The JavaScript library ip-address (npm) fails to treat the NAT64 local-use prefix 64:ff9b:1::/48 as private, so applications that lean on Address6.isPrivate - typically together with isLoopback and isLinkLocal - to enforce an SSRF or trust-boundary policy can be tricked into reading an internal IPv4 destination as external. Unauthenticated network attackers can exploit this (CVSS v4.0 6.9; independent assessment CVSS v3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) only when the target server's network actually uses an operator-chosen NAT64 prefix carved from the RFC 8215 local-use range, and only when the consuming application composes these classifiers as a security control; information disclosure is the realistic outcome, with no impact on integrity or availability. Versions 10.2.0 through 10.5.0 are affected and the issue is fixed in 10.5.1; no public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation is further gated by the non-default NAT64 deployment and by the application's use of these methods for enforcement.
Unauthenticated SQL injection in the SPS-Suite WordPress plugin through version 1.4.0 allows remote attackers to extract sensitive data from the WordPress database when the plugin's static-page search feature is enabled. The vulnerability requires that specific search feature to be explicitly activated, which narrows the exposed population, but publicly available exploit code exists and no authentication or user interaction is needed once the feature is on. CISA's SSVC framework rates exploitation as none and the attack as not automatable, and there is no confirmed active exploitation (CISA KEV status: no); the primary risk is confidentiality impact, with no integrity or availability effects.
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one gRPC method be evaluated against a different method's access rule when case-insensitive path matching is enabled. Only deployments that use xDS-driven RBAC with case-insensitive matching and that define two methods where one name is a string prefix of the other (with differing access rules) are reachable; the flaw yields improper authorization with limited confidentiality impact and high integrity impact (CVSS 6.5, AC:H, PR:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches ship in versions 1.13.1 and 1.14.1.
Unauthenticated shortcode injection in WPForms Lite (versions 1.5.0.1 through 2.0.2) lets remote attackers execute arbitrary registered WordPress shortcodes by submitting form field values that the plugin echoes back into the rendered form without stripping shortcode delimiters. Publicly available exploit code exists via the WPScan advisory, and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (6.5 Medium) confirms low-complexity, no-user-interaction exploitation. Impact is bounded by the shortcodes present on the target; successful exploitation can disclose attachment details of non-public posts and modify rendered form output, but does not by itself grant full remote code execution.
SQL injection in the Post Voting System WordPress plugin through version 1.0 allows an authenticated user to inject arbitrary SQL into a database query because an input parameter is neither sanitized nor escaped before use. Any low-privilege account (PR:L per the assessed CVSS vector) is sufficient, so on sites with open user registration the issue is practically reachable at scale, though exploitation is limited by the plugin's niche deployment and by the fact that a valid authenticated session is mandatory. Publicly available exploit code exists, but there is no confirmed active exploitation (SSVC Exploitation: none), so this should be treated as a genuine but modest-severity issue requiring prompt patching rather than emergency response.
Cross-family subnet comparisons in the ip-address npm library (all versions before 10.7.1) can cause isInSubnet and isHostInSubnet to report that an address falls inside a range it does not belong to, allowing an allowlist or denylist decision built on those predicates to misclassify an out-of-scope address as trusted. The flaw is a logic/comparison error (CWE-697) rather than a memory-safety issue: masked binary strings are compared without first confirming that the address and the subnet share the same IP family, so an IPv4 address checked against an IPv6 mask (or vice versa) can compare equal when the leading masked bits align. Exploitation requires a consuming application to use these methods as a security gate and to pass attacker-influenced addresses into a cross-family check; no public exploit code was identified at time of analysis, and the weakness is inert in applications that never use these predicates or that normalize IP family before comparison. Impact is bounded to integrity of the containment decision (no confidentiality or availability effect), and the vendor's CVSS 4.0 score of 6.3 is higher than our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N because practical exploitation is gated by how the host application wires these predicates.
