Authenticated staff-level users of the WordPress plugin Online Scheduling and Appointment Booking System (all versions before 28.3) can read, modify, and delete appointment and payment records belonging to other staff members, including the customer personal information attached to those records. The flaw is a missing ownership check on the plugin's staff-role AJAX actions: an attacker only needs a valid staff account and a record identifier belonging to someone else, with no user interaction and remote reachability. Exploitation requires an existing staff-level login and is therefore not reachable by unauthenticated visitors or ordinary subscribers; publicly available exploit code exists via the WPScan disclosure, but there is no confirmed active exploitation (CISA KEV not listed), EPSS is only 0.13% (2nd percentile), and SSVC rates exploitation as none and automatable as no, making this a genuine but low-priority issue.
Stack-based buffer overflow in the Edimax BR-6428nC wireless router (firmware version 1.16) allows an authenticated remote attacker to corrupt memory by sending crafted interface1 or interface2 parameters to the /goform/formWizSurvey endpoint, potentially achieving code execution or causing a denial of service. Publicly available exploit code exists, and the severity signals conflict sharply: the CVE publisher assigned a CVSS 4.0 score of 2.1 (low), while our independent assessment rates it 8.8 (high) under CVSS 3.1 due to high confidentiality, integrity and availability impact. No confirmed active exploitation (CISA KEV) has been reported at time of analysis.
Missing authentication in loginlinkstudent.php of Mathurvishal CloudClassroom-PHP-Project allows remote unauthenticated attackers to bypass login checks by manipulating the umail parameter, potentially gaining access to student-scoped functions and data. The vulnerability (CVE-2026-100876) has a publicly available exploit, but no active exploitation has been confirmed. The independent assessment rates it as a genuine but low-priority issue due to the product's obscure, unversioned hobby-project nature and negligible real-world deployment.
Cross-site request forgery in the CloudClassroom-PHP-Project PHP web application (repository state up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be) allows a remote attacker to cause a logged-in victim's browser to submit unintended, state-changing requests against the application without the victim's knowledge. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) agree that no attacker-side authentication is required but that a currently authenticated victim must be socially engineered into loading attacker-controlled content, which caps the realistic impact at low integrity modification rather than code execution or data disclosure. Publicly available exploit code exists (a public advisory with a CSRF proof-of-concept), but there is no evidence of confirmed active exploitation (not in CISA KEV), and the vendor did not respond to disclosure, so no official fix is available.
Missing authorization in zhistaredu StarTraining up to and including version 3.8.1 lets any authenticated low-privilege user invoke privileged role-management operations through the dataScope endpoint, because the checkRoleAllowed function in SysRoleServiceImpl.java performs role CRUD without an authorization guard. Exploitation requires only a valid low-privilege account (CVSS 4.0 PR:L, network reachable) and no user interaction; the outcome is integrity-low role and data-scope tampering with no direct confidentiality or availability impact. Publicly available exploit code exists (referenced from the ArrestX/startraining-advisories ST-VULN-005 advisory) and the vendor did not respond to early disclosure, so no vendor-released patch has been identified at time of analysis; the product has a small deployment base, which limits real-world exposure.
Authenticated SQL injection in the order_by() method of DB_query_builder.php in amirsanni's Mini-Inventory-and-Sales-Management-System lets a remote attacker holding valid low-privilege credentials manipulate the orderBy argument and inject arbitrary SQL into the ORDER BY clause of generated queries, yielding high-confidence read access to database contents (customer, inventory and sales records, application credentials) and limited data-manipulation potential. Publicly available exploit code exists, but the injection sits in an ORDER BY context, which constrains extraction to blind/inferential or error-based techniques rather than direct UNION result dumping, and an authenticated session is required. The project is abandoned - the maintainer has said it is not worth fixing and follows a rolling release model, so no version-specific patched build is expected; exposure is limited to the small existing deployment base, making this a genuine but low real-world priority.
