Stored cross-site scripting in HumHub 1.18.5 lets an authenticated user who holds the delegated, non-system-administrator 'Manage Users' permission (admin_manage_users) inject persistent HTML/JavaScript through a Profile Field Category title, which is later rendered unescaped into the page. The payload executes in the browser of any other user or administrator who views the affected profile-field configuration or rendering page, so exploitation is precondition-gated: it requires a high-privileged management account and victim interaction, making this a real but modest insider/compromised-privileged-account risk rather than open unauthenticated access. No public exploit code or confirmation of active exploitation was identified at time of analysis, and the upstream fix is available as PR #8499 in the HumHub repository.
Path traversal in Plex Media Server before 1.43.3.10861 lets an attacker who can reach the /system/agents/media/get endpoint read files accessible to the targeted Plex user by supplying ../ sequences in the url parameter. The primary exploitation path requires a valid Plex session token (the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, i.e. authenticated), while a secondary, lower-barrier path lets a LAN-adjacent attacker supply a crafted X-Forwarded-For header that the server trusts as evidence of local context. Read access is nominally bounded by the victim account's permissions, but because the reachable files include the PlexOnlineToken store, successful exploitation escalates from file disclosure to full Plex account and server takeover; no CISA KEV entry or public exploit code appears in the supplied intelligence, and a vendor fix is available in version 1.43.3.10861.
Photoview through 2.4.0 contains an authorization bypass in the shareAlbum GraphQL mutation that lets any authenticated low-privileged user generate valid share tokens for albums owned by other users. Because album IDs are sequential integers, an attacker with a normal account can enumerate IDs and create working share links without needing any elevated privileges; distributing the resulting link exposes the victim's photos and sub-albums. Exploitation requires a multi-user deployment and an authenticated session, and no public exploit code has been identified at time of analysis, though the vendor has released an upstream fix.
Denial of service in RabbitMQ versions prior to 4.2.7 and 4.3.1 allows any authenticated AMQP 0-9-1 client to crash the entire Erlang VM, taking down all vhosts and connections, by exhausting the atom table with roughly one million requests. The attack exploits the direct reply-to feature: queue names or routing keys beginning with 'amq.rabbitmq.reply-to.' cause an ETF-encoded pid node name to be passed to binary_to_atom without using binary_to_existing_atom, and because atoms are never garbage collected, the try/catch cannot reclaim them. Exploitation requires a valid AMQP connection (any credential, any permission level) and the ability to send the large number of operations; no public exploit identified at time of analysis.
Authenticated but low-privileged users of Red Hat Ansible Automation Platform 2 can bypass the automation-controller's sanitize_jinja() input-validation guard and have ansible-core evaluate attacker-supplied Jinja inside the execution environment, yielding arbitrary command execution and disclosure of secrets belonging to credentials the attacker cannot normally read. The flaw is exploitable remotely with no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N per independent assessment) and requires only a controller account able to set one of the affected launch-time fields. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; priority is bounded by the required authenticated foothold and the niche deployment footprint.
Denial of service in RabbitMQ Server (versions prior to 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15) allows an authenticated AMQP 0-9-1 client with publish permission to exhaust broker memory by declaring an excessive content-header BodySize and streaming message fragments without completing assembly. The unvalidated uint64 BodySize bypasses the max_message_size check, which only runs at assembly completion, causing unbounded memory accumulation in the reader process until the memory alarm triggers or the node runs out of memory, degrading all publishers cluster-wide. No public exploit code has been identified at time of analysis, and vendor patches are available.
Denial of service in Robur Albatross (specifically the albatross-console component) versions 1.0.0 through 2.x before 2.7.2 lets an authenticated user who can send console subscription commands drive the albatross-console process into an unterminated loop over the unikernel log ring buffer, consuming CPU and making console access unavailable. Exploitation requires the targeted unikernel to have generated enough output to fill the 1024-line ring buffer, and the request must specify a very high or negative line count, or a timestamp earlier than every buffered message; the vendor states it is not exploitable by unauthorized clients, and the independent assessment confirms PR:L with availability-only impact (C:N/I:N/A:H). No public exploit code has been identified at time of analysis, so this is a genuine but bounded availability risk rather than a high-urgency threat.