Denial of service in the ip-address JavaScript/npm library (all versions prior to 10.7.1) lets remote attackers stall or crash a Node.js process by supplying megabyte-scale strings to the IPv6 parsing paths - the Address6 constructor, Address6.isValid, and the underlying parse routine in src/ipv6.ts. An application is only exposed if it accepts an attacker-controlled field of roughly 16 MiB or more and passes it to those entry points without an earlier length bound; common URL, HTTP header, and default body-parser limits keep inputs well below the ~32 MiB needed to terminate the process, so default configurations typically exclude the impact and this is assessed as a low-to-moderate real-world risk that does not warrant emergency prioritization. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and a vendor-released patch in version 10.7.1 resolves it.
Denial of service in Ricoh SP 330DN, SP 221, SP C252SF, and Aficio SP 3500SF multifunction printers (firmware through 20260813) allows a network-reachable attacker with low-privilege credentials to hang the device by submitting a crafted multipart/form-data request to the embedded HTTP management interface. The flaw is an improper-resource-handling condition (CWE-404) in the multipart form-data parser that the researcher's PoC describes as an infinite loop, exhausting device resources with no confidentiality or integrity impact. Publicly available exploit code exists and a proof-of-concept script targeting the SP 330DN has been published on GitHub; the vendor did not respond to the disclosure, so no vendor-released patch is identified at time of analysis. This is a confirmed active-exploitability signal in the form of public tooling, but it is not listed in CISA KEV, and the practical exposure is largely limited to attackers on the same LAN or any environment where the printer's management interface is internet-reachable.
Denial of service in Barco ClickShare CX-20 Gen2 (firmware up to 02.26.00.0007) allows an authenticated, low-privilege attacker with network access to the device's management interface to disrupt or crash the unit by submitting a malformed 'wallpaper' argument to the /wallpaper upload endpoint. Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported. The impact is availability-only, with no data exposure or code execution, and the vendor was contacted but did not respond.
Path traversal in DbGate 7.3.1 and earlier allows unauthenticated remote attackers to read arbitrary files from the server via the 'runid' parameter in the Files Endpoint of packages/api/src/controllers/runners.js. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis. Exposure is limited to deployments where the DbGate API/web server is reachable by the attacker, rather than local desktop-only usage.
Path traversal in DbGate versions up to 6.8.1, 7.0.2, 7.1.8, 7.2.5, and 7.3.1 allows remote attackers to write files outside the intended upload directory by manipulating the filePath or fileName argument in the saveUploadedFile function of the save-uploaded-file endpoint (files.js). Publicly available exploit code exists (per VulDB and a GitHub PoC), and the vendor was contacted but did not respond. The vendor's CVSS 4.0 vector rates all impacts as Low (base 5.5, AV:N/AC:L/AT:N/PR:N/UI:N), while an independent assessment rates integrity impact as High (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N); per the vendor vector no authentication is required, but this is unverified and many deployments may sit behind authentication, which would raise the effective privilege requirement.
Improper authentication in the /bin/boa CGI dispatcher of Netcore NR289-GE firmware 1.4.5102 allows unauthenticated remote attackers to bypass credential checks on the router's web management interface, with low impact across confidentiality, integrity, and availability per both the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) and our assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists, including a GitHub write-up documenting the authentication bypass, so exploitation is a practical concern wherever the management interface is reachable - typically the LAN, or the WAN when remote administration is explicitly enabled (not default on most consumer routers). No vendor response was received and no vendor-released patch was identified at time of analysis. EPSS data was not provided; CISA KEV status is not indicated, so this is not confirmed actively exploited, but the presence of released exploit code and the low attack complexity make the exposure meaningful for any internet-facing or remotely-administered device.
Unauthenticated remote attackers can disclose object-group data from ООО НПО Ритм GEOritm deployments up to version 2.45.1 because the /restapi/objects/obj-groups REST API endpoint fails to enforce authentication when handling the objectId argument (CWE-306). Publicly available exploit code exists, but the impact is bounded to low-confidentiality information disclosure with no integrity or availability effect; the vendor has released version 2.46 and patched the hosted geo.ritm.ru service. The vulnerability was also registered with FSTEC Russia as BDU:2026-11235.
