Use-after-free in the Linux kernel AFS filesystem client's peer address-refresh logic allows a crash or, potentially, limited memory corruption when an AFS fileserver endpoint list is refreshed while an inbound RxRPC callback still holds the old peer. The bug arises because afs_fs_probe_fileserver() fetches endpoint state with old_alist left NULL, so afs_set_peer_appdata() treats every list replacement as initial setup, binds the new peers but never unbinds the removed ones; a peer (Pold) is then freed by the server's RCU callback while still pinned through an RxRPC connection, and a later callback dereferences the freed server (KASAN slab-use-after-free in afs_find_server). Exploitation requires a host with an AFS volume mounted over the kernel afs/rxrpc stack plus the correct multi-event race between an address-list refresh and an incoming callback, so it is assessed as AV:L/AC:H/PR:L/UI:N with bounded impact (C:N/I:L/A:H) rather than the network-reachable NVD vector; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the affected footprint is limited to AFS deployments, which are uncommon. Vendor-released patches addressing the flaw are available in the stable trees.
A use-after-free race in the Linux kernel's CIFS/SMB client DFS automount handling lets a local user trigger a kernel memory-access fault by racing DFS automount expiry against a superblock lookup in __cifs_get_super(), producing a KASAN 'slab-use-after-free in cifs_sb_active' crash. Only hosts with an active DFS-enabled SMB/CIFS mount (DFS referrals and automount expiry in play) are exposed, the race window is narrow with high attack complexity, and the assessed impact is a denial of service/crash rather than reliable code execution. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
Reflected cross-site scripting in GLPI 11.0.0 through 11.0.7 lets an unauthenticated attacker craft a dashboard URL that reflects attacker-controlled markup into a dashboard widget's title attribute without sufficient output encoding; the payload only executes in the browser of an already-authenticated GLPI user who opens the crafted link (UI:R plus the CVSS-noted attack requirement AT:P). The vendor rates this CVSS 4.0 7.5, while the independent assessment scores it CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) because impact is confined to the victim's browser session. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the defect is fixed in GLPI 11.0.8.
Unauthenticated information exposure in Ciena Navigator Network Control Suite (NCS) allows remote attackers with network access to subscribe to an event-streaming API and read potentially sensitive data. The flaw (CWE-306 missing authentication) affects numerous NCS releases from 7.2 through 10.0 and their patch levels, with a CVSS 3.1 base score of 7.5 due to high confidentiality impact and no integrity or availability impact. No public exploit identified at time of analysis.
Heap-based out-of-bounds write in the Esri LERC raster library 4.1.0 and earlier lets a remote, unauthenticated attacker crash an application that decodes attacker-supplied LERC imagery, resulting in a denial of service. Exploitation is possible only where a consuming application exposes a decode path for untrusted LERC input (for example imagery uploads, tile requests, or raster ingestion pipelines); the library is not a network service itself, so reachability is entirely dependent on the host application, and impact is confined to a process crash with no confirmed route to code execution or data disclosure. No public exploit code was identified at time of analysis and the issue has not been confirmed as actively exploited (CISA KEV); CVSS 3.1 scores it 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting availability-only impact requiring no privileges or user interaction on a reachable decode path.
Cross-site request forgery in InvoicePlane before 1.7.2 allows a remote, unauthenticated attacker to force deletion of invoice and invoice-tax records by inducing a logged-in administrator to load attacker-controlled content that invokes the Invoices::delete() or Invoices::delete_invoice_tax() routes. Those routes performed state-changing operations without requiring a POST method or validating a CSRF token, so the victim administrator's active session was sufficient to authorize the deletion (independent assessment: CVSS:3.1/AV:N/AC:L/PR:N/UI:R - integrity high, availability low, confidentiality none). No public exploit has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) applies; despite the 7.5 base score, this is a moderate rather than high real-world priority because it requires administrator interaction and results only in removal of financial records, with the fix released in 1.7.2.
Unauthenticated remote attackers can retrieve sensitive information from Wellav WES emergency broadcast terminals - models WES100, WES270, WES280 and WES290 running firmware released before 08-08-2023 - by abusing the devices' global API request wrapper function, which returns data without adequately restricting the caller. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning no credentials or user interaction are required, although exploitation still requires the terminal to be network-reachable and these units are typically deployed on isolated or dedicated broadcast/utility networks rather than the public internet. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so risk is driven by exposure of the device API surface rather than confirmed active exploitation.