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let unauthenticated attackers execute unauthorized payment actions against the payment-action interface, compromising transaction integrity with a limited availability impact (CVSS 3.1 base 7.1, CWE-862). The assessed vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) means the attacker must already sit on an adjacent network - the same LAN segment, an established VPN, or the OpenShift cluster/service-mesh network - rather than reaching the service from the open Internet, so exposure is bounded by network placement even though no credentials or user interaction are required. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); this reads as a genuine but moderate-priority integrity issue rather than an inflated high-severity finding, and IBM has published a fix.
SQL injection in the Tainacan WordPress plugin through version 1.2.0 lets an attacker with an authenticated Subscriber-level account inject arbitrary SQL into one of the plugin's database queries, potentially reading sensitive data from the underlying WordPress database. The prerequisite is meaningful: the site must permit low-privilege account creation (for example, WordPress self-registration enabled), which substantially narrows the exposure for sites with registration disabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor's own vector (AC:H) indicates some crafting or precondition beyond a trivial payload, keeping this a genuine but bounded threat rather than an opportunistic mass-exploitation risk.
Reflected cross-site scripting in the WordPress plugin Calculated Fields Form affects all versions up to and including 5.5.1.1 and allows an unauthenticated remote attacker to execute script in the browser of a user who follows a crafted link or loads a malicious page. The assessed impact is confined to client-side execution inside the target site's origin (low confidentiality and integrity impact, with scope change), and the attack relies on victim interaction, so higher-value outcomes require luring a privileged user such as a site administrator. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and the available intelligence does not confirm a fixed release.
Reflected cross-site scripting in Core Web Vitals & PageSpeed Booster, a WordPress performance plugin, affects versions 1.0.31 and earlier and lets an unauthenticated remote attacker get arbitrary script executed in a victim's browser session, carrying a CVSS 3.1 base score of 7.1 (High). Exploitation is not autonomous: it requires a victim (a site visitor or a logged-in administrator) to interact with an attacker-crafted request or link that reaches the vulnerable input-handling code path, so realistic abuse depends on phishing or social engineering, and the specific vulnerable parameter or page is not disclosed in the available intelligence. No public exploit code and no confirmed active exploitation are identified at time of analysis.
Reflected cross-site scripting (XSS) in the Ninja Forms WordPress plugin through version 3.15.3 allows unauthenticated attackers to inject and execute arbitrary script in a victim's browser when the victim is tricked into loading a crafted link (UI:R). Reported by Patchstack, no public exploit identified at time of analysis, and the assessed impact is limited to client-side script execution within the site origin due to required user interaction and no server-side code execution. The CVE record assigns a CVSS score of 7.1, but our independent assessment notes no availability impact (A:N) and characterizes the issue as moderate severity.
Reflected cross-site scripting in the Razorpay Payment Button WordPress plugin (versions ≤ 2.4.9) allows unauthenticated attackers to inject arbitrary web script or HTML via a crafted link that a victim must click. The vulnerability requires user interaction (UI:R) and impacts the victim's browser session, with no server-side compromise. Despite a vendor CVSS score of 7.1, the real-world risk is modest due to the mandatory user interaction and limited scope of impact; no public exploit code or active exploitation is reported at this time.
Reflected cross-site scripting in Mang Board WP, a WordPress plugin, affects version 2.4.1 and earlier and allows an unauthenticated attacker to get arbitrary script executed in a victim's browser session by persuading that victim to open a crafted URL. Exploitation is not server-side or automatic: it requires the plugin to be installed and active on a WordPress site and requires the victim to click the malicious link (UI:R, PR:N per the assessed vector), which limits this to targeted or social-engineering delivery rather than mass exploitation. No public exploit code and no confirmed active exploitation were identified at time of analysis, and our independent assessment rates this a genuine but low-priority issue with low confidentiality and integrity impact and no availability impact.