An insecure direct object reference (IDOR) in Krayin laravel-crm through version 2.2.5 allows any authenticated user to download email attachments belonging to other mailboxes simply by supplying a different attachment ID to the admin attachment-download endpoint. Exploitation requires only a valid low-privileged account on the admin panel, causes confidentiality loss only (no modification or denial of service), and publicly available exploit code exists, which the CVSS 4.0 vector reflects via its E:P (proof-of-concept) exploit maturity rating. Vendor-released patch: 2.2.6, which enforces the mail.view permission on the download action.
Improper access control in Krayin Laravel CRM through 2.2.5 allows an authenticated low-privilege admin user to access administrative functions whose routes are missing from the ACL map, including warehouse settings left unprotected by a route-name typo. The pre-2.2.6 Bouncer middleware failed open for unmapped admin routes, so an attacker who already holds valid admin-backend credentials can invoke functions outside their intended role; publicly available exploit code exists, and upgrading to 2.2.6 fixes the issue. Impact is confined to individual unmapped admin functions rather than full system compromise, making this a moderate-severity broken-access-control flaw.
Authorization bypass in zhistaredu StarTraining through 3.8.1 allows an authenticated low-privileged user to escalate privileges by manipulating the userId/roleIds parameters sent to the authRole endpoint, because the SysUser.isAdmin authorization logic trusts caller-supplied identifiers instead of the authenticated principal. Publicly available exploit code exists (published in the ArrestX StarTraining advisories repository as ST-VULN-004), but there is no evidence of confirmed active exploitation, and no vendor patch has been released. Independent assessment classifies this as a genuine but low-priority issue: exploitation requires a valid low-privileged account, the affected product has a very small footprint, and mitigation currently depends on access controls.
Stored/reflected cross-site scripting in mathurvishal's CloudClassroom-PHP-Project lets remote, unauthenticated attackers submit script payloads through the FName, LName, and Addrs parameters of registrationform.php, which are then rendered unsanitized in a victim's browser. The project is a rolling-release PHP application with no version tags, so every known build up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be is presumed affected, and the vendor did not respond to disclosure. Publicly available exploit code exists (a GitHub advisory demonstrating the injection is linked from the CVE record); there is no evidence of confirmed active exploitation (not in CISA KEV), and the practical risk is limited by the near-zero deployment footprint of this project and by the user-interaction requirement (CVSS 4.0 UI:P; independently assessed CVSS 3.1 UI:R) for a victim to view the injected fields.
Stored cross-site scripting in Krayin CRM (laravel-crm) up to and including version 2.2.5 lets an authenticated administrator inject arbitrary JavaScript through the Admin Settings footer label field, which is then rendered unescaped on admin layout pages for any admin who views them. The setting 'general.settings.footer.label' is output with Laravel Blade's raw `{!! !!}` directive in packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php, so script content typed into that field executes in the browser of the next admin loading a page containing the footer-effectively an admin-to-admin/self-XSS scenario confined to the admin panel. Publicly available exploit code exists (a dedicated advisory write-up), but there is no KEV confirmation of active exploitation, and the assigned vector (CVSS 4.0 base 1.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) reflects a genuinely low-priority issue despite the public proof of concept. Upgrading to 2.2.6 resolves it.
Cross-site scripting in zhistaredu StarTraining up to and including 3.8.1 becomes exploitable when the built-in XSS filter is switched off by setting xss.enabled to false in the application.yml configuration file. This issue is not independently exploitable: it is a defense-in-depth gap that amplifies the companion injection flaw CVE-2026-100880, and both must be present for an attack to succeed. Exploitation requires authenticated low-privilege access (PR:L) and victim interaction (UI:P) and is rated as highly complex, with the vendor assigning a CVSS base of 2.1; publicly available exploit code exists (published via the ArrestX StarTraining advisories repository), and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis.
