plex Media Server's 'searchOne' parameter allows a remote attacker to invoke other plugins' functions and supply their own arguments, affecting all releases before 1.43.3.10861. The flaw is scored 6.9 (medium) under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N), and an independent assessment agrees on a network-reachable, low-complexity request-forgery/parameter-injection class issue with only LOW confidentiality and integrity impact and no availability impact: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. No public exploit code was identified at time of analysis (a third-party writeup is referenced in the source list, but that is not confirmation of weaponization), and the vector's PR:N claim should be validated in practice because Plex APIs commonly require a server token and real-world exposure depends on whether the server or its API is reachable beyond localhost.
Server-side request forgery in Plex Media Server before 1.43.3.10861 allows any authenticated user - including a low-trust account invited only to a shared library - to coerce the server into issuing HTTP requests to arbitrary internal or external addresses through the path parameter of the '/video/:/transcode/universal' endpoint. The attacker gains no code execution and the assessed impact is confidentiality-only and limited (CVSS 4.3, C:L/I:N/A:N), but the flaw is a useful internal-network reconnaissance and pivot primitive on internet-facing or flat-network deployments. No public exploit identified at time of analysis; exploitation requires a valid authenticated session and a server running a version prior to 1.43.3.10861.
Server-side request forgery in Plex Media Server before 1.43.3.10861 allows a low-privileged, token-bearing caller to force the server to POST to an arbitrary destination by putting a full URL in the 'protocol' parameter of the '/player/timeline' endpoint. Because any X-Plex-Token value is accepted, the authentication barrier is effectively trivial, but the assessed impact is limited to a blind outbound request (confidentiality-low, no integrity or availability effect) against hosts reachable by the Plex process. No CISA KEV entry and no confirmed exploitation have been reported, and no public exploit code was identified at time of analysis; the practical risk is a genuine but low-priority SSRF that matters most for internet- or DMZ-exposed servers that can reach sensitive internal services.
Catastrophic regex backtracking in the JLine3 `nano` editor's regex search mode allows an authenticated user to hang the editor session thread at high CPU, producing a denial of service. The flaw affects applications that embed `org.jline:jline-builtins` and expose the nano editor: `jline-builtins` 3.0.0 through 3.30.14 and 4.0.0 through 4.3.0 are impacted (CWE-1333, CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). A proof-of-concept reproduction, using a buffer of repeated 'a' characters and the pattern `(a+)+b`, is documented in the vendor advisory, and vendor-released patches exist in 3.30.15 and 4.3.1; no confirmed active exploitation (CISA KEV) or public exploit code beyond the advisory PoC has been reported. Practical severity depends on deployment: in a single-user local terminal the user only hangs their own session, whereas remote multi-user services that share worker threads can lose a server thread indefinitely.
Unauthenticated attackers can execute registered shortcodes server-side and read unpublished recipe content on WordPress sites with comments enabled that use the WP Recipe Maker plugin before 10.8.2. The vulnerability occurs because comment content is shortcode-expanded during structured metadata generation without stripping shortcodes, allowing any available shortcode to run. Publicly available exploit code exists, and the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating network-reachable, low-complexity exploitation with no authentication or user interaction and low confidentiality/integrity impact limited to shortcode capabilities and disclosure of unpublished recipes.
Cross-site request forgery in REDAXO CMS 5.21.1 and earlier lets a remote, unauthenticated attacker (CVSS PR:N with UI:R) lure a logged-in backend administrator into silently triggering an addon update or downgrade from the REDAXO package server via a single forged request to index.php?page=install/packages&rex-api-call=install_package_update. The attacker must know or guess a valid addonkey and target file id, and the admin must have an active session and visit an attacker-controlled page, so this is a genuine but conditional-risk flaw rather than a drop-everything emergency; absent a supply-chain compromise of a redaxo.org package or a vulnerable prior version to downgrade to, the practical impact is limited to forced or unwanted addon installs and site disruption. No active exploitation in CISA KEV has been reported, and no public exploit identified at time of analysis beyond the minimal image-tag proof-of-concept published in the vendor advisory.