Unauthenticated access control weakness in APSL Puput 1.2.1 through 2.2.0 allows a remote visitor to read blog entries that the site intended to restrict, because BlogPage.get_entries() fails to enforce visibility checks in the blog index, tag/category/author/date archives, sidebar widgets, and RSS feed. Exploitation needs only network access to an affected Puput deployment (PR:N, AC:L), but our independent assessment rates the confidentiality impact as Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so practical data loss is limited to restricted content that actually exists on the target. No public exploit code or CISA KEV entry is identified in the provided data.
Privilege escalation and privilege retention in InvoicePlane prior to 1.7.2 allow a previously-authenticated administrator whose account was downgraded or deactivated by another administrator to keep operating with administrative rights through a stale session. Because Admin_Controller trusts the user_type value cached in the session at login rather than re-reading ip_users.user_type, the downgraded user's live session continues to authorize admin requests, and the attacker can then call Users::form() to write user_type back to 1, making the restored admin role persistent in the database. Exploitation is limited to multi-administrator deployments where a role change occurs while the target session stays alive; it requires prior high-privilege access and is not reachable by an unauthenticated or ordinary low-privilege user, and no public exploit code or active exploitation has been identified at time of analysis. The vendor-released fix is InvoicePlane 1.7.2.
Use-after-free in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver lets a local attacker with high privileges (root/CAP_SYS_ADMIN) race a virtual port (vport) teardown against an asynchronous fabric report-ID acquisition, causing qla24xx_report_id_acquisition() to re-insert a vport already marked VPORT_DELETE into host_map, so a later lookup dereferences memory freed by scsi_host_put(). The assessed impact is availability-high with integrity-low and no confidentiality impact (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H), and exploitation requires the qla2xxx driver with NPIV vports in use; no public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel's mac802154 (IEEE 802.15.4 soft-MAC) RX path lets queued beacon or MAC-command frames keep a pointer to an 802.15.4 interface's private data (sdata) after that interface has been removed, so a later worker run dereferences freed memory and crashes the kernel. Triggering it requires two simultaneous conditions: an attacker within 802.15.4 radio range flooding a victim interface to fill the rx_beacon_list/rx_mac_cmd_list, and that interface being unregistered or its whole phy torn down while frames are still queued - the teardown step generally requires administrative/local privilege (PR:L in our assessment, not the PR:N shown in the 7.5 NVD vector), and the race window is narrow (AC:H). The realistic outcome is a kernel crash / denial of service rather than data theft, and no public exploit code was identified at time of analysis.
Use-after-free in the Linux kernel qla2xxx QLogic Fibre Channel HBA driver allows a locally privileged actor to crash the kernel when a pending response-queue work item (qla_do_work) executes against qpair and response-queue memory that has already been freed during queue teardown. The flaw affects kernels carrying the qla2xxx driver built from the parent commit 68ca949cdb04b4dc71451a999148fbc5f187a220, and is fixed by upstream commits 1710a69fd74d0b4bdfcc57c3309b1c4057f70d85, f1f4d1cb93eeeb250eac9405121933e268eefbd3 and 19788a55cab61d78e33e0914a5a31d27843e8a4a released in Linux 6.18.53, 7.2.7 and 7.3-rc1. Exploitation is gated on winning a narrow teardown race and requires the ability to trigger privileged teardown operations (module unload, device removal, HBA reconfiguration); no active exploitation is confirmed (not in CISA KEV) and no public exploit code was identified at time of analysis. The practical outcome is primarily a kernel crash/denial of service rather than a reliable escalation primitive.
A stack out-of-bounds write in the Linux kernel's Bluetooth L2CAP LE connection path lets an attacker within Bluetooth LE radio range corrupt kernel memory by sending L2CAP_LE_CONN_REQ frames - including duplicate identifiers - to a host running a userspace Bluetooth application that listens on an L2CAP LE channel with L2CAP_MODE_EXT_FLOWCTL and FLAG_DEFER_SETUP set. The CVSS base score is 7.5, but the independent assessment rates actual impact as integrity and availability only (no confidentiality impact), gated on that specific, non-default socket configuration, physical radio proximity, and affected kernels from 5.7 onward; no public exploit code has been identified and no active exploitation is confirmed. Unauthenticated (PR:N) adjacent attackers are the relevant threat model per the CVSS vector, and vendor patches are available.