Unauthenticated remote attackers can invoke the routerd.passwd_set function exposed through the /ubus management interface on Netcore POWER13 (build 2.0.240730.162638) to reset or recover device credentials through a weak password-recovery mechanism (CWE-640). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the attack is remote, low complexity, and requires neither authentication nor user interaction, though practical exposure depends on whether /ubus is reachable from the LAN only or also from the WAN; impact is scored as limited across confidentiality, integrity, and availability. Publicly available exploit code exists - a detailed proof-of-concept write-up is published on GitHub - and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis. EPSS and KEV data were not provided; this is not confirmed as actively exploited.
DMARC policy evaluation in Trusted Domain Project OpenDMARC through 1.4.2 can be bypassed by mail carrying sending-domain identifiers that use Unicode full-stop equivalents (such as U+3002 or U+FF0E), which the Domain Handler in policy.c treats as equivalent to the ASCII dot when it should not. Because the flaw sits in the default inbound-milter use case, any MTA running OpenDMARC <=1.4.2 (typically via Postfix or Sendmail) that relies on OpenDMARC verdicts for spoofing decisions is exposed; remote, unauthenticated attackers can send specially crafted mail with no user interaction required. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and given the independent assessment the practical impact is limited to DMARC bypass/spoofing effectiveness rather than code execution, data access, or service disruption.
OpenDMARC through 1.4.2 can mishandle Internationalized Domain Name labels during DMARC policy lookup in opendmarc_policy_query_dmarc, allowing a remote, unauthenticated attacker to trigger an encoding error with a crafted email and potentially distort DMARC evaluation on internet-facing mail servers that run OpenDMARC as a milter/library, typically with Postfix or Sendmail. Publicly available exploit code exists, but the supplied data does not confirm active exploitation or a CISA KEV entry. The independent assessment rates this as a moderate integrity and availability issue rather than a high-urgency compromise: CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, because the flaw requires an IDN/non-ASCII domain edge case and the practical payoff depends on downstream trust in the DMARC verdict.
Improper access control in the TCP Service of Thinkware U3000 dashcams running firmware up to 1.02.04 lets a remote attacker call the get_file function and read arbitrary files, most notably /tmp/wpa_supplicant.conf, which holds the device's Wi-Fi credentials. The CVSS vector shows no authentication, no user interaction, and network reachability (PR:N/UI:N/AV:N), so any host that can reach the camera's TCP service on the LAN or a routable network can trigger it, and publicly available exploit code exists. The impact is confidentiality-only (no integrity or availability effect), and the practical risk is limited less by exploit difficulty than by the product's small deployment footprint and the fact that the attacker must first reach the device's TCP service.
Unauthenticated snapshot disclosure in the Eyeplus IoT camera (version 57.0.0.0308) lets any attacker with network reachability to the device's p2pcam service retrieve a live camera snapshot from the /snapshot endpoint - no credentials, user interaction, or special configuration are required (CVSS:4.0 PR:N/UI:N/AC:L). Impact is confidentiality-only and low (VC:L, 6.9 base) with no integrity or availability effect, but publicly available exploit code exists: a proof-of-concept write-up is published in the GitHub advisory EYEPLUS-8001-Unauth-Snapshot-Disclosure, which raises the effective severity above the raw score. Real-world risk is governed by exposure, so cameras whose p2pcam/P2P service is reachable from the LAN, or from the internet when remote viewing is enabled, are the ones immediately affected.
SQL injection in the makeresult.php script of mathurvishal's CloudClassroom-PHP-Project lets remote attackers tamper with the makeid parameter and inject arbitrary SQL into the application's database queries. Because the project ships only as a continuously-delivered rolling codebase with no tagged releases, every self-hosted deployment tracking upstream - up to and including commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be - should be considered affected, and publicly available exploit code exists (there is no CISA KEV entry, so active exploitation is not confirmed). The CVSS v4.0 score is 6.9, while our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) weighs confidentiality loss as the dominant impact; overall risk stays moderate because exposure is limited to a small number of hobby/self-hosted instances of an unmaintained PHP application, and the vendor never responded to disclosure.