Denial of service in python-hyper/hpack prior to 4.2.0 allows unauthenticated remote attackers to force run-away computation by supplying malformed HTTP/2 header input containing a variable-length integer encoded as a long run of 0xFF octets; the pre-fix decoder imposes no upper bound on the integer length, producing O(n^2) decoding work that effectively blocks the processing path. The library is a core HPACK header-compression dependency of Python HTTP/2 stacks (h2/hyper), so any internet-facing or otherwise reachable Python HTTP/2 server or client that decodes attacker-influenced headers is exposed, though impact is limited to availability of the affected worker with no confidentiality or integrity effect. No KEV entry or public exploit code was identified at time of analysis, and risk is bounded: the vendor-released fix in hpack 4.2.0 caps variable integer decoding to uint32, and a documented input-sanitization workaround exists.
Arbitrary shortcode execution in the WordPress plugin Ninja Tables before 5.2.17 lets an unauthenticated visitor execute arbitrary shortcodes and permanently break a public page by submitting an ordinary form entry, provided the site is running a non-default configuration in which user-submitted rows are rendered with shortcode expansion. Affected sites require no authentication and no victim interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L, score 5.6); default installations do not expand shortcodes in non-administrator-authored rows and are therefore not exposed, which is why the vendor rated attack complexity as High. Publicly available exploit code exists via the WPScan advisory, but there is no indication of confirmed actively exploited (CISA KEV) status, so priority is bounded by the configuration prerequisite.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows attackers to manipulate the test_id parameter in /reviewer_0/admins/assessments/pretest/exam-delete.php, potentially reading or altering database contents. Publicly available exploit code exists, but practical exploitation requires reaching the administrative interface and likely a valid admin session despite the CVSS 4.0 vector indicating no privileges; the product's rare deployment footprint further limits real-world risk. This is a classic high-nominal/low-real-risk finding with limited confidentiality, integrity, and availability impact.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets an attacker who can reach the administrative assessment endpoint inject arbitrary SQL through the test_id parameter of /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update, exposing and potentially altering stored review and assessment data. Publicly available exploit code exists (a proof-of-concept is published in the GitHub issue referenced by VulDB), and the vendor has not shipped a fixed version. Because the vulnerable path sits under /admins/, exploitation in practice most likely requires a valid administrative session, making reachability of the admin area and credential strength the primary limiting factors; the CVSS 4.0 score of 6.9 treats it as PR:N, our own assessment rates it CVSS:3.1 AV:N/AC:L/PR:L/UI:N with high confidentiality and low integrity impact.
SQL injection in SourceCodester Online Reviewer Management System 1.0 lets remote attackers inject arbitrary SQL through the difficulty_id parameter on the /reviewer_0/admins/assessments/databank/btn_functions.php endpoint when action=add, allowing partial read, modification, and disruption of the underlying database. The vendor-supplied CVSS 4.0 score is 6.9 with a vector claiming no privileges or user interaction required (PR:N/UI:N), but the vulnerable path sits inside the /admins/ administrative area, which in typical deployments is only reachable behind an authenticated administrator session - an independent assessment re-rates it as CVSS 3.1 AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity, and availability impact. Publicly available exploit code exists and has been published alongside the disclosure, and there is no indication of confirmed active exploitation (no CISA KEV listing), while exploitation is further constrained by how few instances of this obscure PHP application are deployed and internet-reachable.
Missing authorization in the Abdurrab5 Online Makeup Store PHP application allows unauthenticated remote attackers to reach admin-only functionality by supplying a crafted adminid argument to the confirm_logged_in/confirm_user functions in functions.php, enabling low-impact confidentiality, integrity, and availability effects. Publicly available exploit code exists-including a GitHub write-up-but no CISA KEV confirmation or EPSS data is provided, so active exploitation is not confirmed. The vendor uses a rolling release with no version metadata, meaning all deployments of this codebase should be considered potentially affected, though the project's niche, single-developer nature limits its real-world attack surface.
