OS command injection in the MediaWiki ExternalData extension before version 3.7 allows remote attackers to execute arbitrary operating-system commands on the wiki server. The flaw is reachable over the network with no authentication required per the CVSS vector (PR:N) and low attack complexity, and because the injected command runs in the web server's process context, the vendor's CVSS 4.0 score and our independent re-score both rate it at the maximum severity (10.0), extending impact to subsequent systems (S:C/C:H/I:H/A:H). Exploitation is conditional: the wiki must actually have ExternalData installed (it is an optional extension) and must have a program/command-executing external data source explicitly configured, and invocation may require page-edit rights on wikis that restrict editing; no public exploit code has been identified at time of analysis, but a vendor patch is available in ExternalData 3.7.
Unauthenticated account takeover in the FriendsOfFlarum OAuth extension (fof/oauth) for Flarum, affecting versions prior to 1.7.4 and 2.0.0-beta.4 when the Discord sign-in provider is enabled. Attackers who know a target user's email address can register a Discord account with that address left unverified (relying on a verified phone number to satisfy Discord) and then sign in, causing the extension to hand the address to Flarum core as trusted and link the attacker-controlled Discord identity to the victim's existing account - including administrator accounts - with no password and no victim interaction. The vulnerability has a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is unauthenticated per its vector; no public exploit code identified at time of analysis, though exploitation is straightforward once the preconditions are met.
Unauthenticated privilege escalation in the WordPress plugin Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code (all versions up to and including 4.8.6) allows any remote visitor to register a brand-new account holding the WordPress administrator role and take full control of the site. The publicly reachable signup REST route POST /wp-json/wawp/v1/signup/<op> performs no permission check and passes attacker-supplied wawp_custom_fields values straight into update_user_meta(), so keys such as wp_capabilities and wp_user_level can be set by the caller; when signup OTP is enabled, the plugin also leaks the otp_transient token in the HTTP response and marks it verified on any unauthenticated GET, so the OTP step can be skipped without any access to the victim's email or SMS. No public exploit code or active exploitation was identified at time of analysis (not listed in CISA KEV), but with CVSS 9.8, PR:N and no prerequisite beyond a reachable signup feature, this is a top-priority issue for any site running the affected plugin.
Unauthenticated account takeover in X-SpringBoot through 6.0 allows remote attackers to authenticate as any user by submitting the hardcoded default master login verification code 172839, shipped in the database seed, to the emailOrMobileLogin endpoint together with a known email address or mobile number. Exploitation requires the deployment to retain the default seed and the attacker to know a valid account identifier, but no credentials, OTP, or user interaction are needed; publicly available exploit code exists. The vulnerability has a CVSS 4.0 base score of 9.3, and the assessed CVSS 3.1 vector is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
X-SpringBoot through 6.0 allows remote unauthenticated attackers to hijack user accounts by abusing unauthenticated endpoints that return login verification codes in HTTP responses, enabling authentication as any victim whose mobile number or email is known. Publicly available exploit code exists, and the vulnerability is not confirmed actively exploited (not in CISA KEV). Affected users are those running X-SpringBoot versions 0 through 6.0 with network-exposed login endpoints.
Authenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Installation Manager) bundle import functionality to supply a crafted bundle whose contents cause attacker-controlled arguments to be passed to the underlying tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager. The flaw is network-reachable and requires only low-privileged authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) with no victim user interaction, so any account able to trigger a bundle import should be considered capable of full compromise of the Central Manager. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has published a fix advisory.
Authenticated administrators of ClipBucket v5 who hold the manage_template_access permission can abuse a path traversal in the admin template editor (template_editor.php) to write attacker-controlled PHP files outside the intended styles/layout directory and have them executed as the web server user, yielding remote code execution on all versions before 5.5.3-#197. Publicly available exploit code exists (a HackMD writeup linked from the CVE record), and the vendor has released a fix in commit f31de49b and release tag 5.5.3-#197; the bug is access-gated by the administrator privilege and permission requirement (CVSS 4.0 base 8.6, PR:H), and there is no confirmed active exploitation in CISA KEV. This is a genuine but access-gated risk that primarily matters where multiple admin accounts exist or admin credentials are weak or reused.