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the outputFile parameter in the exportModelSql function of the Export Handler. Publicly available exploit code exists, and the vendor did not respond to disclosure, so no official patch is available. The CVSS 4.0 score is 5.5 (medium), with limited integrity and availability impact; exploitation requires the DbGate API to be network-reachable, and full code execution depends on targeting a sensitive write path.
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the Create Connection endpoint's zipJsonLinesData function when the filePath argument is manipulated. Publicly available exploit code exists, and the endpoint was omitted from earlier hardening (PR #1530/commit 5f99b4d82) that added checkSecureExportFilePath to other export endpoints. Practical exploitation depends on the DbGate instance being network-reachable, as it is commonly bound to localhost.
Unauthenticated remote path traversal in DbGate through 7.3.1 allows attackers to manipulate the linkedFolder argument in the Archive Link Creation createLink endpoint and access paths outside the intended archive link location. Publicly available exploit code exists, and the vendor was contacted but did not respond; exploitation is limited mainly by whether the DbGate web/API service is reachable by the attacker and by the filesystem privileges of the DbGate process. The assessed impact is low against confidentiality, integrity, and availability (CVSS 3.1 C:L/I:L/A:N; CVSS 4.0 6.9 Medium).
Information disclosure in the Thinkware U3000 dashcam (firmware versions through 1.02.04) allows a remote, unauthenticated attacker to retrieve stored Wi-Fi credentials by sending a crafted GET_STATUS request with a manipulated wifi_info argument to the device's TCP service. Publicly available exploit code exists, including a full technical write-up in the researcher's GitHub disclosure repository, so the technique is trivially reproducible, though practical exposure requires reaching the dashcam's TCP service over the local/Wi-Fi network it is joined to. CVSS 4.0 scores it 6.9 with E:P, and our own assessment (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) characterises it as a genuine but low-priority issue because confidentiality impact is real but integrity and availability are unaffected.
Improper access control in the Thinkware U3000 dashcam (firmware through 1.02.04) allows remote, unauthenticated attackers to abuse the TCP Service's PUT_FILE operation - manipulating its path argument - to read and write arbitrary files, including /tmp/wpa_supplicant.conf. Because no authentication, user interaction, or special configuration is required once the service is reachable (CVSS 4.0 AV:N/AC:L/PR:N/UI:N, and the independent assessment's CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact), the practical barrier is exposure: an attacker must have a network path to the dashcam's TCP service, typically via its own Wi-Fi hotspot or a LAN it is bridged to, which limits internet-wide exploitation. Publicly available exploit code exists (published in the Turretsec disclosure), and the vendor was contacted but did not respond, so no fix is available; there is no CISA KEV listing, so active exploitation is not confirmed.
Refly through 1.1.0 uses a hard-coded JWT signing secret in apps/api/src/modules/config/app.config.ts, allowing unauthenticated remote attackers to forge authentication tokens and impersonate any user when deployments retain the default 'test' secret. Publicly available exploit code exists, and the vendor did not respond to the disclosure. The configuration is the limiting factor: operators who override the JWT secret with a strong environment-provided value are not exploitable.
An uncaught exception in the NAS message decoder of aligungr UERANSIM's gNB component (nr-gnb, versions up to and including 3.3.0) lets a remote, unauthenticated sender crash the simulated 5G base station by delivering a malformed plain Initial NAS message during AMF slice selection, causing the gNB process to terminate. Availability-only impact: no confidentiality or integrity effect, and exploitation is limited to UERANSIM lab/test deployments. Publicly available exploit code exists (a PoC gist is referenced), but there is no indication of confirmed active exploitation, and an upstream fix commit is available.