A concurrency flaw in the Linux kernel's mlxsw Spectrum PTP driver (spectrum_ptp) can panic the kernel when a stale PTP entry is reaped by the garbage-collection workqueue at the same moment the threaded NAPI poll is running on another CPU. The GC path calls mlxsw_sp1_ptp_unmatched_finish() → mlxsw_sp1_ptp_packet_finish() → mlxsw_sp_rx_listener_no_mark_func(), which ends in napi_gro_receive() using a NAPI pointer captured earlier in the RX context; because mlxsw_pci_napi_devs_init() unconditionally calls netif_threaded_enable(), that poll runs as an independently scheduled kthread that local_bh_disable() on the GC CPU cannot protect against, so both CPUs mutate the same GRO list and hit list_add corruption / 'kernel BUG at lib/list_debug.c'. Exploitation is not remotely trivial: it requires physical Mellanox Spectrum hardware running the mlxsw driver, PTP hardware timestamping configured and active (e.g. ptp4l) with privileged CAP_NET_ADMIN access, plus a genuine timing race (AC:H) - the reported trigger is a tx-timestamp timeout while a port transitions to UNCALIBRATED/SLAVE. No public exploit code or in-the-wild activity has been identified at time of analysis, and our independent assessment rates the published CVSS 7.5 (AV:A/PR:N) as an overstatement, scoring the issue as a locally triggered, privilege-gated denial-of-service/kernel-panic (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H).
The vdpa_sim_net virtual network simulator driver in the Linux kernel fails to check the signed return value of vringh_iov_pull_iotlb() when processing a TX descriptor, so a negative error code is added to an unsigned byte counter and later used as a size_t length for receive_filter() and vringh_iov_push_iotlb() in the RX path - turning an error into an oversized copy length. Only systems built with CONFIG_VDPA_SIM_NET that have loaded the vdpa_sim_net simulator module and expose a vhost-vdpa device to a local user are affected; this is a test/simulator driver not normally loaded in production, and the independent assessment rates exploitation as high complexity (AC:H) requiring local access (PR:L). There is no public exploit code identified at time of analysis, and the flaw was self-reported by the developer rather than observed in the wild; vendor fixes are already released in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3.
Account takeover in GLPI is achievable by an authenticated technician-level user who supplies an 'authtype' value in a user-update call to the REST API, allowing them to silently change another account's authentication method - including that of a super-administrator. The issue affects GLPI from version 0.70 up to (but not including) 10.0.26 and 11.0.x before 11.0.8, and the dangerous takeover path is scoped to instances using the legacy REST API interface or SSO/external logins, since the attacker switches the victim onto an authentication method they control. Successful exploitation requires a valid authenticated account with rights to update other users but lacking the UPDATEAUTHENT right, plus the non-default legacy-API or SSO configuration; no public exploit code or confirmed active exploitation was identified at time of analysis, though the CVSS 4.0 base score is 7.5.
Unauthenticated attackers can enumerate private and draft galleries and retrieve the original private image bytes from any WordPress site running the Modula Image Gallery - Photo Grid & Video Gallery plugin in versions up to and including 3.0.1. The plugin's Modula_Meta::add_metas() method is hooked to wp_head on every frontend request and builds Open Graph/Twitter meta tags from whatever post ID is supplied in the modula_gallery_id GET parameter, without verifying the gallery's post_status or the requester's read capability, so the response leaks the private gallery item's title, description, dimensions and original upload URL. Exploitation is remote and unauthenticated with no user interaction (CVSS 3.1 base 7.5, confidentiality-only impact), and gallery post IDs are sequential, making enumeration trivial; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Local file inclusion in the WP Maps (flippercode) plugin for WordPress, affecting all versions up to and including 4.9.8, allows an authenticated attacker holding subscriber-level access or above to supply a crafted 'page' parameter that reaches the plugin's include logic and pulls in arbitrary local PHP files. File disclosure and access-control bypass are achievable against default configurations, but full remote code execution is conditional, requiring the attacker to additionally place or reference an includable .php file on the server (for example through an upload feature). There is no public exploit identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV).