PHP code execution on Netgate pfSense Plus and pfSense CE firewalls can be achieved by an authenticated, highly privileged webGUI user who can modify Dashboard widget settings and plant a crafted .widget.php file on the filesystem, then set a widget sequence value containing path traversal so Dashboard index.php include()s and executes that file. The vendor rates this High (CVSS 8.5), while the independent assessment keeps AV:N/AC:H but raises the privilege requirement to PR:H, reflecting that the attacker already needs substantial Dashboard and file-write access; it is not remotely exploitable without authentication. No public exploit or KEV-listed active exploitation was identified in the provided data, and Netgate has released fixed versions.
Incorrect authorization in phpIPAM's REST API (api/controllers/User.php) allows an attacker with API access to retrieve privileged user records by supplying the special identifiers id='admins' or id='all', bypassing intended access controls. Affected versions are those prior to 1.8.3, which includes a security fix for insecure direct object references. While the CVE lists a CVSS score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), the independent assessment indicates the flaw more realistically requires a valid API token (PR:L) and has no scope change (S:U); no public exploit code has been identified at time of analysis.
Authenticated privilege escalation in X-SpringBoot through 6.0 lets any account with delegated user-management permissions reset passwords, rebind roles, or delete users - including the super administrator - through POST /sys/user/update and POST /sys/user/delete because those endpoints perform no object-level ownership verification. Publicly available exploit code exists, in the form of the referenced Python BOLA proof-of-concept, but no CISA KEV status is provided and the risk is tempered by the PR:H requirement that the attacker already be a sub-administrator rather than an unauthenticated remote user. The impact is full compromise of user accounts on affected instances that delegate user-management privileges.
Command injection in Root Browser Classic 3.3.0 (Android, package com.jrummyapps.rootbrowser.classic) lets an attacker execute arbitrary shell commands with the app's privileges by supplying a SQLite database whose filename is seeded with shell metacharacters; the app passes that path to an operating-system shell without separating the filename from the command (CWE-78). Exploitation is local rather than remote: the crafted file must first reach the device (download, sideload, shared storage or another app) and the victim must then open it inside the app, so the flaw is gated by passive user interaction and confined to users of this root-capable file manager. No public exploit code was identified at time of analysis, and while exploitation yields high confidentiality, integrity and availability impact, the 8.5 CVSS v4.0 base score overstates the practical exposure because the realistic attack surface is narrow.
OS command injection in the PowerShell and Cmd wrapper classes of the CliInvoke.Specializations .NET library (and its predecessor package AlastairLundy.CliInvoke.Specializations) lets a double quote embedded in caller-controlled target paths or arguments break OS-level quoting of the single ProcessStartInfo.Arguments string, causing pwsh -Command or cmd /c to execute an additional command with the host process's privileges. Affected builds are CliInvoke.Specializations 2.2.0 through 2.8.4, 2.9.0 through 2.9.3, 2.10.0 through 2.10.4, and 3.0.0-alpha.1 through alpha.4 plus 3.0.0-alpha.8 through alpha.10, as well as AlastairLundy.CliInvoke.Specializations 1.0.0-rc.1 through 1.6.1.1; an application is only reachable if it consumes one of these vulnerable versions, uses the specialized shell wrappers rather than direct process invocation, and routes attacker-influenced data into the target or arguments. Rated CVSS 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) by reporter GitHub_M; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Argument injection in the CliInvoke .NET process-wrapping library (and its former identity, AlastairLundy.CliInvoke) allows a double quote in a caller-supplied target or argument to break out of the operating-system-level quoted region and add unintended elements to a runner's argument vector, potentially escalating to arbitrary command execution when a shell runner is used. Affected versions span CliInvoke 2.0.0-2.8.4, 2.9.0-2.9.3, 2.10.0-2.10.4 and 3.0.0-alpha.1-3.0.0-beta.1, plus AlastairLundy.CliInvoke 2.0.0-alpha.1-2.0.0; the flaw is reachable only when a consuming .NET application routes attacker-influenced data through RunnerProcessFactory (2.x) or RunnerConfigurationFactory (3.x) instead of building a ProcessConfiguration with an explicit ArgumentList. Scored CVSS 3.1 8.4 (High) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, it carries no public exploit identified at time of analysis and is not in CISA KEV.
