Unauthenticated arbitrary file upload in the WordPress plugin Ultra Addons for Contact Form 7 (themefic) affects every version up to and including 3.5.50, allowing a remote attacker to place arbitrary files - including executable PHP - on the web server because the 'uacf7_wpcf7_mail_components' handler performs insufficient file-type validation. Successful exploitation requires the plugin's PDF Generator module to be explicitly enabled; that module is off by default, so default installations are not vulnerable, and RCE further depends on the uploaded file landing in a web-executable path. Vendor/NVD rates this 9.8 (AV:N/AC:L/PR:N/UI:N), while our assessment raises complexity to AC:H precisely because of that non-default module prerequisite; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to and including 2.9.2, lets a remote attacker write executable files such as PHP into a web-accessible temporary RFQ upload directory by posting a file through the afrfq_submit_quote_via_popup() handler, which passes the attacker-supplied filename straight into move_uploaded_file() without extension or MIME validation. Exploitation depends on a non-default configuration: a public (unauthenticated-reachable) quote rule must exist and the multi-page popup quote flow must be enabled, which is what exposes the vulnerable handler; when those conditions are met no credentials or user interaction are required, consistent with the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but given the low attack complexity and PHP code-execution outcome, any site running the popup RFQ flow should be treated as high priority.
Unauthenticated remote code installation in the lomart.fr 'UP' plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows remote attackers to write and install arbitrary code on affected sites without authentication, user interaction, or non-default configuration, as reflected in the vendor's CVSS 4.0 base score of 10.0. The flaw is a path traversal (CWE-22) that lets attacker-supplied paths escape the intended directory and place executable content where the web server will run it, giving full compromise of confidentiality, integrity, and availability on the host and follow-on systems. This is a niche, single-vendor Joomla add-on, so exposure depends entirely on whether the plugin is installed and active; no public exploit has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing).
Authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications WordPress plugin (all versions up to and including 5.5.5) allows an unauthenticated remote attacker to log in as any existing administrator account by submitting only a known admin username, an empty password, and the POST parameter mo_wp_login_intent=otp - no password or OTP check is ever performed. Exploitation requires a specific, non-default configuration in which the site administrator has simultaneously enabled WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass; that prerequisite stack is the primary limiting factor and is why our independent assessment rates the issue AC:H rather than the AC:L assumed by the published 9.8 score, while the impact ceiling (full WordPress site takeover via an administrator session) remains high. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so risk is real but contingent on the vulnerable option combination being present; the upstream plugin repository shows a code fix commit.
Authenticated PHP code injection in the lomart.fr UP Plugin for Joomla (versions 5.0.0-5.2.0 and 6.0.0-6.0.29) allows a high-privilege administrator to execute arbitrary PHP code and system commands on the underlying server. The flaw requires a valid Joomla administrator account (PR:H) and is remotely exploitable without user interaction, but no public exploit code or active exploitation has been identified at time of analysis. Because the plugin is a narrowly deployed third-party extension and no vendor patch is available, the real-world priority is low despite the critical CVSS score (9.4), with mitigation limited to removing the plugin or tightly restricting administrative access.
Unauthenticated remote code execution in AcyMailing Enterprise for Joomla (versions before 11.1.0) lets anyone who can email the address monitored by the extension's 'mailbox action' feature write a PHP file into the site's web root, because inbound MIME parts are stored under media/com_acym/upload/ with no extension check (CWE-434); once reachable over HTTP and PHP-executable, that file runs as the web-server account. The gating precondition is that mailbox monitoring is enabled and the upload path is web-exposed, which is not a default configuration, but where it applies exploitation is trivial and requires no authentication (CVSS 4.0 9.5 with AT:P; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with the scope change reflecting impact escaping the extension into the hosting Joomla site). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor-released fix is AcyMailing Enterprise 11.1.0.
Privilege escalation in Kyverno before 1.19.1 allows an authenticated Kubernetes namespace tenant with Policy/apiCall authoring rights to escape namespace isolation and create objects as Kyverno's admission-controller ServiceAccount. The attacker supplies percent-encoded directory-traversal sequences in the Policy apiCall urlPath to bypass the per-namespace clamp, enabling creation of cluster-wide MutatingWebhookConfiguration objects or PolicyException objects in the kyverno namespace, with a path to cluster-admin escalation. No public exploit identified at time of analysis; vendor patch available in 1.19.1.
Privilege escalation in the Froxlor server administration panel (2.3.10 and earlier, including any build carrying only the earlier incomplete GHSA fix) lets an authenticated customer account with the data-export/DataDump feature enabled take ownership of arbitrary host directories, including /etc and other tenants' trees. The root-owned export cron runs `chown -R` through a symlink the customer plants at an intermediate path component of their export destination, because Froxlor\FileDir::makeCorrectDir() has an off-by-one in its path-component walk that skips the first segment below the customer home directory and ExportCron.php only validates the final component with is_link(). Exploitation is deterministic and needs no race, resulting in host root and cross-tenant compromise; the flaw is fixed in Froxlor 2.3.12, and no public exploit was identified at time of analysis.
Argument injection in the Froxlor hosting control panel (versions before 2.3.12) allows an authenticated administrator - or any actor able to write settings, such as through the settings-import API - to inject arbitrary acme.sh command-line options via the unescaped system.letsencryptchallengepath setting, resulting in arbitrary command execution as root the next time the Let's Encrypt cron job runs. The vendor CVSS 4.0 score of 9.4 (and the independently assessed CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects complete compromise of the host, but exploitation is gated behind a high-privilege settings-write primitive (PR:H) and requires that acme.sh-based Let's Encrypt certificate issuance be configured so the root cron actually executes the poisoned command line. No public exploit code was identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); the vendor-released fix is Froxlor 2.3.12.