Malformed DMARC policy tags (fo, rf, ri, pct, sp, adkim, aspf, rua, ruf) supplied in attacker-controlled DNS TXT records trigger improper handling of exceptional conditions in OpenDMARC 1.4.2 and earlier (opendmarc_policy_parse_dmarc), letting remote unauthenticated senders disrupt or weaken DMARC enforcement on mail servers that run OpenDMARC as a Postfix or Sendmail milter. Impact is confined to availability (milter crash/denial of processing) and integrity (misapplied or weakened policy), not code execution or data theft. Publicly available exploit code exists, and the vendor was contacted early but did not respond, so no vendor-released patch is identified at time of analysis; the independent assessment characterizes this as a genuine but modest DMARC-integrity issue rather than a high-severity emergency.
Off-by-one bounds error in Trusted Domain Project OpenDMARC through 1.4.2 lets a remote, unauthenticated attacker send a crafted message that causes the DMARC record parser's opendmarc_util_cleanup routine to write one byte past the end of a buffer; publicly available exploit code exists. The practical impact is narrow - the overflow is a single NUL byte, so the realistic outcome is a crash or denial of service rather than controllable memory corruption, which aligns with the independently assessed CVSS:3.1 vector (C:N/I:L/A:L). The flaw requires the target to run an affected OpenDMARC milter on an internet-facing mail server and to process attacker-influenced input whose length exactly equals the destination buffer size, so triggering is constrained.
SQL injection in the updateresultdetails.php script of the CloudClassroom-PHP-Project allows remote attackers to manipulate the 'editid' parameter and potentially read or modify database contents. The vulnerability is confirmed by publicly available exploit code, and the vendor has not responded to disclosure, leaving all versions affected because the project lacks versioning. Despite a high technical severity (assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), real-world risk is low due to the project's limited deployment as an unmaintained hobby application.
Server-side request forgery (SSRF) in October CMS 4.3.4 and earlier allows unauthenticated remote attackers to bypass the validateExternalImageHost protection in System/Classes/ResizeImages.php by supplying a crafted IPv6-mapped IPv4 host, causing the server to fetch attacker-controlled or internal URLs. Publicly available exploit code exists (no CISA KEV confirmation of active exploitation), and the assessed impact is a largely blind SSRF with Low confidentiality, integrity and availability impact, so real-world severity depends on what internal services or cloud metadata endpoints the server can reach. October CMS 4.3.5 resolves the bypass; the issue is genuine but should be treated as low-to-moderate priority.
Incomplete scheme validation in October CMS's image resizer (getSourcePathForResize() in modules/system/classes/ResizeImages.php) allows non-HTTP PHP stream wrappers such as phar://, file:// and ftp:// to be stored in the resize cache and later handed to the underlying image library, producing a server-side request forgery condition that on phar:// paths can trigger metadata deserialization during subsequent file operations. Affected builds are 4.1.x up to 4.1.19, 4.2.x up to 4.2.25 and 4.3.0 through 4.3.4; upgrading to 4.3.5 or 4.4.0 resolves the issue (patch commit 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58). Publicly available exploit code exists (reported by 0xGenesi, tracked as CVE-2026-100909), but no confirmed active exploitation has been observed; reachability is narrow because the flaw only matters where a pre-existing injection primitive already pipes untrusted input into the |resize Twig filter or the ResizeImages::resize() API without validating the scheme, so default templates and trusted-value usages (uploaded file models, theme assets, static URLs) are not exposed.
Unauthenticated information disclosure in Eyeplus firmware 57.0.0.0308 lets remote attackers retrieve user account records - including plaintext passwords - by invoking the GetUsers operation on the ONVIF Device service at /onvif/Device. Both the vendor CVSS 4.0 vector (6.9) and the independent assessment (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) agree the flaw is network-reachable, unauthenticated (PR:N), requires no user interaction, and yields high confidentiality impact with no integrity or availability effect. Publicly available exploit code exists (a GitHub proof-of-concept advisory), and because credentials are returned in cleartext the exposure is especially severe - the only limiting factor is network reachability of the ONVIF interface, which is frequently LAN-restricted unless the device is internet-exposed or port-forwarded.