Unauthenticated account creation in Neethuharii CafeManagement lets any remote attacker who can reach the AddCashierCode.php endpoint provision a new cashier account with attacker-chosen uname, pass, role and status values, because the addcashier function performs no authorization check (CWE-285). Publicly available exploit code exists - a third-party GitHub writeup demonstrates the missing-authentication account-creation path - but there is no sign of active exploitation and the CVE is not in CISA KEV. The vendor was contacted early and never responded, so no fixed release is available; the practical impact is bounded to Low confidentiality, integrity and availability effects (cashier-level account creation rather than administrative takeover) and should be weighed against the project's limited real-world production footprint, meaning the headline CVSS 4.0 score of 6.9 overstates real-world priority.
SQL injection in DataLife Engine 18.0 allows remote, unauthenticated attackers to manipulate the 'story' parameter in the Search Module's strip_data function, potentially leading to partial data disclosure or modification. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no vendor-released patch is identified at time of analysis. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network reachability without privileges or user interaction, though impact is limited to low confidentiality and integrity loss per the assessed CVSS 3.1 vector.
Remote unauthenticated SQL injection in the Abdurrab5 'online-makeup-store' customer login handler (customerSignin.php) allows attackers to inject arbitrary SQL via the username or password arguments, potentially leading to full database compromise with high confidentiality and integrity impact. The flaw is confirmed by a publicly available exploit write-up on GitHub, and the CVSS 4.0 vector carries the E:P proof-of-concept maturity flag, though exploitation in production is expected to be rare due to the niche deployment footprint of this individual-developer application. No vendor patch is available at time of analysis, and the project uses a rolling release model, so no fixed version can be identified.
Unauthenticated SQL injection in the Online Makeup Store PHP application lets remote attackers manipulate the 'id' and 'password' parameters of index.php's Admin Login Handler. Because the injectable parameters sit on the public login endpoint, no credentials, user interaction, or special configuration are required, and publicly available exploit code exists (no CISA KEV listing). Practical risk is dominated by deployment scarcity: this is an individual developer's project with no versioned releases and negligible production footprint, so few real targets are likely to exist even though any reachable instance is exploitable.
A crafted HISTORY_IGNORE value can hang a JLine reader session (org.jline:jline-reader) via catastrophic regular-expression backtracking, pinning the reader thread at high CPU each time a command line is written to history. Applications that embed JLine 3.x (>= 3.0.0, < 3.30.15) or 4.x (>= 4.0.0, < 4.3.1) and let HISTORY_IGNORE be set from user configuration or application settings are affected; the impact is limited to denial of service with no confidentiality or integrity effect. The attacker must already be able to control configuration (CVSS vector PR:L, AV:L), so this is a low-to-moderate real-world priority; no public exploit code was identified at time of analysis, although the vendor advisory documents deterministic reproduction steps, and vendor patches shipping the fix are available in 3.30.15 and 4.3.1.
Unauthenticated SQL injection in CafeManagement's CafePortalLogin.php login handler allows remote attackers to bypass authentication and potentially read or modify backend data. Publicly available exploit code exists, including a Medium writeup, and the vendor did not respond, leaving a rolling-release product without an official patched version; severity signals conflict, with the supplied CVSS 4.0 score of 5.5 understating the independently assessed high confidentiality and integrity impact.
Unrestricted file upload in the AddProductCode.php endpoint of Neethuharii CafeManagement lets unauthenticated remote attackers upload arbitrary files, including PHP scripts, by manipulating the 'image' parameter - a public proof-of-concept writeup by researcher 'mr.yk404' describes achieving remote code execution through this path, and exploitation requires no authentication, privileges, or user interaction (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, E:P). The vendor was contacted but did not respond, and because CafeManagement uses a rolling release model, no affected or fixed version numbers are published; the CPE entry (cpe:2.3:a:neethuharii:cafemanagement:*:*:*:*:*:*:*:*) treats all versions as potentially vulnerable. Vendor scoring places this at CVSS 4.0 6.9, while our independent assessment rates it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) because successful upload of executable content to a web-reachable directory yields full confidentiality, integrity, and availability impact; the practical limiter is deployment scarcity, as this is a niche hobbyist application rarely exposed in production.