Out-of-bounds memory access in the Linux kernel's IPv6 Segment Routing (SRv6) receive path can be triggered by remote, unauthenticated attackers who send a crafted IPv6 packet containing a Segment Routing Header (SRH) with segments_left > 0 that is preceded by another extension header such as a Hop-by-Hop options header. Because ipv6_srh_rcv() restores skb->data by pushing a fixed sizeof(struct ipv6hdr) instead of re-establishing the real network header, skb_network_offset() remains negative; that negative value is then consumed as an unsigned length by the flow dissector during ip6_route_input(), or by sch_fragment()/neighbour output when the packet is forwarded via ip6_forward() or redirected via act_mirred, producing an out-of-bounds memcpy or buffer overflow that can crash the kernel and corrupt memory. Exploitation is not automatic: the target must be built with CONFIG_IPV6_SEG6 and configured as an SRv6 endpoint, and the packet must be specifically structured, which is reflected in the assessed vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H; no public exploit code and no confirmed active exploitation were identified at time of analysis. Vendor fixes are available in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2.
Account takeover in Wakapi before 2.17.6 is possible because the user caching service resolves lookups in an unintended context, allowing one user's lookup to return another user's cached record; unauthenticated remote attackers can thereby hijack an existing account. The high attack complexity (AC:H) reflects that an attacker must induce or await the specific cache state in which lookups cross contexts, rather than sending a single deterministic request, and no public exploit has been identified at time of analysis. Vendor-released patch: 2.17.6.
Path traversal via symlink prefix reuse in gitoxide's gix-fs crate (before 0.23.0; GHSA lists <= 0.21.0) allows a crafted repository tree to write attacker-controlled symlinks outside the worktree during forced checkout with overwrite_existing enabled, enabling code execution by overwriting known paths such as .git/hooks/post-checkout. Exploitation is local, requires user interaction to initiate checkout of an untrusted tree, and has high attack complexity tied to winning the prefix-reuse condition; no public exploit was identified at time of analysis, and no KEV or EPSS data were provided. Per the assessed CVSS:3.1 vector AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, unauthenticated but local access with user interaction is required.
Unauthenticated privilege escalation in the Optima Express IDX plugin for WordPress (all versions up to and including 8.7.5) allows a remote attacker to take control of the plugin's hard-coded `optima-express` integration account and force it to the Author role, gaining `publish_posts`, `upload_files` and `edit_published_posts` capabilities, including access to the plugin's own `/wp-json/optima-express/v1/blog-post` REST endpoint. The exploit path is an AJAX action registered with `wp_ajax_nopriv_ihf_clear_cache` that reaches `provisionBlogCredentials()` with no capability check, nonce verification or ownership validation, but it is only reachable when two conditions are met: open user registration must be enabled on the target site (a non-default WordPress setting), and the attacker must claim the `optima-express` username before the plugin provisions that login for its own integration account - a race that the independent assessment captures with an AC:H adjusted vector despite the published AC:L. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS signal was supplied.
SQL injection in InvoicePlane's tax-rate settings allows an authenticated administrator to inject arbitrary SQL fragments into the ALTER TABLE statement that rebuilds the ip_tax_rates schema, letting them alter or drop required database columns in every release prior to 1.7.2. Because the malicious value is changed through the admin-only Settings page, exploitation requires high privileges (CVSS PR:H); the outcome is persistent schema corruption affecting financial data structures and potential loss of application availability, with integrity and availability impact rated high. No public exploit code has been identified at time of analysis, and the issue is resolved by upgrading to 1.7.2.
Arbitrary code execution in IBM Guardium Data Protection 12.2 is reachable by an authenticated, high-privilege user who can write to or otherwise influence the Quartz JDBC job store, because the scheduler deserializes stored job data without validating the Java object graph it reconstructs. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) requires valid privileged credentials but no victim interaction, and successful exploitation gives full loss of confidentiality, integrity, and availability on the affected server. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but IBM has published a vendor patch to remediate the issue.