Server-side request forgery in athlon1600 youtube-downloader up to 4.0.1 lets remote, unauthenticated attackers make the server issue attacker-controlled HTTP/HTTPS requests by manipulating the url argument of public/stream.php. Publicly available exploit code exists (per VulDB and the linked exploit gist), but there is no CISA KEV confirmation of active exploitation, and assessed impact is limited to low confidentiality and integrity effects against internal services and cloud metadata endpoints reachable from the host. The vendor was contacted early and never responded, and the only code change tied to this component (commit 6ffe823, 'better security for public/stream.php') is a partial hardening rather than a fix.
A NULL pointer dereference in the Trusted Domain Project's OpenARC ARC milter (affected versions up to and including 1.0.0.Beta1) allows a remote, unauthenticated sender to crash the milter by delivering an email whose ARC canonicalization (c=) tag causes arc_parse_canon_t in libopenarc/arc-canon.c to dereference a NULL pointer. Publicly available exploit code exists, but the impact is confined to availability - the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the reported CVSS 4.0 vector both carry no confidentiality or integrity consequence, so this is a pure denial-of-service condition, not code execution or data exposure. Exploitation requires that OpenARC be deployed inbound on a Postfix or Sendmail MTA and actively performing ARC validation on received mail, which limits real-world exposure given the product's beta-stage, optional mail-authentication footprint.
Server-side request forgery in Privoce VoceChat Server 0.5.36 and earlier lets unauthenticated remote attackers force the server to issue outbound HTTP requests to arbitrary URLs through the OpenGraph link-preview endpoint, potentially reaching internal services or cloud metadata endpoints reachable from the server's network position. Publicly available exploit code exists, and the vendor was notified early but did not respond, so no vendor-released patch has been confirmed. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) this is a real but moderate-priority SSRF - no credentials or user interaction are required, but impact is bounded to low confidentiality, integrity and availability effects and depends on whether fetch responses or errors are reflected back to the attacker (blind vs non-blind is not confirmed in the source data).
Remote denial of service in aligungr UERANSIM up to 3.3.0 allows an unauthenticated network attacker who can reach the nr-gnb signaling interface to trigger memory corruption by sending a crafted dedicatedNASMessage in an RRC ULInformationTransfer message. The assessed impact is limited to availability loss (crash) rather than code execution, confidentiality, or integrity compromise, and the affected software is an open-source 5G simulator typically deployed in research or test networks. Publicly available exploit code exists, and the vendor was reportedly contacted but did not respond.
A NULL pointer dereference in the Trusted Domain Project's OpenDMARC (up to and including 1.4.2) can crash the mail filter when it processes certain SPF data for an inbound message. The flaw sits in opendmarc_spf_ipv6_explode() in libopendmarc/opendmarc_spf.c, where manipulation of the `cp` argument causes the parser to dereference a NULL pointer; it is remotely reachable by an unauthenticated attacker (CVSS 4.0 6.9, CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) who can influence the SPF information evaluated during mail handling. Publicly available exploit code exists and the vendor did not respond to the disclosure, but there is no confirmed active exploitation (not listed in CISA KEV). Impact is limited to availability of the filter process rather than host compromise; the referenced proof-of-concept is published at weitongli.com.
Blocked accounts can keep authenticating on the authentication paths that the Blacklist Manager for WooCommerce WordPress plugin (versions 1.3.0 through 2.3.1) fails to hook, so a user whom the site owner has explicitly blocked retains the privileges of their original role - typically a customer-level WordPress/WooCommerce account - with the block neither enforced nor recorded. Exploitation requires the attacker to already hold valid credentials for a blocked account (CVSS 3.1 score 5.4, AV:N/AC:L/PR:L/UI:N, authenticated), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) is indicated at time of analysis. Because access is capped at the account's existing role, there is no privilege escalation - impact is limited to confidentiality and integrity of data that account could already reach, plus the failure of the blocking control itself.