Improper authorization in the WPGraphQL WordPress plugin's updatePost GraphQL mutation allows an authenticated Contributor to publish their own draft posts without the publish_posts capability and to edit their own already-published posts without edit_published_posts, bypassing the site's editorial approval workflow. Confirmed in WPGraphQL 2.19.0 under default settings; the equivalent requests against the WordPress REST API are correctly rejected with rest_cannot_publish and rest_cannot_edit. Impact is bounded - the attacker must already hold a valid Contributor account (unauthenticated exploitation is not possible), can only touch posts they own, and cannot escalate privileges, modify other authors' content, or execute code; no public exploit code was identified at time of analysis, and the issue is rated MEDIUM (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
Unauthenticated ANSI/VT100 escape-sequence injection in the Mesop web framework's /__csp__ CSP-reporting endpoint (pip package mesop <= 1.3.3) allows remote attackers to embed terminal control sequences in JSON report fields such as blocked-uri and document-uri, which are passed straight to print() and written to stdout unsanitized. A public proof-of-concept payload is documented in the vendor advisory; when an operator later views the raw application stdout in an ANSI-capable terminal, the injected sequences can clear the screen, move the cursor, hide text, or render forged messages such as a fake 'SECURITY OK - No CSP violations found' banner, corrupting the integrity of operator-facing logs. The assessed risk is low-to-moderate and is purely a log-integrity issue: there is no confidentiality, availability, or server-side integrity impact, the attack requires a human to view rendered logs (UI:R), and logs consumed by JSON aggregators, SIEMs, or other non-rendering pipelines neutralize the sequences. Vendor-released patch: 1.3.4.
Unauthenticated remote attackers can mark pending WooCommerce orders as paid without completing payment by abusing the SUMIT Payment Gateway for WooCommerce plugin before version 4.0.0, which accepts payment notifications without validating them against the SUMIT payment provider. The vulnerability is network-reachable with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) and is confined to falsifying order payment status, i.e. financial fraud rather than site compromise; publicly available exploit code exists, though there is no confirmation of active exploitation (not in CISA KEV). Risk is bounded mainly by the niche adoption of this specific gateway and by the fact that the integrity impact is limited to order state.
Content spoofing in Foxit PDF Editor and Foxit PDF Reader allows remote attackers to alter visible content in incrementally updated PDFs without invalidating an existing digital signature, so the document continues to appear validly signed. Publicly available exploit code exists for this CWE-347 signature verification flaw, but no active exploitation has been confirmed. The attack requires user interaction (opening the document) and is high complexity (AC:H) but unauthenticated (PR:N), yielding high integrity impact without confidentiality or availability loss.
Server-side Twig template injection in Solspace Freeform 5.0.0 through 5.10.13 for Craft CMS 5.x lets unauthenticated attackers submit Twig expressions through public forms that are evaluated by Freeform's isolated Twig renderer when field values are rendered back into HTML attributes (the vendor fix excludes the value, name, and id attributes from rendering). Confirmed impact is limited to disclosure of PHP/core and Craft bootstrap constants such as PHP_VERSION, PHP_OS, CRAFT_BASE_PATH, and CRAFT_VENDOR_PATH, plus possible form rendering errors from malformed Twig; no access to Craft globals, getenv(), alias(), database or mailer credentials, security/license keys, arbitrary files, or code execution was demonstrated in testing. Publicly available exploit code exists in the form of one-line payloads published in the vendor's GitHub security advisory (e.g. {{ constant('PHP_VERSION') }}@example.com), but there is no evidence of confirmed active exploitation (not listed in CISA KEV); CVSS 5.3 and the advisory's isolated-sandbox findings indicate low severity.
Missing reCAPTCHA verification in the Paid Membership Subscriptions WordPress plugin before version 3.1.0 lets unauthenticated attackers create user accounts without solving the CAPTCHA the site has enabled, by simply omitting the reCAPTCHA form field from the registration request. Publicly available exploit code exists (documented by WPScan), though there is no confirmed active exploitation per CISA KEV. The impact is a protection-mechanism bypass rather than data exposure or code execution - the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - and it only affects sites that run an affected version and have reCAPTCHA enabled on the registration form.