An authenticated guest with an active booking could unlock rooms other than their own in Akia's keyless entry cloud service by tampering with the client-supplied room or door identifier, because the unlock action was not authorized server-side against that guest's booking-resulting in unauthorized physical access to guest rooms at the affected property. The independent assessment rates this as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N and notes the attack is remote but the impact is local to a single property. Akia reportedly remediated the service server-side as of September 19, 2026; no public exploit code or CISA KEV confirmation was identified at time of analysis.
Stored cross-site scripting in ITFlow's inbound email-to-ticket parser (cron/ticket_email_parser.php) lets a remote, unauthenticated sender deliver a ticket email carrying a malicious SVG attachment that executes script in the browser of any technician or admin who opens it, running with that staff user's privileges against the ITFlow origin (scope-changed, C:H/I:H). Every ITFlow release before 26.08 is affected, but exposure requires the deployment to actually run the email-ingestion pipeline and to accept inbound SMTP from arbitrary external senders; the payload does not fire on ingestion and needs a staff user to open the attachment (UI:R), which is reflected in the AC:H/UI:R vector. No public exploit code and no confirmed active exploitation were identified at time of analysis, and remediation is simple: the vendor-released fix in ITFlow 26.08 removes svg from the attachment allowlist. Given the CVSS 8.0 base score and the privileged session the script inherits, this is a genuine, moderately high-priority issue for exposed instances rather than an emergency.
The AetherBrowser API server shipped with SCBE-AETHERMOORE versions 4.0.2 through 4.2.0 exposes the POST /api/ops/check-email endpoint with no authentication check whatsoever, letting any remote, unauthenticated attacker invoke the email_reader.py subprocess, which logs into configured ProtonMail or Gmail accounts over IMAP and returns email metadata (sender, subject, and body snippets) in the JSON response. The server listens on 0.0.0.0:8100 by default and sets CORS allow_origins=["*"], so the endpoint is reachable from any network host and callable from any browser origin, though meaningful mailbox disclosure requires that IMAP credentials have actually been configured for the reader. Version 4.2.1 resolves the missing authentication (CWE-306); no public exploit code has been identified at time of analysis.
Local privilege escalation in GNU libextractor before 1.16 allows a low-privileged local attacker to execute arbitrary code with elevated privileges by pointing the LIBEXTRACTOR_PREFIX environment variable at a directory containing a malicious plugin, which the library loads from that untrusted search path without privilege checks. Exploitation requires a setuid or setgid consumer of libextractor to be installed and invocable on the host, so the issue is conditionally gated rather than a remote-facing emergency. Publicly available exploit code exists (a PoC repository is referenced), and the vendor has released a fix; no CISA KEV entry confirms active exploitation at time of analysis.
SQL injection in GLPI's history/logs tab allows an authenticated attacker who holds the READ right on logs to inject attacker-controlled values into a database query via crafted affected_fields filter parameters in the history-tab URL. The flaw affects GLPI releases from 9.4.0 up to but not including 10.0.26 and 11.0.8, and exploitation is gated by the READ-on-logs privilege, which is not held by ordinary or self-service users by default. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has released fixes in 11.0.8 and 10.0.26, and the issue is well-confirmed by the vendor advisory and two upstream fix commits.
Missing server-side enforcement of the write/submission password in TDuck survey form through 6.0 allows remote unauthenticated attackers to post form entries directly to the public submission API, because the password gate is implemented only in front-end JavaScript. An attacker only needs the form key that is exposed in any public share link; no account, no user interaction, and no special configuration are required. Publicly available exploit code exists (a Python PoC targeting the submission endpoint), but there is no indication of confirmed active exploitation (not in CISA KEV), and the impact is bounded to unauthorized submission injection - existing responses cannot be read and availability is unaffected.