Quadratic-time CPU exhaustion in the brace-expansion npm library (all releases prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12) lets unauthenticated remote attackers stall the Node.js event loop by supplying a crafted brace pattern shaped like '{a},b}' with a very large number of trailing closing braces. Parsing such input forces successive full-string rescans with growing working strings, so ~128 KB of the payload has been measured to block the event loop for tens of seconds; the process recovers afterward, making this a recoverable denial-of-service rather than a persistent crash, which is why it is rated only 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation requires that an application pass attacker-controlled input into expand() - directly or transitively through consumers such as minimatch/glob - and it affects Node.js runtimes only; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Malformed JSON Web Token headers can cause an uncaught RecursionError in PyJWT 2.13.0 through versions before 2.14.0, resulting in HTTP 500 for the request handling the token. Unauthenticated remote attackers can trigger the condition by sending a deeply nested JWS header to an application that calls jwt.decode or PyJWS.decode on untrusted token input. No public exploit identified at time of analysis; the assessed CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), making this a bounded availability impact rather than a confidentiality or integrity compromise.
Unauthenticated attackers can mark any order in a WordPress site running the Verge3D Publishing and E-Commerce plugin (versions 4.1.0 through 4.13.0) as paid without any payment ever being made. The plugin fails to confirm the transaction with the payment provider and fails to verify that the order belongs to the requesting party, so a fully remote, low-complexity request (CVSS 3.1: AV:N/AC:L/PR:N/UI:N) is enough to flip order status; the resulting impact is integrity-only and limited (C:N/I:L/A:N, score 5.3 MEDIUM), meaning goods or services may be released on unpaid orders rather than data being exposed or the site taken down. Publicly available exploit code exists - the WPScan advisory documents the flaw - and exploitation is confirmed only against sites that actually sell through this plugin's order workflow; no CISA KEV entry indicates confirmed active exploitation.
An unauthenticated payment-verification bypass in the Paymattic WordPress plugin (versions 4.6.20 through 4.6.25) lets attackers mark arbitrary pending orders as paid without actually paying the order's amount. The plugin fails to confirm that a Stripe payment belongs to the order it is being applied to, so an attacker can complete a small, genuine Stripe payment of their own and redirect that confirmation at a victim's pending order, obtaining goods or services for a fraction of the price. Publicly available exploit code exists and the flaw is remotely exploitable with no authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3), though real-world applicability is constrained by the requirement that Stripe be the active gateway and that a pending order be available to hijack.
Unauthenticated attackers can zero out the price of paid appointments in the Bookly WordPress plugin before 28.3 by manipulating the client-supplied booking quantity that the plugin uses to compute the appointment total, allowing them to book paid services for free and skip the payment step entirely. The issue is a server-side validation gap in the booking total calculation, and publicly available exploit code exists, so any publicly reachable WordPress site running an affected version with a paid service exposed on the front-end booking form is remotely exploitable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Impact is confined to integrity - fraudulent or underpriced bookings - with no confidentiality or availability effect, and there is no CISA KEV confirmation of active exploitation at time of analysis.
Missing authorization on a REST route in the WP Verify API WordPress plugin (versions through 1.0.0) allows unauthenticated remote attackers to insert arbitrary data into the plugin's own database table and to make the affected site dispatch templated verification emails to any email address they choose. Because the route has no permission callback and no rate limiting, it can be driven repeatedly and at scale, though impact is limited to integrity (CVSS 5.3, C:N/I:L/A:N) rather than data disclosure or denial of service. Publicly available exploit code exists and the issue was reported via WPScan, but there is no confirmation of active exploitation (CISA SSVC exploitation: none) and the practical exposure is constrained by the plugin's low adoption rate.
Axios 1.12.0 through 1.19.x can be tricked into merging attacker-supplied HTTP headers into a fetch adapter request when the surrounding Node.js or browser application is already vulnerable to a separate, same-process prototype-pollution flaw. The polluted value must be an array or a non-plain class instance that masquerades as FormData via inherited append, getHeaders, or Symbol.toStringTag properties; plain objects are explicitly blocked, and the resulting header injection can alter authorization, cache, metadata-service, or application-specific request semantics. This is a defense-in-depth integrity gadget rather than a standalone remotely exploitable bug - exploitation is unauthenticated (PR:N) but conditional on a pre-existing pollution primitive (AT:P), no public exploit code was identified at time of analysis, and the flaw is fixed in Axios 1.20.0.