Unauthenticated attackers can forge payment webhook requests to mark arbitrary WooCommerce orders as paid without any money changing hands in the Paymob for WooCommerce WordPress plugin before version 4.1.14. The weakness is confined to one branch of the plugin's payment webhook handling that omits request-signature verification, so no credentials and no user interaction are required - only that the store runs the vulnerable plugin with its webhook endpoint network-reachable. Publicly available exploit code exists, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3 MEDIUM) reflects a remote, unauthenticated business-logic integrity impact rather than data theft or code execution.
Unauthenticated metadata injection in the Forminator Forms WordPress plugin before 1.57.2.1 allows any visitor who submits a public form to attach arbitrary metadata keys - including keys WordPress reserves for its own use - to the post that submission creates. The issue is confined to forms explicitly configured with Forminator's post-creation feature (forms that collect post content and publish a post per submission); ordinary contact, lead, or newsletter forms that never create posts are not exposed, which keeps real-world reach narrow and impact low (integrity-only). Publicly available exploit code exists per the WPScan reference, exploitation status is not confirmed actively exploited (CISA KEV) and no EPSS value was supplied; the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N yields a 5.3 base score, consistent with a low-to-moderate priority finding.
Unauthenticated attackers can bypass the per-visitor voting limit and falsify the submitter address recorded for form entries in the Forminator Forms WordPress plugin before 1.57.2.1. The plugin prefers client-supplied forwarding headers such as X-Forwarded-For over the actual connecting address without first confirming the request originated from a trusted proxy, so every attacker-controlled request appears to come from a different, self-chosen IP - breaking both the vote-throttling logic and the integrity of stored submission metadata (rated CVSS 5.3, integrity-only impact, no code execution, data disclosure, or availability loss). Publicly available exploit code exists per the WPScan advisory, making this trivially reproducible; it is not reported as confirmed actively exploited (no CISA KEV entry), and exploitation of the voting bypass requires the site to actually host a Forminator poll.
Stored cross-site scripting in REDAXO CMS 5.21.1 and earlier allows an attacker who can place a file with HTML metacharacters in its filename into the /media directory to inject JavaScript that runs in the browser of any backend user who opens Mediapool → Sync, enabling session-cookie theft and potential CMS takeover. The flaw lives in the mediapool addon's sync.php, which renders unregistered filesystem filenames into HTML without rex_escape(); exploitation requires high privilege (admin-level backup restore or direct server/filesystem access) plus a victim holding the media[sync] permission who loads the page, so it is not reachable by an unauthenticated remote attacker on a default install. It is correctly rated LOW at CVSS 4.8, with no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV), although the vendor advisory documents a step-by-step proof-of-concept reproduction path; a vendor patch is available in REDAXO 5.21.2.
Stored cross-site scripting in REDAXO CMS 5.x (affecting versions up to and including 5.21.1) lets an authenticated backend administrator plant HTML/JavaScript in a Media Manager effect type's name field, which is later rendered unescaped inside the 'media is in use' warning shown when another administrator tries to delete a referenced media file. Successful exploitation requires a second, victim administrator to click the Delete button on a specifically referenced media item, after which the payload runs in the victim's backend session and can be used for session hijacking, credential harvesting, or CSRF-token theft leading to full backend account takeover. Rated CVSS 3.1 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), this is a low-priority issue: it is not listed in CISA KEV and there is no evidence of active exploitation, though the vendor advisory publishes a full step-by-step proof-of-concept reproduction (publicly available exploit code exists). No EPSS score or in-the-wild telemetry was provided with this report.
Server-side shortcode execution can be triggered through the GTranslate WordPress plugin before 5.0.1, which fails to strip shortcodes from outgoing email content before expanding them. Unauthenticated remote attackers can exploit this only when the plugin is configured in a non-default way that places user-influenced content into email bodies passed through WordPress shortcode expansion, and only if a useful shortcode is already registered on the site; both prerequisites keep the practical impact bounded and are reflected in the assessed CVSS score of 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists via the WPScan advisory, and there is no indication of confirmed active exploitation (CISA KEV); this is a real but low-priority issue.