SQL injection in Piwigo's Batch Manager (admin/batch_manager.php) allows an authenticated administrator to inject time-based or other SQL expressions through unvalidated dimension (width, height, ratio) and filesize values supplied in the filter URL, potentially disclosing, modifying, or disrupting database contents. The flaw affects Piwigo versions prior to 16.4.0 and arises because the URL filter parser stores raw values in the bulk_manager_filter session state, which is later concatenated into SQL predicates, unlike the validated POST filter path. Exploitation requires an existing high-privileged administrator account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2), and no public exploit code has been identified at time of analysis; the vendor-released patch is version 16.4.0.
Heap out-of-bounds reads in pgPointcloud through 1.2.5 allow an authenticated PostgreSQL user who can supply or store pcpatch values to copy bytes from adjacent backend heap memory into a persisted patch, enabling information disclosure or a backend crash (CVSS 4.0 base 7.2, CWE-125). The defect lives in dimensional patch WKB deserialization, where an attacker-controlled dimension size field is trusted without being validated against the remaining buffer length; exploitation requires a valid database session, the pgPointcloud extension installed, and the ability to insert or construct pointcloud-typed values. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and an upstream fix is available via pull request 388.
Stored SQL injection in Piwigo photo gallery versions prior to 16.4.0 lets an authenticated administrator store a crafted image_order[] value that is later concatenated into ORDER BY clauses, enabling disclosure, modification, or disruption of database data. Exploitation requires a high-privileged admin account (PR:H per the assessed CVSS 3.1 vector, 7.2 High) and the precondition that at least one album contains at least one photo, so the injected expression is executed on a subsequent album or Batch Manager query rather than immediately. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 16.4.0.
Image upload handling in Piwigo before 16.4.0 permits authenticated attackers to read arbitrary files and, in permissive configurations, write server-side files or achieve remote code execution by abusing Imagick's processing of user-supplied images. Format confusion-such as disguising SVG content as PNG-can trick Imagick into interpreting embedded SVG elements that reference local files, while the Magick Scripting Language (MSL) may be abused for unauthorized file writes and code execution if ImageMagick's policy.xml allows MSL and SVG delegates. Exploitation requires Piwigo to use the Imagick backend (not GD) and an authenticated account with upload rights; vendor rates it 7.2 with PR:H and full C/I/A impact, whereas independent assessment lowers integrity/availability to L and stresses that hardened ImageMagick policies commonly block the RCE path. No public exploit identified at time of analysis, and version 16.4.0 provides the vendor-released patch.
Stored cross-site scripting in the Themify Builder plugin for WordPress, affecting all versions up to and including 7.8.1, allows unauthenticated attackers to inject arbitrary JavaScript through the css[fonts] parameter; the payload is persisted in site styling and executes in the browser of any visitor who later views the affected page. The assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) confirms this is a network-reachable, unauthenticated attack requiring no victim interaction to plant the payload, with scope change because the injected content escapes the plugin's own security boundary into site pages. The intended nonce protection is ineffective: the nonce is embedded in plain sight in front-end page markup for all visitors, so it functions only as a publicly readable CSRF token rather than an authentication barrier; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
Unauthenticated stored cross-site scripting in the Repeater Fields for Elementor Forms plugin (all versions through 2.2.7) allows any anonymous visitor to submit a malicious Repeater Field value through a public Elementor form, which is then stored and executed in the browser of an administrator reviewing form entries or any user loading a page where the value is rendered unescaped. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) reflects remote, low-complexity exploitation requiring no credentials or victim interaction to inject, with a scope change because the payload executes in the victim's browser context. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis; version 2.2.8 resolves the issue.
Unauthenticated stored cross-site scripting in the Fancy Product Designer WordPress plugin (all versions up to and including 6.5.2) lets an attacker persist arbitrary JavaScript through the Shortcode Order elements[].title parameter. The payload is written to the DOM via innerHTML in the beforeElementAdd JavaScript event handler when a logged-in administrator opens and reviews the poisoned shortcode order in the WordPress admin panel, so injection is remote and unauthenticated (PR:N) but execution is gated on the admin review workflow and on the store actually using the shortcode order feature. There is no public exploit identified at time of analysis; the assessed vector (UI:R) is more restrictive than the published 7.2 High (UI:N), so the practical severity is lower than the raw score suggests.