Axios versions 1.0.0 through 1.19.x can leak attacker-controlled headers - including authorization-related values - into outgoing HTTP requests, but only as a secondary gadget in a chain: a separate same-process prototype-pollution flaw must first set Object.prototype.headers, and the application must use trusted request interceptors that return a fresh ordinary configuration object without its own headers property, causing dispatchRequest's normalization step to fall through to the inherited prototype value. The issue is fixed in Axios 1.20.0, which filters shared-prototype-inherited values during config merging and interceptor replacement; no public exploit code has been identified at time of analysis and the defect is inert in isolation, making this a defense-in-depth hardening fix rather than a standalone exploitable vulnerability. Authentication requirements are unauthenticated per the CVSS vector (PR:N), but exploitation is gated by the AT:P attack-requirements flag and the pre-existing pollution primitive.
Header sanitization bypass in the Axios fetch adapter (npm axios 1.7.0 through 1.19.x) allows attacker-controlled request headers - such as Authorization, caching directives, or metadata-service targeting values - to be applied after Axios has already built a sanitized Request object, enabling scope-changed integrity impact (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N). Exploitation is not standalone: it is a gadget that requires a separate same-process prototype-pollution flaw capable of writing Object.prototype.headers, plus use of the fetch-based transport rather than the default Node HTTP adapter. No public exploit code is identified at time of analysis, but the fix and code change are public in the Axios v1.20.0 release, pull request #11141, and commit d19040bd, so the affected range should be treated as patch-now.
Axios versions 0.27.2 through below 0.34.0, and 1.0.0 through below 1.20.0, can silently upgrade an intended GET into a state-changing HTTP method when a request is sent through the default instance without an explicit method. The flaw is a read-side gadget, not a pollution source: calls such as axios({ url }) or axios.request({ url }) omit a method, so dispatch looks up the method on the prototype chain and honours an Object.prototype.method value planted by an unrelated prototype-pollution vulnerability in the same process. Because a separate pollution primitive must already exist, this is only exploitable as part of a chain, which is why the vendor CVSS 4.0 vector carries AT:P; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. The vendor scores it 6.9 (AV:N/AC:L/AT:P/PR:N/UI:N, SI:H only), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, treating the unauthenticated network-reachable integrity impact as high but gated on the pollution prerequisite.
Unauthenticated remote attackers can repeatedly invoke the revalidateProducts Server Action in the MarcosCamara01 Ecommerce Template (all revisions before commit ec97209) to forcibly expire the entire storefront product cache, driving near-zero-cost cache thrash and availability degradation. The action lives in src/app/actions.ts under a file-scope "use server" directive and calls updateTag("products") with no session or role check, unlike the read-only actions in the same file; because two client components under src/components/admin import it, its Server Action id is compiled into a public /_next/static chunk that the proxy.ts admin middleware does not gate, so any remote user can harvest the id and POST it directly. Impact is strictly availability-scoped (CVSS 4.0 base 6.9; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and the reachable condition is deployment-dependent: it matters when cacheComponents is enabled and storefront pages are served from 'use cache' entries tagged 'products' with an hours-long cacheLife, an open-source self-hosted template configuration chosen by each operator. No public exploit code was identified at time of analysis and there is no KEV confirmation of active exploitation.
Information disclosure in SiYuan before v3.8.4 allows publish readers to retrieve image asset paths and filenames from attribute-view (database) rows that the publish configuration should have hidden. The getCurrentAttrViewImages endpoint skips the database-level publish-access check that its sibling rendering endpoint enforces, so an attacker who first obtains an unrendered database identifier from a related endpoint can supply it as avID and receive asset paths for detached rows. The flaw is remotely reachable without authentication (CVSS PR:N) and rated CVSS 6.9 (confidentiality-only, low impact); no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though the vendor has released v3.8.4 to correct it.