Denial of service in Caddy Server 2.11.3 and earlier allows remote unauthenticated attackers to exhaust server memory by sending large request bodies when the site configuration resolves the http.request.body placeholder. The unbounded io.Copy in replacer.go reads the entire body before request-body size-limit middleware can apply, leading to process termination. This is not exploitable in default configurations; it requires an operator-defined Caddyfile that uses the placeholder. No public exploit identified at time of analysis, and the attack only affects availability (CVSS 3.1 A:L).
Denial of service in RabbitMQ prior to versions 4.2.7 and 4.3.1 allows a remote, authenticated user holding the 'policymaker' tag to crash a broker node by exhausting the Erlang atom table. The runtime-parameters API lookup path coerces the attacker-controlled :component URL segment into a brand-new atom on every request, and because the atom table is bounded and atoms are never garbage collected, roughly one million requests with distinct component values are enough to fill it and bring the node down. Impact is availability-only (no data exposure or modification), exploitation requires high privileges and a very large request volume, and no public exploit code has been identified at time of analysis - the independent assessment rates this a moderate, low-urgency issue and the vendor has released fixed versions 4.2.7 and 4.3.1.
Denial of service in RabbitMQ affects every server release prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, where importing a crafted definitions file can exhaust the Erlang atom table and crash the node. The issue is reachable only by an authenticated user holding the RabbitMQ administrator tag: a definitions import containing a vhosts entry with roughly one million unique metadata keys slips under the 20 MB management body limit and is passed by add_vhost/2 into the unsafe rabbit_data_coercion:atomize_keys/1 path (binary_to_atom) with no whitelist or cap, killing the node that processes the request. Impact is limited to availability loss on a single node (no disclosure or tampering), exploitation is gated behind administrator privileges, and no public exploit code was identified at time of analysis; vendor-released fixes are available in the versions listed above.
Unauthenticated JCR-SQL2 injection in Sulu CMS 2.6 (before 2.6.25) and 3.0 (before 3.0.8) allows an anonymous visitor to manipulate the content-repository query generated by category-filtered Smart Content blocks, disclosing or enumerating nodes they should not see - including unpublished content - and degrading availability with malformed or expensive query fragments. No authentication, no user interaction, and no configuration beyond a publicly reachable page containing a category-filtered Smart Content element is required, though exploitation is contingent on that deployment-specific feature being exposed. The flaw is fixed in 2.6.25 and 3.0.8 via an integer cast on category, tag, and audience-target-group IDs; no public exploit code has been identified at time of analysis and no EPSS data was supplied, and the impact is confined to read/enumeration and denial-of-service since this path cannot modify repository data.
Second-factor authentication bypass in Keycloak's Conditional OTP authenticator allows an attacker who already possesses a user's password to skip OTP verification by sending a crafted HTTP header, provided the realm is configured to evaluate headers for OTP-skipping without validating their source. This flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7, has a CVSS score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and requires a non-default configuration plus a compromised first factor, meaning it is an account-targeted MFA bypass rather than unauthenticated remote compromise. No public exploit has been identified at the time of analysis.
SQL injection in the WordPress plugin Booking Manager versions before 2.1.21 allows an authenticated user holding Author-level privileges or higher to read arbitrary data from the site's database by importing an external iCalendar (.ics) feed whose field values the plugin passes unsanitized into a SQL query. Exploitation is constrained: the attacker must already hold the Author role (or above) and must be able to point the plugin's feed import at an attacker-controlled calendar source, and no victim interaction is required. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV), so risk is assessed as genuine but constrained rather than broadly exploitable, with confidentiality of database contents as the primary impact.
Stored cross-site scripting in the Subscribe Forms WordPress plugin before 1.6.3 allows an authenticated user with the Author role or higher to inject JavaScript into a form setting that is later rendered without sanitisation, so the payload executes in the browser of any visitor - including logged-out users and administrators - who loads a page that embeds that form. Exploitation is gated by two conditions: the attacker must hold a privileged WordPress account on the target site, and a victim must actually view a page containing the affected form (user interaction is required for the payload to fire). No public exploit code or CISA KEV entry has been identified at time of analysis, and the practical risk is moderate rather than top-tier because a valid Author+ credential is a prerequisite and the outcome is client-side script execution rather than direct server compromise.
