OS command injection in the MediaWiki ExternalData extension before version 3.7 allows remote attackers to execute arbitrary operating-system commands on the wiki server. The flaw is reachable over the network with no authentication required per the CVSS vector (PR:N) and low attack complexity, and because the injected command runs in the web server's process context, the vendor's CVSS 4.0 score and our independent re-score both rate it at the maximum severity (10.0), extending impact to subsequent systems (S:C/C:H/I:H/A:H). Exploitation is conditional: the wiki must actually have ExternalData installed (it is an optional extension) and must have a program/command-executing external data source explicitly configured, and invocation may require page-edit rights on wikis that restrict editing; no public exploit code has been identified at time of analysis, but a vendor patch is available in ExternalData 3.7.
Unauthenticated account takeover in the FriendsOfFlarum OAuth extension (fof/oauth) for Flarum, affecting versions prior to 1.7.4 and 2.0.0-beta.4 when the Discord sign-in provider is enabled. Attackers who know a target user's email address can register a Discord account with that address left unverified (relying on a verified phone number to satisfy Discord) and then sign in, causing the extension to hand the address to Flarum core as trusted and link the attacker-controlled Discord identity to the victim's existing account - including administrator accounts - with no password and no victim interaction. The vulnerability has a CVSS base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is unauthenticated per its vector; no public exploit code identified at time of analysis, though exploitation is straightforward once the preconditions are met.
Unauthenticated privilege escalation in the WordPress plugin Automation Web Platform - Notifications and OTP for WooCommerce, Advanced Country Code (all versions up to and including 4.8.6) allows any remote visitor to register a brand-new account holding the WordPress administrator role and take full control of the site. The publicly reachable signup REST route POST /wp-json/wawp/v1/signup/<op> performs no permission check and passes attacker-supplied wawp_custom_fields values straight into update_user_meta(), so keys such as wp_capabilities and wp_user_level can be set by the caller; when signup OTP is enabled, the plugin also leaks the otp_transient token in the HTTP response and marks it verified on any unauthenticated GET, so the OTP step can be skipped without any access to the victim's email or SMS. No public exploit code or active exploitation was identified at time of analysis (not listed in CISA KEV), but with CVSS 9.8, PR:N and no prerequisite beyond a reachable signup feature, this is a top-priority issue for any site running the affected plugin.
Unauthenticated account takeover in X-SpringBoot through 6.0 allows remote attackers to authenticate as any user by submitting the hardcoded default master login verification code 172839, shipped in the database seed, to the emailOrMobileLogin endpoint together with a known email address or mobile number. Exploitation requires the deployment to retain the default seed and the attacker to know a valid account identifier, but no credentials, OTP, or user interaction are needed; publicly available exploit code exists. The vulnerability has a CVSS 4.0 base score of 9.3, and the assessed CVSS 3.1 vector is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
X-SpringBoot through 6.0 allows remote unauthenticated attackers to hijack user accounts by abusing unauthenticated endpoints that return login verification codes in HTTP responses, enabling authentication as any victim whose mobile number or email is known. Publicly available exploit code exists, and the vulnerability is not confirmed actively exploited (not in CISA KEV). Affected users are those running X-SpringBoot versions 0 through 6.0 with network-exposed login endpoints.
Missing per-weblog authorization in Apache Roller 6.1.5 allows any authenticated user to read, modify, or delete weblog content owned by other weblogs via the legacy XML-RPC Blogger and MetaWeblog APIs, which authenticate the caller but do not check the caller's permission on the affected weblog or entry. Exploitation requires an authenticated account and the non-default global XML-RPC feature to be enabled, although the per-weblog API flag defaults to on for UI-created weblogs, and impact is confined to weblog content rather than the host. No public exploit identified at time of analysis, and while the NVD-style CVSS 3.1 score is 9.9 (critical) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, that figure conflicts with the vendor's Moderate rating and the stated constraints.