Unauthenticated SQL injection in the joomlaboat.com YouTube Gallery extension for Joomla (versions below 5.7.3) lets remote attackers inject arbitrary SQL into read queries through the video search and sorting parameters of the public-facing gallery. No credentials, user interaction, or non-default configuration are required - only that the extension is installed and its video search/sorting front end is reachable, which is its normal deployment state. The CNA rates it 9.3 under CVSS 4.0, our independent assessment scores it as high severity with confidentiality impact dominant (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), and no public exploit code or confirmed active exploitation was identified at time of analysis. Impact is bounded by deployment scope: core Joomla installations without this third-party extension are not affected, but any site that does run it is exposed to unauthenticated database disclosure.
Stored cross-site scripting in Froxlor 2.0.0 through 2.3.10 lets an authenticated customer - the lowest-privileged account role - inject JavaScript through the issuer organization field of an SSL certificate they upload for their own domain, which is parsed by openssl_x509_parse() and stored verbatim without sanitization. The payload executes only when a reseller or administrator opens Domains > SSL certificates, because the table-listing renderer passes scalar cells through Twig's raw filter and disables HTML auto-escaping, so the script runs in the privileged user's session and can result in full administrator account takeover. Because a Froxlor admin controls webserver, DNS and PHP configuration applied by a root cron job, that takeover can be escalated to command execution as root on the managed server. No public exploit identified at time of analysis; exploitation requires a valid tenant account plus privileged-user page interaction (UI:P), which makes this a genuine priority within its deployment niche rather than a mass-exploitation emergency.
Unauthenticated path traversal in the lomart.fr UP extension for Joomla (versions 5.0.0 through 5.2.0 and 6.0.0 through 6.0.29) allows remote attackers to read files outside the intended plugin directory, exposing configuration files, credentials and other sensitive data under the web root's readable filesystem. The reported CVSS 4.0 score is 9.2, and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms a confidentiality-only impact with no authentication or user interaction required, while integrity and availability remain unaffected. Real-world risk is governed by deployment scope rather than exploitability: this is a niche third-party Joomla extension, no public exploit was identified at time of analysis, and only sites that have the plugin installed and enabled at an affected version are exposed.
Authentication bypass in Flowise 3.1.4 and earlier running in Enterprise/platform mode with SSO enabled allows an attacker who can authenticate at any configured SSO provider while asserting a pending invitee's email address as the email claim to hijack that invitation, flipping the target account and its organization membership to ACTIVE without ever possessing the emailed invitation token. Our independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L (vendor CVSS 4.0 base 9.2), reflecting full confidentiality and integrity impact with high attack complexity driven by the need for a matching SSO identity; the practical limiting factor is the trust and email-verification behavior of the configured SSO provider, and exploitation is constrained to the invitation's validity window (24 hours by default). No public exploit code has been identified at time of analysis, and at the time of the advisory no patched version was available.
Unauthenticated account takeover of pending invited users in Budibase Server (@budibase/server) versions 3.41.0 through 3.45.0, caused by an authentication bypass in the OIDC/SSO login path. In sso.authenticate, when no existing user matches the incoming SSO subject, the server resolves pending invites using only the IdP-asserted email address, skipping both invite-code validation and the email_verified check (which guards only the existing-account lookup), so anyone who can register at a trusted IdP and claim a victim's invited email - even with email_verified=false - consumes the invite and inherits its privileges, including builder and admin.global roles. Impact scales with the outstanding invite: an admin.global invite yields full tenant compromise (all apps, datasources with production credentials, automations) and the invite is consumed, denying onboarding to the legitimate invitee. Exploitation requires OIDC/SSO configured against a trusted IdP and an unclaimed pending invite matching the asserted email, per the vendor's AT:P attack-requirement modifier; no public exploit code or confirmed active exploitation was identified at time of analysis, and CVSS 4.0 rates this 9.2 with a CVSS 3.1 equivalent of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Account takeover in Flowise through 3.1.4 allows unauthenticated attackers to impersonate any existing user by claiming that user's email at any configured SSO provider. This authentication bypass (CWE-287) occurs because the application resolves users solely by email without storing provider or subject identifier bindings, enabling cross-provider or local-password claim of identities. Exploitation requires SSO to be enabled and knowledge of a victim's email, but no public exploit code has been identified at time of analysis.
Credential theft in OpenClaw for iOS (versions >= 2026.7.1 and < 2026.8.11) lets a man-in-the-middle attacker who redirects the same Gateway host and port and presents a certificate that passes iOS system trust capture the injected Gateway token or password from the authenticated Terminal and session Dashboard WebViews, which - unlike native connections - failed to enforce the saved Gateway TLS fingerprint. The stolen credential can grant operator access, including reading sensitive Gateway state and invoking host-capable tools. No public exploit has been identified at time of analysis, and exploitation requires a prior accepted Gateway fingerprint, a network-adjacent MITM position, a validly trusted certificate for the host, and the victim opening the affected WebView, which substantially limits realistic risk to targeted adversaries despite the vendor's Critical 9.0 CVSS 4.0 rating.
GNU Inetutils builds rlogin, rlogind and telnetd on top of a libinetutils helper that fails to initialize a stack-allocated struct sigaction, leaving sa_flags and sa_restorer holding whatever was previously on the stack - producing a crash and, on architectures that honor SA_RESTORER, a theoretical uninitialized function-pointer signal trampoline. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L, i.e. unauthenticated but high-complexity and availability-only, with no confidentiality or integrity impact assessed. There is no CVSS score, EPSS estimate, CISA KEV entry, or public exploit code in the provided data, so no public exploit identified at time of analysis, and practical exposure is further limited because the trigger value is not directly attacker-controlled and telnet/rlogin are legacy services that are usually disabled or firewalled.