Improper privilege management in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets an attacker who already holds a low-privileged authenticated account on the management interface escalate to unauthorized access with high confidentiality and integrity impact (CVSS 6.8, AV:N/AC:H/PR:L/UI:N). The weakness maps to CWE-269 and requires network reachability plus a non-trivial precondition (AC:H), so it is not triggerable by a fully unauthenticated remote attacker. No public exploit code has been identified and the flaw is not confirmed actively exploited (CISA KEV), so urgency is moderate and driven primarily by the mandatory low-privilege foothold; the vendor-released fix is version 5.34.00.16.
Stored cross-site scripting in the JSM Show Post Metadata WordPress plugin before 4.9.1 lets an authenticated contributor-level user inject arbitrary JavaScript that runs in the browser session of a higher-privileged editor or administrator. The flaw is a missing output-escape of a post meta key that is echoed into an inline event-handler attribute inside the plugin's admin-facing meta box; the payload only fires when a privileged user opens the attacker's post in wp-admin to review it. Exploitation is therefore second-order and UI-dependent rather than remote-unauthenticated: it requires a contributor account on a site running the vulnerable plugin plus reviewer interaction, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in HappyAddons for Elementor (all versions before 3.50.0) lets an authenticated attacker holding only Contributor-level access or above inject event-handler attributes through the icon value of one of the plugin's button widgets, which the plugin then writes into an HTML attribute without escaping. When a higher-privileged user - an editor, administrator, or any reviewer who opens or previews the crafted page - views that content, the injected JavaScript runs in their session, giving the Contributor a way to bypass the unfiltered_html capability they normally lack. Exploitation requires a valid low-privilege account plus victim interaction (UI:R), there is no public exploit code identified at time of analysis, and the vendor has released HappyAddons for Elementor 3.50.0 as the fix.
Stored cross-site scripting in the Real3D Flipbook WordPress plugin (all versions before 5.4) allows authenticated users with at least the Author role to inject arbitrary JavaScript into several flipbook editor fields, because those fields are neither sanitized on input nor escaped on output. The payload is stored and later fires in the browser of any higher-privileged user - typically an administrator - who opens the affected flipbook for editing, meaning the attacker only needs to plant the content and wait for a privileged victim to interact with it. No public exploit code has been identified at time of analysis and there is no indication of active exploitation (not listed in CISA KEV); the assessed severity is moderate and exposure is limited to sites that grant untrusted users Author-or-above privileges, such as multi-author or membership-driven installations. Patch available per vendor advisory: upgrade to 5.4 or later.
Missing capability checks in the Real3D Flipbook WordPress plugin before 5.4 allow authenticated users with Author-level access or higher to delete other users' flipbook content and overwrite administrator-only global plugin settings, which can be abused to store JavaScript that later executes in the browser of any visitor or administrator who views the affected pages. This is a genuine but conditional broken-access-control flaw (CWE-862) that requires an authenticated foothold rather than being open to anonymous visitors, and the stored-script payoff additionally depends on a victim subsequently rendering the poisoned global settings. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; the vendor has released a fix in version 5.4.
A local denial-of-service condition affects Ghidra versions before 12.1.4, where the software-suite's OptionsDB.createUnregisteredOption() routine fails to validate the TYPE_COL byte of an imported program database, triggering an ArrayIndexOutOfBoundsException. The exception path skips the lock-release logic in AbstractTransactionManager, leaving domain objects permanently locked so the application stalls and cannot clean up resources or shut down gracefully. Exploitation is not remote: it requires a Ghidra operator to be socially engineered into importing a maliciously crafted program database file (CVSS 4.0 base 6.8, AV:L/UI:P, availability-only impact), and no authentication or special configuration is needed. At time of analysis there is no public exploit code identified and no evidence of active exploitation, so this is best treated as a genuine but low-priority availability bug rather than a critical flaw.