Stored cross-site scripting in the WordPress plugin User Profile Builder (Profile Builder) through version 4.0.2 allows unauthenticated attackers to write raw, unsanitized input into a user's avatar meta by submitting a zero-length multipart file to any public registration or edit-profile form that exposes the Avatar field; the payload then lies dormant until a victim - typically an administrator - views the affected account, at which point it is rendered unescaped as an attachment URL. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), indicating remote and unauthenticated injection with low confidentiality and integrity impact and a scope change because the script executes within the WordPress administrative context; the practical trigger still depends on a privileged user subsequently loading the injected profile. No public exploit code has been identified and no active exploitation has been confirmed - it is a genuine but moderate-priority issue that should be prioritized where public registration forms with the Avatar field are exposed.
Stored cross-site scripting in the MP Restaurant Menu and Food Ordering plugin for WordPress (all versions up to and including 2.4.14) lets an unauthenticated remote attacker inject arbitrary JavaScript by submitting a crafted value in the 'phone_number' field of the public ordering flow, with a CVSS:3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The payload is persisted in the order record and executes in the browser of whoever later opens the poisoned order in the site dashboard - typically an administrator or staff member - so real-world impact is gated by a privileged victim viewing attacker-controlled order data. Per the available intelligence, exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no public proof-of-concept, and exploitation only requires the plugin to be active with its ordering/checkout functionality publicly reachable.
Stored cross-site scripting in the Premium Packages - Sell Digital Products Securely WordPress plugin (versions up to and including 7.2.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the cart_items[][product_name] parameter, which is persisted and later executed in the browser of any logged-in user who views an affected invoice page. The plugin's checkout REST route is exposed without authentication (permission_callback set to __return_true) and its invoice loader performs no order ownership check, confirming remote unauthenticated exploitation against default configurations with no special conditions; impact is confined to client-side script execution in the viewer's session. No public exploit identified at time of analysis and no CISA KEV active-exploitation entry exists, though the CVSS 3.1 score is 7.2 High.
Stored cross-site scripting in the Zero Spam for WordPress plugin (all versions up to and including 5.7.10) lets unauthenticated attackers push arbitrary HTML or JavaScript into the plugin's spam log through its Contact Form 7 integration. The payload rides in a nested POST array key - PHP parses the crafted field name into a nested array key that is written verbatim to the zerospam_log.submission_data column whenever the submission is flagged as spam, and it executes when an administrator opens the flagged submission in the admin spam-log details modal, so exploitation depends on privileged user interaction despite unauthenticated injection. The base CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N per the CVE record, though our assessment adjusts UI to R for the required admin view); no public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the BA Book Everything WordPress plugin affects every version up to and including 1.8.27: the first_name field submitted through the public [babe-booking-form] booking flow is neither sanitized on input nor escaped on output, so a payload persists and executes in the browser of any user who later views the affected order or payment page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2) indicates the injection step requires no authentication - an attacker can create a guest booking through the shortcode, harvest the returned order_id, order_num and order_hash, and then reach the action_to_pay() handler with a malicious first_name value. No public exploit code was identified at time of analysis and there is no CISA KEV listing; exploitation is bounded by the plugin being installed and active at <=1.8.27, the booking shortcode being published on a reachable page, and a victim (typically an administrator or staff member reviewing orders) actually opening the injected page.
Stored DOM-based cross-site scripting in HT Contact Form - Drag & Drop Form Builder for WordPress (all versions up to and including 2.10.1) allows unauthenticated attackers to inject arbitrary JavaScript through the 'form_data' Rich Text Field, which then executes in a victim's browser. Injection occurs because the plugin's draft save/resume flow neither sanitizes the rich-text input nor escapes it on output, and the save response hands back the draft_key and access_token needed to build a resume URL. Exploitation is not automatic: an attacker must socially engineer a victim into clicking the crafted draft-resume link, which is why the independently assessed vector scores user interaction as required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 7.2) even though Wordfence's published vector lists UI:N. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no availability or server-side code-execution impact.
Stored cross-site scripting in the Fancy Product Designer WordPress plugin, versions up to and including 6.5.2, lets unauthenticated attackers inject arbitrary web scripts through the output_format parameter when the Pro Export/Genius feature is enabled. The injected payload is stored and executes when any user, including an administrator, later views the affected page; the CVSS 3.1 base score is 7.2, and no public exploit was identified at time of analysis. Sites without the non-default Pro Export/Genius feature enabled are not exposed because the vulnerable fpd_pr_export AJAX action is not registered.