Denial of service in containerd versions prior to 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1 allows an unauthenticated attacker who controls or poisons an image source to force excessive CPU and memory consumption during PullImage, causing long ContainerCreating stalls and potential node instability at larger graph sizes. The vulnerability is triggered before container start and requires no privileges on containerd itself, but is limited to environments that pull untrusted images; clusters pulling only trusted first-party images are not exposed. No public exploit identified at time of analysis, and impact is availability-only with no confidentiality or integrity effect.
Unauthenticated credential disclosure in X-SpringBoot (yzcheng90) through version 6.0 allows remote attackers to read tenant appKey and appSecret values from the GET /application/manager/select endpoint, which performs no authentication check and applies no field filtering to the response. With those credentials an attacker can drive the affected tenant's configured SMS provider to send arbitrary messages, enabling SMS bombing, cost abuse, and impersonation of the legitimate application. The issue is trivially exploitable - the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (vendor score 6.9 under CVSS 4.0) - and publicly available exploit code exists in a GitHub PoC repository; there is no indication of confirmed active exploitation (not in CISA KEV) and no vendor-released patch was identified at time of analysis. Direct impact is bounded: the disclosure affects SMS credentials and message-sending capability rather than full system compromise.
Reflected cross-site scripting in the Link Library WordPress plugin (versions before 7.9.6) lets remote, unauthenticated attackers inject script via parameters that are reflected, unescaped, into the link addresses generated on the plugin's front-end directory pages. Exploitation requires the victim to open an attacker-crafted URL (CVSS UI:R), so delivery depends on phishing or social engineering, and the impact is substantially greater when the tricked user is a logged-in administrator because the injected script runs with that session. Publicly available exploit code exists, but this CVE is not in CISA KEV and EPSS is low at 0.15% (4th percentile), so broad real-world exploitation is not currently suggested; a vendor-released patch is available in 7.9.6.
TDuck Survey Form 6.0 fails open in its form-ownership authorization check, letting an authenticated user read submission records that belong to forms which have been permanently deleted. An attacker who knows or can guess a dataId can call GET /user/form/data/details and retrieve the orphaned submission row, including personal information, because FormAuthUtils.hasPermission returns a permissive result when the parent form no longer exists; for live forms the ownership check behaves normally. Exploit code is publicly available, no CISA KEV entry indicates active exploitation, and the practical risk is bounded by the need for valid credentials, a known or enumerable dataId, and the strict precondition that the parent form has already been permanently deleted - for these reasons the real-world impact sits below the headline 6.0 CVSS 4.0 score.
Missing per-weblog authorization in Apache Roller 6.1.5 allows any authenticated user to read, modify, or delete weblog content owned by other weblogs via the legacy XML-RPC Blogger and MetaWeblog APIs, which authenticate the caller but do not check the caller's permission on the affected weblog or entry. Exploitation requires an authenticated account and the non-default global XML-RPC feature to be enabled, although the per-weblog API flag defaults to on for UI-created weblogs, and impact is confined to weblog content rather than the host. No public exploit identified at time of analysis, and while the NVD-style CVSS 3.1 score is 9.9 (critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, that figure conflicts with the vendor's Moderate rating and the stated constraints.
Unauthenticated remote attackers who can reach an existing publicly shared Briefcase document can abuse unsigned save fields in Zimbra Collaboration Suite's OnlyOffice/Document Editing integration to perform path-traversal writes and execute commands as the zimbra service account. Exploitation is contingent on the non-default OnlyOffice/Document Editing add-on being enabled and on a supported Briefcase document being publicly accessible, so the 9.8 score in the source feed (AV:N/AC:L) is moderated by an independent assessment that rates attack complexity as High (AC:H) given those prerequisites. No public exploit code or confirmed active exploitation was identified at time of analysis, and no patched version could be confirmed from the single Zimbra wiki advisory reference provided.