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 allows an unauthenticated attacker holding a man-in-the-middle position on an adjacent network segment to intercept and tamper with the appliance's TLS-protected traffic and to bypass protection mechanisms. The CVSS vector (AV:A/AC:H/PR:N/UI:N, C:H/I:H/A:N) confirms the attacker needs no credentials and no user interaction, but must be able to spoof or intercept traffic on the same/shared network and present a forged certificate that the affected component accepts, which keeps attack complexity high and makes this a moderate, defense-in-depth-grade issue rather than an internet-reachable emergency. No public exploit code identified at time of analysis and no confirmed active exploitation; a vendor patch is available.
Out-of-bounds write in BusyBox's passwd and group applets allows an authenticated attacker with high privileges (PR:H) to corrupt heap memory via a stale endpoint pointer after field trimming. The vulnerability (CVSS 6.7, CWE-787) is local-only (AV:L), requires no user interaction (UI:N), and is confined to the host (S:U), meaning a would-be attacker must already hold root or equivalent privileges to supply the malformed passwd/group entry. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was provided; the primary limiting factor is the PR:H requirement, which makes this a defense-in-depth hardening issue rather than a remotely reachable attack.
Argument injection in Red Hat Ansible Automation Platform 2's automation-controller system-job subsystem allows an authenticated user with superuser privileges to inject arbitrary command-line arguments into the control-plane awx-manage process, gaining control of its argument vector and the first entry of its Python module search path. The root cause is that the system-job template launch endpoint stores a caller-supplied 'days' value without applying the integer validation used elsewhere for that field, and the dispatcher flattens the management-command argument list into a single space-delimited string that the job runner re-splits, so embedded spaces become additional arguments; system jobs run in-process on the control node without the container isolation applied to other job types. Confirmed remote code execution does not follow from the injected arguments alone - it would require an additional import gadget that is not present in the current management commands - so the demonstrated impact is argument injection and search-path control rather than code execution, and no public exploit was identified at time of analysis.
TLS peer impersonation in Red Hat Ansible Automation Platform 2's automation-controller instance install-bundle endpoint lets an authenticated controller System Administrator obtain a mesh-CA-signed X.509 certificate that TLS peers will accept as a different control node. The flaw arises because a caller-chosen instance hostname is copied verbatim into the certificate's Common Name, DNS SAN, and receptor node-id, and the hostname charset validator is case-insensitive while the uniqueness validator is case-sensitive, so a case variant of an existing control node's hostname passes registration and yields a hard-coded ten-year, non-revocable mesh peer credential. Realizing the impact additionally requires an on-path/man-in-the-middle position on the receptor mesh, and the scenario is most meaningful in managed or hosted deployments where a customer holds controller superuser while the platform operator runs the mesh; there is no public exploit identified at time of analysis, and the flaw does not grant direct remote code execution because receptor work submission is gated by a separate signing key absent from the bundle.
CVE-2026-96279 is tracked against software maintained in the Ubuntu archive, based on the only source of intelligence available: a report attributed to the vendor:ubuntu channel that cross-references GitHub advisory GHSA-9rww-v4mm-x4jg. The advisory text itself was not supplied and could not be retrieved, so the vulnerable component, version range, attack vector, and security impact remain undefined; no CVSS score, CVSS vector, or CWE classification was provided. No public exploit code has been identified at time of analysis, and there is no KEV listing or EPSS signal to indicate active exploitation, so the practical risk cannot be meaningfully assessed until the underlying advisory is read. The authenticated/unauthenticated question cannot be answered because no CVSS vector containing PR metrics was provided, and no fix version appears in the available data.
Path traversal in Flatpak's `flatpak build-init` command allows an attacker-controlled SDK container to write arbitrary files outside the developer's working directory when that developer builds against the SDK using both the `--writable-sdk` and `--sdk-extension` flags. The root cause (CWE-22) is that the SDK's declared extension-point `directory` value is resolved through a path helper that does not reject `..` components, so a malicious SDK can steer writes outside the intended build root. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is a local, user-interaction-dependent action rather than the remote 9.8 originally submitted; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the attacker must convince the developer to consume a hostile SDK, which severely limits real-world exposure.