Heap use-after-free in wolfSSL's (D)TLS shutdown path can crash or corrupt memory in applications that leave decrypted application data buffered (typically after a wolfSSL_read() with a small user buffer), then call wolfSSL_shutdown() for a bidirectional close, then call wolfSSL_read() again while the peer keeps sending data during shutdown. All builds that use (D)TLS, including default builds, are affected per the vendor's own advisory scope, and the defect was confirmed by wolfSSL in fix PR #10863, which ships a dedicated regression test (test_wolfSSL_shutdown_pending_data_uaf) reproducing the exact sequence. Impact is availability-only - no confidentiality or integrity effect is assessed - and the vendor rates it low severity (CVSS 4.0 2.3, with AC:H and AT:P), consistent with the independent assessment of CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:L; exploitation requires induced timing/state and an attacker who is the connected TLS peer (or a MITM positioned to keep sending during shutdown), and no public exploit identified at time of analysis.
Certificate revocation checking in wolfSSL builds that enable both OCSP and CRL can be silently bypassed, allowing a certificate that the loaded CRL explicitly lists as revoked to be accepted during a TLS/DTLS handshake. Only applications that define both HAVE_OCSP and HAVE_CRL (for example --enable-ocsp --enable-crl, or bundles such as --enable-all, --enable-nginx, --enable-haproxy, --enable-openvpn, --enable-strongswan) and that actually call both wolfSSL_CTX_EnableOCSP() and wolfSSL_CTX_EnableCRL() with a CRL loaded are exposed; OCSP-stapling-only applications are not affected. The CVSS vector indicates the attacker must be positioned as an authenticated peer (PR:L) presenting a crafted certificate, and the independent assessment rates this LOW priority: no public exploit code has been identified at time of analysis and the stacked build-time and configuration prerequisites make practical exploitation unlikely, though the resulting integrity impact is real for affected deployments.
Server-side request forgery in the UTCP Python GraphQL (utcp-gql) and WebSocket (utcp-websocket) plugins at 1.1.0 and earlier lets unauthenticated attackers (CVSS 4.0 vector PR:N, and the assessed 3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) force the host to open outbound connections to internal services and cloud metadata endpoints such as 169.254.169.254. utcp-gql still relies on a startswith prefix check for http://localhost and http://127.0.0.1, so crafted hostnames like http://127.0.0.1.attacker.example or http://localhost.evil.com satisfy the check and then resolve to any address the attacker's DNS returns, while utcp-websocket performs no URL validation at all despite docstrings claiming it enforces 'WSS or localhost only'. Both plugins attach the call template's configured auth headers to the outbound connection, so a successful SSRF also exfiltrates configured API keys and OAuth tokens to the attacker-controlled host; risk is genuine but low urgency, exploitation requires the victim to ingest an attacker-supplied tool or manual call-template URL (UI:P/UI:R) and, for the GraphQL path, attacker-controlled DNS resolution, and no public exploit identified at time of analysis (no CISA KEV entry, no POC reported).
SQL injection in FleetDM Fleet before 4.89.0 allows an authenticated user holding read access to Activity to influence the ORDER BY clause on the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities), because the deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key without an allowlist. The impact is read-only and tightly bounded: it acts as a blind sort-order oracle that can only infer values from columns on the activity_past table (e.g. details) that are not otherwise returned, with no write access, no privilege escalation, and no reachability of node_key or host-join columns through these endpoints. Exploitation requires authenticated access plus high attack complexity due to the indirect inference, no public exploit code was identified at time of analysis, and the issue is fixed in 4.89.0.
Cleartext MCP server connections in utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 allow a plain-HTTP or plain-WS, non-loopback MCP server URL to be dialed without the ensure_secure_url check that the HTTP-family plugins enforce, so the HTTPS/WSS-or-loopback rule is silently skipped for call templates. The practical risk is low: exploitation requires an operator to author an mcpServers entry pointing at a non-loopback plaintext URL and an attacker to already hold a man-in-the-middle position on that network path, and the misconfigured channel only carries an MCP handshake rather than an arbitrary request returning a response body. The OAuth2 token_url credential-leak path from the original report is not reachable in affected versions because the OAuth2 handler was never invoked. Remote attackers are unauthenticated (CVSS:4.0 PR:N), no public exploit code has been identified, and there is no confirmed active exploitation (no CISA KEV listing); the root cause is CWE-319, cleartext transmission of sensitive information.