Stale send-queue credit accounting in the Linux kernel's RDMA/SRP target can cause I/O handling errors and denial of service on hosts that export LUNs over InfiniBand or RoCE. The defect occurs only when srpt_alloc_rw_ctxs() fails partway through building a multi-buffer indirect descriptor, leaving stale n_rw_ctx/n_rdma values and a dangling rw_ctxs pointer that later skew sq_wr_avail calculations in srpt_queue_response() or srpt_write_pending(); this is conditional, requiring a configured srpt target and an established SRP session plus a transient allocation failure. No public exploit identified at time of analysis, and the supplied 9.8 vector is overstated versus the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H.
Unauthenticated remote code execution in Apache Roller 6.1.5, where the XML-RPC endpoint deserializes attacker-controlled bytes during request parsing before any authentication check occurs. The servlet is mapped unconditionally, so the vulnerable parsing path is still reachable even when the global XML-RPC feature is turned off, and no non-default configuration is required. This rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; practical RCE reliability depends on a usable deserialization gadget chain being present on the application classpath, which the advisory does not enumerate. Vendor-released patch: Apache Roller 6.1.6.
Unauthenticated access to the Swagger/OpenAPI api-docs endpoint in zhistaredu StarTraining through 3.8.1 allows remote attackers to retrieve API documentation and structural details when the endpoint is network-reachable and SecurityConfig.java lacks an authentication filter. Public exploit code exists, but this is an information-disclosure issue (assessed CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), not confirmed active exploitation; the vendor did not respond to the disclosure. The practical risk depends on exposing the api-docs route, and impact is limited to confidentiality of API structure.
Unauthenticated remote access to the Alibaba Druid monitoring console bundled with zhistaredu StarTraining 3.8.1 and earlier allows anyone who can reach the /druid/index.html endpoint to view monitoring data and perform console reset operations without credentials. No user interaction or privileges are required (CVSS vector PR:N/UI:N), though real-world exposure depends on the Druid StatViewServlet being enabled and network-reachable without an authentication filter - a non-default but commonly insecure configuration. Publicly available exploit code exists (a GitHub advisory with reproduction details), but there is no evidence of confirmed active exploitation, and the vendor was contacted and did not respond.
Code injection in the Zhonglun CloudPos desktop client (versions up to and including 3.0.1.76) allows remote attackers to inject and execute code through the 'url' argument of the OpenLocalBrowser function in the CefSharp-based JSBridge component (ZlPos/ZlPos/Bizlogic/JSBridge.cs), with the vendor's own CVE record pointing to RCE as the practical outcome. Publicly available exploit code exists - a proof-of-concept document titled 'CloudPos.CefSharp.RCE' is linked from the disclosure - so the attack is both demonstrable and reproducible. The vendor was contacted but did not respond, so no vendor-released patch has been identified; exploitation requires the affected desktop client to process an attacker-influenced url (the independent assessment rates UI:R, implying some operator interaction or attacker-controlled content delivery is likely despite the CVSS 4.0 vector's UI:N claim). The CPE entry uses a wildcard version range, so all released builds up to 3.0.1.76 should be treated as affected.
SQL injection in the faculty authentication handler (loginlinkfaculty.php) of mathurvishal's CloudClassroom-PHP-Project lets unauthenticated remote attackers manipulate the fid or pass request arguments to alter the backend SQL query, potentially bypassing faculty login and reading or modifying application data. Exploitation needs only network reachability to the exposed login endpoint - the CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with Low confidentiality, integrity, and availability impact (base 6.9), so no credentials, user interaction, or non-default configuration are required. Publicly available exploit code exists (a GitHub proof-of-concept demonstrating authentication bypass), but the practical risk is tempered by deployment scarcity: the vendor uses rolling releases, published no version details, responded to neither disclosure, and no vendor-released patch is currently identified.