WP Photo Album Plus versions up to and including 9.3.02.002 contain a reflected cross-site scripting (XSS) flaw that allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by tricking them into clicking a crafted link. Successful exploitation requires user interaction and results in low confidentiality and integrity impact within the victim's session, potentially enabling cookie theft or content manipulation. Despite a CVSS base score of 7.1, the real-world risk is considered low-priority because the attack is non-persistent and depends on social engineering; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated reflected cross-site scripting in the WordPress plugin WPS Limit Login (versions up to and including 1.5.9.3) lets a remote attacker craft a URL that injects script into a page served by the affected site, executing in the browser of any victim who loads the link. Because the injected script runs in the site's origin, an attacker could hijack an authenticated administrator's session, perform actions as that user, or redirect visitors, though exploitation is not automatic - it requires the victim to interact with the crafted link, and impact is confined to the client-side browser session rather than the WordPress server. The flaw carries a CVSS 3.1 base score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and no public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin through version 5.29.4 enables remote attackers to inject malicious scripts into pages viewed by victims, potentially allowing session hijacking or defacement if a privileged user is tricked into interacting with a crafted link. The vulnerability requires victim interaction (UI:R) and is exploitable without authentication (PR:N), but impact is limited to the victim's browser context (C:L/I:L, S:C). No public exploit code or active exploitation has been identified at time of analysis, and this is assessed as a moderate-priority issue that should be patched but does not represent an urgent, mass-exploitation threat based on current signals.
Authenticated low-privileged users can delete service monitors outside their assigned scope in ZohoCorp ManageEngine Applications Manager versions 182000 and below due to improper permission validation (CWE-20). This network-reachable flaw (CVSS 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) requires valid credentials and no user interaction, causing high integrity impact and partial availability loss for monitoring coverage. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in ZohoCorp ManageEngine OpManager and ManageEngine Firewall Analyzer 12.8.710 and earlier lets an authenticated low-privilege console user create alert notifications for firewalls that fall outside their assigned scope. The weakness (CWE-639, authorization bypass through a user-controlled key) only matters in deployments that actually enforce separate scopes - multi-user, multi-team, or multi-tenant setups - since a flat single-administrator installation has no boundary to cross. Exploitation requires a valid, even minimal, console account (CVSS vector PR:L, no user interaction) and there is no public exploit identified at time of analysis: no CISA KEV listing, no EPSS score, and no POC were provided.
Broken access control in ZohoCorp ManageEngine OpManager and Firewall Analyzer 12.8.710 and below allows an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope. The vendor CVSS 3.1 vector is 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), but independent assessment adjusts confidentiality to Low (C:L/I:L), because impact is limited to cross-scope report scheduling data and requires a pre-existing low-privilege account plus a multi-scope/RBAC deployment. No public exploit or CISA KEV listing was identified at time of analysis.
Blind SQL injection in Isotope eCommerce through 2.9.10 allows authenticated Contao backend users with Isotope module permissions to manipulate backend SQL queries and extract arbitrary database contents, including password hashes from the tl_user table. Exploitation requires a legitimate backend session with Isotope permissions and is limited to blind conditional or time-based techniques; no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data. The independent assessment rates confidentiality impact as high, integrity impact as low, and availability impact as none, emphasizing that this is a genuine but access-gated vulnerability and not a mass-exploitation threat.