TLS server impersonation in wolfSSL 5.3.0 through 5.9.2 lets an on-path attacker who observes a server-chosen TLS 1.2 session ID poison the client's process-global SessionCache and be accepted as the original peer for the entire lifetime of the resumed connection. The flaw lives in the legacy session-reference flow (wolfSSL_get_session()/SSL_get_session() followed by wolfSSL_set_session()), where the handle is validated only against a hash of the session ID; a second server reusing that ID overwrites the cached master secret, cipher suite and version, and the resulting abbreviated handshake sends no Certificate message, so neither chain verification nor wolfSSL_check_domain_name() ever runs. Reachability is heavily gated - a vulnerable build (NO_SESSION_CACHE_REF, NO_SESSION_CACHE, NO_CLIENT_CACHE and TITAN_SESSION_CACHE all left undefined), an adjacent/on-path attacker, TLS 1.2 or DTLS 1.2 or below, and completion within the default 500-second session timeout - and no public exploit has been identified at time of analysis; the CVSS 4.0 base score is 2.3, though the independent assessment rates confidentiality and integrity impact as high (CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
A certificate signature-verification bypass exists in wolfSSL builds compiled with WOLFSSL_SMALL_CERT_VERIFY, where the separate signature check performed by ProcessPeerCertParse() is merged back only when the certificate parse returns 0, causing ASN_SIG_CONFIRM_E to be discarded. An unauthenticated remote attacker can present a self-made certificate carrying the expected subject name and the trusted CA's subject as issuer with arbitrary signature bytes, and if the application's verify callback consents to date errors (the shipped myVerify()/VERIFY_OVERRIDE_DATE_ERR shape), the handshake succeeds - a genuine CWE-347 failure whose practical severity far exceeds its low base score because it requires two independent non-default configuration prerequisites. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the flaw affects TLS 1.2, TLS 1.3 in both directions, and DTLS. Note that the two prerequisites - the compile-time macro and the permissive callback - mean default wolfSSL deployments and applications without a date-overriding callback remain unaffected.
Information disclosure in Nezha before version 2.2.7 allows any authenticated user to retrieve their own bcrypt-hashed password by requesting the GET /api/v1/profile endpoint. While the exposure of password hashes is a security weakness, bcrypt is a deliberately slow, salted hashing algorithm, so offline cracking is only feasible for weak or reused passwords; this makes the issue low-risk. No public exploit code is known, and the vulnerability is not confirmed as actively exploited. The independent assessment rates this as a genuinely low-priority issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), emphasizing that the disclosed hashes are resistant to cracking for strong passwords.
Path traversal in Cloudreve before 4.16.1 lets an authenticated user write downloaded files outside the destination directory they selected, by supplying '..' segments in the file names reported by a configured remote downloader such as aria2. The vulnerability is graded very low (CVSS 4.0 2.3 with attack requirements AT:P; the independent assessment scores CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N), because the attacker must control downloader-reported metadata rather than the downloaded HTTP body, and the misplaced writes remain confined to namespaces the user can already reach and are still subject to Cloudreve's normal permission and upload checks. No public exploit code was flagged by the available threat-intelligence feeds, and this CVE is not in CISA KEV; the upstream advisory does document a proof-of-concept harness that emulates an aria2 JSON-RPC service returning a traversal path.
Stored cross-site scripting in zhistaredu StarTraining 3.8.1 and earlier lets an authenticated user upload a file whose MIME type is misclassified by MimeTypeUtils.java, so the content is stored and later rendered as HTML/script in a victim's browser; the attacker's script then executes in the context of the StarTraining web application. Exploitation requires a valid account with access to the Upload Endpoint plus a second user who views the uploaded content, and publicly available exploit code exists. This is a low-real-risk issue despite being a network-reachable stored XSS: the vendor was contacted but never responded, and no vendor-released patch has been identified, so the practical severity is bounded by the credential and user-interaction prerequisites.