StarTraining 3.8.1 and earlier embeds a hard-coded JWT signing secret in application.yml, allowing an unauthenticated remote attacker who knows that static value to forge valid authentication tokens carrying attacker-chosen user_id and company_id claims, effectively impersonating arbitrary users without any credentials. Publicly available exploit code exists (a GitHub advisory demonstrates forging tokens from the shipped secret), but the flaw is not in CISA KEV and no confirmed active exploitation has been reported. The vendor was contacted about the disclosure and did not respond, so no vendor-released patch is identified; installations that have rotated the JWT signing secret away from the shipped default are not exploitable through the disclosed value.
SQL injection in mathurvishal's CloudClassroom-PHP-Project (updatequery.php) lets remote attackers manipulate the gid parameter to inject arbitrary SQL into the application's database queries, rated CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N with low confidentiality, integrity, and availability impact. Publicly available exploit code exists via a GitHub advisory (proof-of-concept maturity per the E:P vector), but there is no CISA KEV listing and no evidence of active exploitation; CISA's SSVC assessment is Exploitation: poc, Automatable: yes, Technical Impact: partial. The vendor was contacted early and did not respond, and the project uses rolling releases, so no fixed version can be identified; combined with the product's near-zero deployment footprint, real-world risk is LOW.
Authorization bypass in ningzichun's student-management-system (all versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf) allows a remote attacker to tamper with log records by manipulating the sid, addtime, type, reason, detail and logdate arguments passed to user/editLog.php, circumventing the intended ownership/authorization check on those records. Publicly available exploit code exists and the flaw was disclosed through a public GitHub issue report that the maintainer has not responded to, so exposed deployments should be considered at risk. The impact is integrity-only log tampering with no confidentiality or availability loss, and because the affected code is a rare, unmaintained hobby project with no patched release, the realistic risk is low despite a moderate 6.9 CVSS 4.0 base score; authentication requirements are not firmly confirmed from available data, as VulDB rates the vector PR:N while independent analysis assesses PR:L.
Authorization bypass in ningzichun student-management-system (versions up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf) allows remote attackers to read other students' records by manipulating the 'sid' parameter of admin/fun/getStudent.php. Publicly available exploit code exists, and the maintainer has not responded to the report, so no vendor-released patch is identified. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, limiting impact to confidentiality of individual records, but the PR:N rating assumes the admin/ path is reachable without upstream authentication.
SQL injection in the updatefaculty.php script of mathurvishal's CloudClassroom-PHP-Project allows remote attackers to inject arbitrary SQL through the unsanitized fid parameter, potentially reading or altering faculty records stored in the underlying database. Publicly available exploit code exists, published as a GitHub advisory with a SQLi proof-of-concept, and the vendor was contacted but never responded, so no fixed version is available; the CPE record (cpe:2.3:a:mathurvishal:cloudclassroom-php-project:*) carries a wildcard version because the project uses a rolling-release model. Practical risk is bounded by the product's negligible production footprint as an obscure educational PHP project rather than by attack difficulty, making this a real but low-priority issue.
GLPI 11.0.0 through 11.0.7 allows an authenticated attacker holding the form-administration privilege to achieve remote code execution by importing a crafted form with an illustration or scene identifier containing path-traversal sequences, causing a file to be written outside the intended custom-asset directory and into a servable or executable location. The CVSS 4.0 base score is 9.4 (Critical), and exploitation requires an authenticated admin session (PR:H) with no user interaction. No public exploit code has been identified at time of analysis; the vendor has released version 11.0.8 to fix the issue.
Authenticated non-admin users can add, modify, or delete global form themes and theme categories in TDuck Survey Form through 6.0 because the FormThemeController write endpoints enforce neither an administrative role nor ownership of the affected theme resources. The flaw is a missing-authorization (CWE-862) issue reachable by any holder of a valid low-privilege account (CVSS 4.0 vector PR:L, AV:N, AC:L, UI:N) with no confidentiality impact - only integrity and availability effects on themes shared across other users' forms. Publicly available exploit code exists (a proof-of-concept script targeting the theme write path), but there is no confirmed active exploitation in the wild; the NVD score of 5.3 is credible and consistent with this limited, credential-gated impact.