Stored cross-site scripting in the Fancy Product Designer WordPress plugin (all versions through 6.5.2) lets unauthenticated attackers inject arbitrary JavaScript into order item metadata, which executes in an administrator's browser when the affected order is opened in wp-admin. The injection route is the plugin's fpd_save_order AJAX action, registered for logged-out users via wp_ajax_nopriv_fpd_save_order with no nonce and no capability check, and the strip_tags() sanitization applied at save time is bypassed by submitting JSON unicode escape sequences that json_decode() converts back into literal angle brackets at render time. The flaw is rated CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), meaning remote and unauthenticated at injection time with a scope change because the payload executes in the privileged admin context; the provided intelligence contains no KEV entry, and no public exploit code was identified at time of analysis. Practical impact is bounded by the fact that the payload only fires when a store administrator or shop manager views the affected order, so it is a client-side XSS in the admin browser rather than server compromise or remote code execution.
Stored cross-site scripting in the AMP for WP - Accelerated Mobile Pages WordPress plugin, affecting all versions up to and including 1.1.16, allows unauthenticated attackers to submit comment content that is transformed by a regex routine into an anchor carrying a javascript: URI, which the plugin's AMP sanitizer does not strip. The injected script persists in the database and executes in the browser of any visitor who loads the AMP-rendered version of the affected page, giving a scope-changed (S:C) impact rated CVSS 7.2 with PR:N (no authentication required), though realized exploitation depends on victims actually browsing the AMP output rather than the canonical page. No public exploit code or confirmed active exploitation was identified at time of analysis.
Node-wide denial of service in RabbitMQ server 4.1.0 through 4.1.10, 4.2.0 through 4.2.8, and 4.3.0 through 4.3.2 occurs when the non-default rabbitmq_stream_management plugin is enabled: an authenticated management-UI user with access to the target vhost - but no configure, write, or read permission on the resulting streams - can issue a single PUT to /api/stream/super-streams/{vhost}/{name} whose binding-keys field is expanded into the full stream-name list before any resource permission check, forcing a large transient allocation. The advisory demonstrates one ~4.5 MB JSON PUT killing a RabbitMQ container capped at 768 MB, so effective denial of service is strongly dependent on a low memory ceiling; on hosts with ample memory the impact degrades to a temporary resource spike rather than a guaranteed crash. No exploitation in the wild has been confirmed and no public exploit code was identified at time of analysis, but the low privilege bar (any valid management credentials with vhost access) and high availability impact make it a realistic insider or compromised-credential risk for constrained deployments. The issue is fixed in RabbitMQ 4.3.3, 4.2.9, and 4.1.11.
Denial of service against RabbitMQ topic exchange routing can be triggered by an authenticated user who holds permissions to bind a queue to a topic exchange and to publish to that exchange: a binding key containing consecutive '#' multi-segment wildcards, combined with a publication that matches it, drives the topic matcher into combinatorially repeated trie walks and duplicate destination materialization, exhausting CPU and memory and disrupting routing for all tenants on the broker. All RabbitMQ server versions prior to 4.3.5 are affected, with impact assessed as availability-only (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H; vendor-published 7.1); there is no data disclosure or modification, and no public exploit identified at time of analysis. The issue is a conditional but genuine algorithmic-complexity DoS rather than a critical priority, because exploitation requires valid credentials with configure and write privileges on a topic exchange, and it is remediated by the vendor in 4.3.5.
Authenticated users of GLPI 11.0.5 through 11.0.7 can read documents attached to items they are not authorized to access by supplying the itemtype and items_id of a different, legitimately viewable item as the linkage context in a document request. The flaw is an IDOR authorization bypass (CWE-639) in the document permission path, rated CVSS 4.0 7.1 (and CVSS 3.1 7.1 per independent assessment), with high confidentiality impact but no integrity or availability impact; valid credentials with permission to view at least one item are a prerequisite, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The issue is fixed in GLPI 11.0.8.