Unauthenticated remote attackers who can reach an existing publicly shared Briefcase document can abuse unsigned save fields in Zimbra Collaboration Suite's OnlyOffice/Document Editing integration to perform path-traversal writes and execute commands as the zimbra service account. Exploitation is contingent on the non-default OnlyOffice/Document Editing add-on being enabled and on a supported Briefcase document being publicly accessible, so the 9.8 score in the source feed (AV:N/AC:L) is moderated by an independent assessment that rates attack complexity as High (AC:H) given those prerequisites. No public exploit code or confirmed active exploitation was identified at time of analysis, and no patched version could be confirmed from the single Zimbra wiki advisory reference provided.
Stale send-queue credit accounting in the Linux kernel's RDMA/SRP target can cause I/O handling errors and denial of service on hosts that export LUNs over InfiniBand or RoCE. The defect occurs only when srpt_alloc_rw_ctxs() fails partway through building a multi-buffer indirect descriptor, leaving stale n_rw_ctx/n_rdma values and a dangling rw_ctxs pointer that later skew sq_wr_avail calculations in srpt_queue_response() or srpt_write_pending(); this is conditional, requiring a configured srpt target and an established SRP session plus a transient allocation failure. No public exploit identified at time of analysis, and the supplied 9.8 vector is overstated versus the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H.
Unauthenticated remote code execution in Apache Roller 6.1.5, where the XML-RPC endpoint deserializes attacker-controlled bytes during request parsing before any authentication check occurs. The servlet is mapped unconditionally, so the vulnerable parsing path is still reachable even when the global XML-RPC feature is turned off, and no non-default configuration is required. This rates CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; practical RCE reliability depends on a usable deserialization gadget chain being present on the application classpath, which the advisory does not enumerate. Vendor-released patch: Apache Roller 6.1.6.
GLPI 11.0.0 through 11.0.7 allows an authenticated attacker holding the form-administration privilege to achieve remote code execution by importing a crafted form with an illustration or scene identifier containing path-traversal sequences, causing a file to be written outside the intended custom-asset directory and into a servable or executable location. The CVSS 4.0 base score is 9.4 (Critical), and exploitation requires an authenticated admin session (PR:H) with no user interaction. No public exploit code has been identified at time of analysis; the vendor has released version 11.0.8 to fix the issue.
Stored cross-site scripting in Zimbra Collaboration Suite (ZCS) Classic webmail lets an unauthenticated sender forge a share notification that, once a signed-in recipient clicks 'Accept Share', executes attacker-supplied script inside that victim's authenticated session - exposing mailbox contents and allowing the attacker to act with the victim's privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, base 9.3) reflects a remotely reachable, low-complexity attack requiring no attacker credentials but one act of victim interaction, with scope change and high confidentiality and integrity impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low bar to delivery and the high value of mailbox access make it a priority for ZCS Classic deployments. Reported through Rapid7, with tracking rooted in CWE-79 (improper neutralization of input during web page generation).
Zimbra Collaboration Suite's Classic web client is vulnerable to stored cross-site scripting via iCalendar COUNTER messages, allowing an unauthenticated remote attacker to inject active markup into the RFC From address and execute scripts when a victim selects the message, leading to mailbox data theft and session hijacking. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) yields a 9.3 base score; exploitation requires the victim to use the legacy Classic UI and open the crafted message, while the modern UI is unaffected. No public exploit code has been identified at time of analysis, but the low complexity and high impact warrant urgent remediation.
Stored cross-site scripting in Zimbra Collaboration Suite's Modern web client lets an unauthenticated sender forge a share notification; a signed-in recipient must click Accept Share, after which attacker-controlled script executes in the victim's Zimbra session and can access mailbox data and act as that user. The issue is rated CVSS 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), with the required user interaction and Modern-client precondition limiting exposure to users who act on the forged notification; no public exploit was identified in the provided data.
Command injection in the kitty terminal emulator (versions 0.47.3 through 0.48.x) lets any program that can get output rendered on screen - a file shown with cat, a log line, command output, an SSH banner, or a web response - make kitty write attacker-composed printable ASCII back into the pseudoterminal, where the user's shell treats it as typed input and executes it with the user's privileges. The root cause is that the OSC 21 colour-control handler echoed unrecognised field names verbatim into its reply, and the 0.47.3 restriction (introduced as the fix for CVE-2026-54057) to printable ASCII excluding ';' and '=' still left enough characters to compose a shell command; the newline needed to submit that command is obtainable through the ssh kitten path. Exploitation is local (AV:L) and requires the victim to display attacker-controlled bytes (UI:P), no privileges are required, and no public exploit code has been identified in the available intelligence at time of analysis. The 9.3 CVSS 4.0 base score overstates real-world reach, since this is not a remote, unauthenticated, one-click compromise; the vendor-released patch is kitty 0.49.0.