Stored cross-site scripting in Zimbra Collaboration Suite (ZCS) Classic webmail lets an unauthenticated sender forge a share notification that, once a signed-in recipient clicks 'Accept Share', executes attacker-supplied script inside that victim's authenticated session - exposing mailbox contents and allowing the attacker to act with the victim's privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, base 9.3) reflects a remotely reachable, low-complexity attack requiring no attacker credentials but one act of victim interaction, with scope change and high confidentiality and integrity impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low bar to delivery and the high value of mailbox access make it a priority for ZCS Classic deployments. Reported through Rapid7, with tracking rooted in CWE-79 (improper neutralization of input during web page generation).
Authenticated users who know a form's key can flood TDuck Survey Form through 6.0 with unlimited submissions via POST /user/form/data/create, because that endpoint never enforces the form's publish status, time window, quota, or per-IP limits - letting an attacker falsify or inflate collected survey results. The defect requires only a low-privileged TDuck account (CVSS 3.1 PR:L) plus the target form key, is remotely exploitable over HTTP with no user interaction, and is strictly an integrity issue: no confidential data can be read and no denial of service results. Publicly available exploit code exists (a bypass PoC script for the data-create endpoint), but there is no confirmed active exploitation and no CISA KEV listing; independent assessment rates this a genuine but low-severity authorization defect.
Zimbra Collaboration Suite's Classic web client is vulnerable to stored cross-site scripting via iCalendar COUNTER messages, allowing an unauthenticated remote attacker to inject active markup into the RFC From address and execute scripts when a victim selects the message, leading to mailbox data theft and session hijacking. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) yields a 9.3 base score; exploitation requires the victim to use the legacy Classic UI and open the crafted message, while the modern UI is unaffected. No public exploit code has been identified at time of analysis, but the low complexity and high impact warrant urgent remediation.
Stored cross-site scripting in Zimbra Collaboration Suite's Modern web client lets an unauthenticated sender forge a share notification; a signed-in recipient must click Accept Share, after which attacker-controlled script executes in the victim's Zimbra session and can access mailbox data and act as that user. The issue is rated CVSS 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), with the required user interaction and Modern-client precondition limiting exposure to users who act on the forged notification; no public exploit was identified in the provided data.
Command injection in the kitty terminal emulator (versions 0.47.3 through 0.48.x) lets any program that can get output rendered on screen - a file shown with cat, a log line, command output, an SSH banner, or a web response - make kitty write attacker-composed printable ASCII back into the pseudoterminal, where the user's shell treats it as typed input and executes it with the user's privileges. The root cause is that the OSC 21 colour-control handler echoed unrecognised field names verbatim into its reply, and the 0.47.3 restriction (introduced as the fix for CVE-2026-54057) to printable ASCII excluding ';' and '=' still left enough characters to compose a shell command; the newline needed to submit that command is obtainable through the ssh kitten path. Exploitation is local (AV:L) and requires the victim to display attacker-controlled bytes (UI:P), no privileges are required, and no public exploit code has been identified in the available intelligence at time of analysis. The 9.3 CVSS 4.0 base score overstates real-world reach, since this is not a remote, unauthenticated, one-click compromise; the vendor-released patch is kitty 0.49.0.
Unauthenticated remote code execution affects GestSup, the PHP-based IT asset and ticket management application, in all versions before 3.2.61. Attackers simply send an email carrying a PHP attachment to a mailbox the GestSup basic IMAP connector monitors; the connector fails to apply its blocked-extension filter during attachment ingestion, writes the file into the web-accessible upload/ticket directory, and the payload executes when requested over HTTP (CWE-434). Exploitation requires the IMAP connector to be configured and actively polling a mailbox (the AT:P precondition in the CVSS 4.0 9.2 vector); deployments without email-to-ticket ingestion are not exposed, and no public exploit was identified at time of analysis.