An authenticated broken-access-control flaw in Zammad's External Data Source feature lets any logged-in user - including a minimal customer-level account - read records that do not belong to them by supplying another record's numeric ID. The affected component builds a 'render context' from request parameters such as ticket_id, customer_id, user_id, group_id, and organization_id and passes it to the configured external system lookup without first checking whether the requesting user is permitted to see that record, so enumerable IDs leak ticket, user, group, and organization details. The issue affects Zammad versions prior to 7.1.2, where the vendor-released patch (7.1.2) adds an explicit authorization check; no public exploit code or confirmed active exploitation was identified at time of analysis.
Internal article attachments in Zammad helpdesk before 7.0.2 can be pulled down by the very customer who owns the ticket, because the attachment download API authorizes only against the parent ticket and never against the article itself (CWE-863). Any authenticated customer with normal view access to a ticket (CVSS v4.0 PR:L, AV:N) can therefore retrieve files attached to internal notes that the article listing API deliberately withholds, giving a confidentiality-only impact with no integrity, availability, or scope change. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the independent assessment characterizes this as a genuine but bounded broken-authorization flaw rather than an inflated high-CVSS issue, and a vendor patch is available in 7.0.2.
Zammad versions prior to 7.0.2 contain an insecure direct object reference (CWE-639) in the knowledge base answer attachment endpoints, allowing an authenticated user with limited knowledge-base permissions to create, delete, or clone attachments on answers outside their assigned access scope. The flaw stems from controller policies that authorized actions broadly by role rather than validating the specific answer object, so an agent (or similarly scoped user) could reach attachments they should not be able to modify or even see. The vendor fixed the issue in 7.0.2 by delegating authorization to the per-answer policy; no public exploit code was identified at time of analysis, and the impact is confined to the confidentiality and integrity of knowledge base attachments rather than code execution or availability.
Inbound PGP signature verification in Zammad is bypassed because the result of the gpg verification call was discarded, so the helpdesk marks every multipart/signed PGP message as 'Good signature' regardless of whether the signature is valid, invalid, or absent. Any sender can therefore tamper with the body of a signed email - or supply a fabricated or mismatched signature - and remote attackers (CVSS 4.0 vector shows PR:N, unauthenticated) can have the altered content displayed to agents and users as cryptographically verified; exploitation requires the recipient to view the affected article (UI:P) and impacts integrity only (VI:H, no confidentiality or availability impact). All inbound PGP-signed email handled while PGP integration is enabled is affected prior to 7.0.2, and at time of analysis no public exploit code or confirmed active exploitation has been identified; the practical risk is a moderate authenticity/trust defect rather than an urgent one, since it enables content forgery and misleading signature indicators but does not by itself grant code execution or data access.
Bludit CMS through version 3.22.0 allows authenticated users with Author or Editor roles to read private drafts and scheduled posts belonging to any other user, including administrators, by sending a crafted request to the content-get-list AJAX endpoint. This missing authorization vulnerability (CWE-862) is network-reachable, requires low-privilege authentication, and results in high confidentiality impact with no integrity or availability effects. No public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Actual Sync Server versions prior to 26.7.0 allows an authenticated user (CVSS PR:L) to bypass the plugin CORS proxy allowlist and cause the server to attach its configured ACTUAL_GITHUB_TOKEN to GitHub API requests outside the permitted repository, exposing private GitHub resources that the token can reach. The flaw is a prefix-matching error: the allowlist check accepts any GitHub API path beginning with /repos/{owner}/{repo}, so sibling repositories sharing an allowlisted repository's name prefix pass validation. Exploitation is config-gated - it requires the operator to have set ACTUAL_GITHUB_TOKEN and to have at least one allowlisted public plugin repository - and impact is bounded by whatever permissions that token holds; no public exploit code was identified at time of analysis, and the vendor has released a fix in 26.7.0.
Unauthenticated attackers on the management network can crash the ASMI web interface on IBM Server Firmware by sending a malformed HTTPS request, causing a temporary denial of service that may become sustained with repeated exploitation. The vulnerability is an out-of-bounds read (CWE-125) with a CVSS score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H); while the interface restarts automatically after a single crash, sustained attacks could lead to a persistent loss of management access. No public exploit identified at time of analysis; this is a moderate-risk availability flaw, not a critical priority, and exposure is limited to attackers already on the management network segment.