Unauthenticated remote code execution affects GestSup, the PHP-based IT asset and ticket management application, in all versions before 3.2.61. Attackers simply send an email carrying a PHP attachment to a mailbox the GestSup basic IMAP connector monitors; the connector fails to apply its blocked-extension filter during attachment ingestion, writes the file into the web-accessible upload/ticket directory, and the payload executes when requested over HTTP (CWE-434). Exploitation requires the IMAP connector to be configured and actively polling a mailbox (the AT:P precondition in the CVSS 4.0 9.2 vector); deployments without email-to-ticket ingestion are not exposed, and no public exploit was identified at time of analysis.
Remote code execution affects Piwigo photo-gallery installations running any release prior to 16.4.0: an authenticated administrator (CVSS PR:H) can abuse the logo upload in admin/themes_standard_pages.php to store a file whose contents pass MIME validation but whose final extension is taken verbatim from the attacker-supplied filename, so a server-executable file such as a .php script lands in the web-accessible logo directory and runs when requested. The flaw carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) because successful exploitation yields arbitrary command execution with full confidentiality, integrity and availability impact and a scope change, though it only works when the deployment's web server actually executes the chosen extension for files in that directory. No CISA KEV entry and no publicly available exploit code were identified at the time of analysis, and the vendor has shipped an exact fix in version 16.4.0.
Remote code execution in InvoicePlane builds prior to 1.7.2-rc-1 allows an attacker who already holds InvoicePlane's administrator-controlled file-write capability to plant a malicious PHP file inside the PHP template directory that Mdl_templates automatically scans and trusts. That planted file can then be selected as public_invoice_template, and when any unauthenticated guest renders the corresponding public invoice, the guest View controller includes and executes it with web-server privileges - a CWE-98 PHP file-inclusion flaw with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation is gated by the need for high-privilege file-write access (PR:H) even though the execution trigger is network-reachable and unauthenticated, and no public exploit code has been identified at time of analysis; the vendor fixes the issue in 1.7.2-rc-1 by replacing filesystem scanning with explicit allowlist constants.
Unauthenticated attackers can exploit an insecure direct object reference in the Bookly appointment-booking plugin for WordPress (all versions up to and including 28.2) to enumerate sequential order IDs and disclose other customers' secret order tokens, retrieve appointment and calendar details, and permanently delete non-completed bookings. The chain requires only a reachable public booking form and the plugin's standard AJAX endpoints; no authentication, user interaction, or non-default configuration is needed, which is why the assessed severity remains high (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) despite the confidentiality impact being narrower than full data compromise. At time of analysis there is no public exploit code and no confirmed active exploitation (no CISA KEV listing), but the sequential-ID prerequisite is trivially satisfied on typical installations, making opportunistic abuse realistic.
Zammad's SSO auto-linking logic can be abused to take over any existing local account, including agent and administrator accounts, because it binds an incoming third-party identity to a local user purely by matching the email address the identity provider reports. An unauthenticated remote attacker only needs to control one identity at any provider configured on the target instance - with Zammad's default multi-tenant Microsoft 365 /common app registration, any Azure AD tenant qualifies - set that identity's email to the victim's address, then authenticate and be logged in as that victim without ever knowing their local password. Exploitation requires the 'Automatic account link on initial logon' setting to be enabled and at least one SSO provider configured; no public exploit code has been identified at time of analysis and the issue is confirmed fixed in Zammad 7.1.2.
Unauthenticated SQL injection in Piwigo 17.0.0beta1 and earlier lets anonymous guests read arbitrary database contents through the public photo-search flow whenever the rating feature is enabled. An attacker calls pwg.images.filteredSearch.create with a crafted ratings[] value and then opens the returned search URL; because only the lower rating bound is integer-cast while the raw upper bound is concatenated directly into the SQL filter, error-based and blind extraction - plus database-dependent time delays - become possible over the network with no credentials or user interaction. The independent assessment rates confidentiality impact as High with no Integrity or Availability impact, and upstream fixes exist only as commits (9755d88, aede490) with no released patched version identified at time of analysis; no public exploit code or confirmed active exploitation was identified.