Rate-limit bypass in the wpForo Forum WordPress plugin (3.0.0 up to but not including 3.1.6) allows unauthenticated remote attackers to drain a site owner's paid, metered AI credits by spoofing the client-supplied IP header the plugin trusts when keying its per-visitor throttle on AI requests. Exploitation requires the plugin's paid/metered AI feature to be enabled and funded, and the deployment must accept forwarded-IP headers from untrusted clients; there is no code execution, data disclosure, or privilege gain, with impact limited to financial/resource exhaustion (CVSS 5.3, A:L), and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV). Sites that have not enabled the AI feature or that normalize forwarded-IP headers at a trusted proxy are not meaningfully exposed.
Unauthenticated customer record tampering in the Bookly WordPress plugin before 28.3 lets remote attackers overwrite a known customer's stored personal details - name, email and address - because the plugin fails to verify the requester's identity before processing a customer-details update. Exploitation is trivial and needs no login or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3), but it is not blind: the attacker must already hold a valid customer's primary identifier, which confines practical abuse to targeted modification of a specific known record rather than mass, automated takeover of the whole customer base. Publicly available exploit code exists and WPScan has published a proof-of-concept advisory, though there is no indication of confirmed active exploitation; integrity impact is limited (I:L) with no confidentiality or availability loss, and this is a genuine but moderate-severity issue rather than a top-tier priority.
Remote code execution affects Piwigo photo-gallery installations running any release prior to 16.4.0: an authenticated administrator (CVSS PR:H) can abuse the logo upload in admin/themes_standard_pages.php to store a file whose contents pass MIME validation but whose final extension is taken verbatim from the attacker-supplied filename, so a server-executable file such as a .php script lands in the web-accessible logo directory and runs when requested. The flaw carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) because successful exploitation yields arbitrary command execution with full confidentiality, integrity and availability impact and a scope change, though it only works when the deployment's web server actually executes the chosen extension for files in that directory. No CISA KEV entry and no publicly available exploit code were identified at the time of analysis, and the vendor has shipped an exact fix in version 16.4.0.
Remote code execution in InvoicePlane builds prior to 1.7.2-rc-1 allows an attacker who already holds InvoicePlane's administrator-controlled file-write capability to plant a malicious PHP file inside the PHP template directory that Mdl_templates automatically scans and trusts. That planted file can then be selected as public_invoice_template, and when any unauthenticated guest renders the corresponding public invoice, the guest View controller includes and executes it with web-server privileges - a CWE-98 PHP file-inclusion flaw with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation is gated by the need for high-privilege file-write access (PR:H) even though the execution trigger is network-reachable and unauthenticated, and no public exploit code has been identified at time of analysis; the vendor fixes the issue in 1.7.2-rc-1 by replacing filesystem scanning with explicit allowlist constants.
Unauthenticated attackers can exploit an insecure direct object reference in the Bookly appointment-booking plugin for WordPress (all versions up to and including 28.2) to enumerate sequential order IDs and disclose other customers' secret order tokens, retrieve appointment and calendar details, and permanently delete non-completed bookings. The chain requires only a reachable public booking form and the plugin's standard AJAX endpoints; no authentication, user interaction, or non-default configuration is needed, which is why the assessed severity remains high (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) despite the confidentiality impact being narrower than full data compromise. At time of analysis there is no public exploit code and no confirmed active exploitation (no CISA KEV listing), but the sequential-ID prerequisite is trivially satisfied on typical installations, making opportunistic abuse realistic.
Zammad's SSO auto-linking logic can be abused to take over any existing local account, including agent and administrator accounts, because it binds an incoming third-party identity to a local user purely by matching the email address the identity provider reports. An unauthenticated remote attacker only needs to control one identity at any provider configured on the target instance - with Zammad's default multi-tenant Microsoft 365 /common app registration, any Azure AD tenant qualifies - set that identity's email to the victim's address, then authenticate and be logged in as that victim without ever knowing their local password. Exploitation requires the 'Automatic account link on initial logon' setting to be enabled and at least one SSO provider configured; no public exploit code has been identified at time of analysis and the issue is confirmed fixed in Zammad 7.1.2.