Missing BLS public key validation in Klever-Go prior to 1.7.20 allows a remote authenticated party with validator-registration capability (PR:L) to submit a CreateValidatorContract (Register) or ValidatorConfig update (UpdateValidator) containing a malformed BLSPublicKey that the runtime never checks for curve membership, prime-order subgroup, or nonzero value. Impact is delayed and conditional: the malformed-key validator must first become eligible and then be selected into a consensus group, at which point MultiSigner.Reset and the signature-verification creation path fail to deserialize the group key and cancel the slot, causing repeated missed consensus rounds and throughput degradation; a complete halt occurs only when the consensus group equals the eligible validator set. This is an availability-only, conditional risk - no public exploit identified at time of analysis, no KEV listing, and genesis-path validation is unaffected because it already calls CheckPublicKeyValid.
Apache Tomcat's HTTP/2 connector harbors a race condition (CWE-362) that allows unauthenticated remote attackers to inject trailer fields into another user's concurrent HTTP/2 request, resulting in high confidentiality and integrity impact without affecting availability. Affected versions are 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, 9.0.39 through 9.0.121, and the end-of-life 8.5.59 through 8.5.100; exploitation is conditional on winning a concurrency race and only applies when the HTTP/2 upgrade protocol is enabled and actively serving traffic. No public exploit code or active exploitation has been identified at time of analysis, and the overall threat is considered credible but conditional.
Origin-validation bypass in the Apache Sling Security Bundle before 1.3.2 allows a remote attacker to defeat the ReferrerFilter when that filter is relied upon as the cross-site request protection control, so cross-site requests that should have been blocked are accepted, yielding low-level confidentiality, integrity, and availability impact. Exploitation requires the victim to be lured into a crafted request carrying an authenticated session (CSRF-style user interaction), and only deployments that depend on ReferrerFilter for origin validation are exposed. Apache rates this 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), while our independent assessment adjusts the vector to UI:R given the required session-riding interaction; EPSS is only 0.13% (3rd percentile) and there is no public exploit identified at time of analysis.
WebSocket message smuggling in Apache Tomcat allows a remote, unauthenticated attacker to inject or reorder messages within a compressed WebSocket stream, corrupting application-level message boundaries and undermining integrity of data exchanged over the connection. The flaw affects the 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M1 through 9.0.121 release lines, plus the end-of-support 8.5.0-8.5.100 and 7.0.56-7.0.109 branches, but it only triggers when the per-message-deflate compression extension has been negotiated on the WebSocket connection; deployments that serve only standard HTTP or that run WebSocket endpoints without compression are not exposed. There is no confirmed active exploitation (CISA KEV does not list this issue), no public exploit code identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none', making this a genuine but conditionally-gated integrity flaw rather than a drop-everything emergency.
Apache Tomcat 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121 can cause an unrelated user's request to fail when a malformed request triggers incomplete cleanup of request-processing state on a reachable HTTP connector. No authentication or user interaction is required, but the effect is fundamentally gated by a race window - the advisory itself states the failure occurs only 'depending on timing' - so it is non-deterministic and cannot be reliably triggered on demand, and the realistic worst case is intermittent failure of another user's individual request rather than sustained denial of service, data disclosure, or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 7.3 base score reflects low impact across confidentiality, integrity, and availability, though our assessment rates attack complexity as High rather than Low.
Cross-application authentication realm leakage in Apache Tomcat's Jakarta Authentication integration causes requests to be validated against the realm established by whichever co-hosted web application authenticated first, breaking per-application authentication boundaries. The flaw (CWE-287, improper authentication) affects Tomcat 11.0.0-M1 through 11.0.25, 10.1.0-M1 through 10.1.59, and 9.0.0.M4 through 9.0.121, plus end-of-life 8.5.0 through 8.5.100. Exploitation is gated by a non-default deployment - SimpleAuthConfigProvider as the default Jakarta Authentication provider with two or more applications sharing it - and the independent assessment rates the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (unauthenticated, high attack complexity, low impact); no public exploit identified at time of analysis, the issue is not in CISA KEV, and the vulnerable configuration is not Tomcat's default.