Source-IP spoofing in Zoraxy 3.2.3 through 3.3.4 lets unauthenticated attackers who reach the service over IPv6 forge X-Forwarded-For and X-Original-IP values, so IP-based access controls enforced by Zoraxy's SSO forward-auth provider see a trusted client address and grant access (CWE-290). The 9.1 CVSS 4.0 severity reflects fully unauthenticated remote exploitation (PR:N), but our independent assessment (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) rates the real-world risk lower because exploitation requires IPv6 connectivity and a deployment that actually relies on forward-auth IP allowlisting as a security boundary, so IPv4-only or non-IP-gated instances are not exploitable. No public exploit code was identified at time of analysis and there is no KEV entry, though a vendor patch is available.
An authorization-code interception attack against public OIDC Relying Parties on LemonLDAP::NG::Portal 2.23.0 through 2.23.3 lets an attacker redeem a stolen code for the victim's access, ID and refresh tokens without knowing the client secret, which is precisely the theft PKCE is designed to prevent. The flaw only applies to Relying Parties flagged as public while oidcRPMetaDataOptionsRequirePKCE is set to 2 ('PKCE or secret' mode), a configuration that Dynamic Client Registration creates automatically for every RP, making exposure broad on affected deployments. Exploitation is not confirmed in the wild (no CISA KEV listing), but publicly available exploit code exists and CISA SSVC rates the issue exploitable with total technical impact; EPSS is only 0.22% (11th percentile), and the independent assessment sets attack complexity to High because the attacker must first obtain a valid authorization code issued to a public RP before the token exchange succeeds. No authentication is required for the token-endpoint step (CVSS PR:N), and the victim's only involvement is completing a normal login.
Unauthenticated OAuth2 token introspection against LemonLDAP::NG Portal lets an attacker who already holds a valid access token and knows the client_id of any Relying Party configured as 'public' confirm that the token is active and read its metadata, including scope, audience, expiry and the sub claim. The flaw sits in checkEndPointAuthenticationCredentials(), which skips the client-secret comparison for public Relying Parties yet still reports a deduced authentication method (client_secret_basic or client_secret_post), so a request with a public client_id and an arbitrary or empty secret passes introspection()'s authentication gate in versions 2.20.0 before 2.21.6 and 2.22.0 before 2.23.4. Because the returned sub is computed using the calling Relying Party's user identifier attribute, an attacker can correlate a user identifier across Relying Parties, defeating per-client and pseudonymous identifiers; CVSS vector PR:N makes this unauthenticated at the protocol level, but in practice exploitation requires possession of a live token plus knowledge of a public client_id, so no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is 0.21% (10th percentile). Vendor patches are released as 2.21.6 and 2.23.4.
Permanent deletion of arbitrary WordPress Media Library attachments - including administrator-owned product images, logos and documents - is possible in the Customer Reviews for WooCommerce plugin through version 5.120.0, because a missing authorization check (CWE-862) in the review-submission handler lets an unauthenticated remote attacker inject arbitrary attachment IDs into a review that is later trashed and purged through the normal moderation lifecycle. Exploitation depends on a live public review-form link (a 13-hex formId that the store distributes to customers by e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session, and the impact is integrity/availability only - there is no confidentiality impact (C:N). Wordfence rates this CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); no public exploit identified at time of analysis.
Incorrect authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker to bind an outstanding request token to an arbitrary user account - including an administrator - by submitting an unsigned authorization request that supplies the target identity directly instead of relying on the logged-in session. Exploitation is constrained: it requires an installation that has configured a non-default OAuth 1.0a site-wide consumer, plus knowledge of one of that consumer's outstanding (issued but unconsumed) request tokens, which is the basis for the high attack-complexity rating despite the critical 9.0 CVSS 3.1 score. Successful abuse yields administrator-level API access to the blog server, so confidentiality and integrity impact are high (the independent assessment scores availability impact as none); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has released a fix in Apache Roller 6.1.6.