Unauthenticated account creation in the User Frontend WordPress plugin (versions 2.5.8 through before 4.3.12) lets remote attackers register a new user on sites where WordPress user registration is disabled, because the plugin never verifies that setting before processing its own registration form. The created account receives the site's default role, normally Subscriber, so impact is largely limited to unwanted accounts, spam, and content noise unless an administrator has configured an elevated default role; CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none, so this is a genuine but low-to-moderate priority issue best handled as routine hygiene patching rather than an emergency. Vendor-released patch: 4.3.12.
Information disclosure in ZTE U30 Air devices allows remote, unauthenticated attackers to read limited sensitive information from the affected interface, owing to improper permission control in the product's access management. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no authentication or user interaction is required but the impact ceiling is low confidentiality only - there is no integrity or availability effect and therefore no route to device takeover from this flaw alone. Exploitation requires network reachability to the vulnerable service, and attack surface is further constrained by the device's niche deployment; no public exploit identified at time of analysis and no evidence of active exploitation.
Missing authentication on AiSOC's realtime service internal fan-out routes allows any caller that can reach the realtime port (adjacent-network access, no credentials, no user interaction) to inject spoofed agent events and unauthorized device notifications for arbitrary tenant IDs into the platform's WebSocket and Redis SSE broadcast channels, corrupting the integrity of what analysts see in AiSOC 5.1.0 through 11.x. The flaw is present by default: the guard protecting POST /internal/agent-event and POST /internal/push treated an unset REALTIME_INTERNAL_TOKEN as authorized, and no shipped manifest ever passed that variable, so authentication was effectively absent in every default deployment of affected versions. Impact is integrity-only with no data disclosure or denial of service, the affected deployment base is small, and exploitation is largely constrained to networks where the target's internal realtime service is reachable; no public exploit identified at time of analysis, and a vendor fix exists in v12.0.0.
Missing authentication on AiSOC's response-action API endpoints lets adjacent-network attackers reach the actions service without credentials in versions 9.0.0 through 11.x when the shipped defaults are in use - AISOC_DEV_MODE enabled and AISOC_ACTIONS_SERVICE_TOKEN left empty. In that state the authorization guard in services/actions/app/security/authz.py exempts itself, so every mutating route answers unauthenticated, allowing an attacker to enumerate response-action integrations, submit and approve actions as arbitrary principals, and trigger host-isolation or account-disable containment actions through the platform's own vendor credentials. Exploitation is deployment-gated rather than universal: it requires network reachability to the actions-service port (adjacent/internal), and no public exploit code was identified at time of analysis. Vendor patching is available in AiSOC v12.0.0.
Arbitrary file overwrite in the PFU/Ricoh Image Scanner Driver for Linux (fi series and sp series) lets an authenticated local user destroy or corrupt files that the driver's privileged operation writes to, by pre-positioning a symbolic link that the driver later follows. The vendor rates this CVSS 4.0 5.2 (AV:L/AC:L/AT:N/PR:L/UI:P), and our independent CVSS 3.1 assessment is AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H - a local-only integrity and availability issue with no confidentiality impact and no remote or unauthenticated path. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exposure is limited to Linux hosts that actually have this specific PFU/Ricoh scanner driver installed.
Reflected cross-site scripting (CWE-79) in QloApps through 1.7.0 lets attackers inject JavaScript through the 'exceptions' parameter of the back-office 'Transplant a module' form, which AdminModulesPositionsController::displayModuleExceptionList() reflects unescaped into an HTML input so the payload executes in an authenticated administrator's browser once the victim follows a crafted link. Exploitation requires a logged-in back-office admin and victim interaction (CVSS 4.0 5.1 Medium; vector PR:L/UI:P, independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), the payload is reflected and non-persistent so each victim must be individually lured, and impact is bounded to low confidentiality/integrity with no availability effect. An upstream fix is available (GitHub PR #1899 / commit 7ed467d, which introduces Tools::safeOutput), and no public exploit is identified at time of analysis.
Stored cross-site scripting in baserCMS lets an authenticated user bypass the CMS's script-validation filter and inject arbitrary JavaScript that then executes in the browser of any other user who loads the affected page. The flaw is scored CVSS 3.0 5.4 (medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning the attacker must already hold a valid baserCMS account with the ability to submit content, and successful execution additionally depends on a second user interacting with the poisoned page. No public exploit code has been identified at time of analysis, and realistic exposure is tempered by the database being reported by JPCERT through Japan's JVN coordination program and by baserCMS's comparatively small deployment base.
Reflected cross-site scripting in the QloApps back-office (through version 1.7.0) allows an attacker to execute arbitrary JavaScript inside an authenticated administrator's browser session by inducing that admin to submit a crafted POST request to the room type editor's length-of-stay configuration. The payload is injected through the restriction_min_los and restriction_max_los parameters, which are echoed unescaped into HTML input value attributes in admin/themes/default/template/controllers/products/lengthofstay.tpl. Exploitation requires an authenticated back-office session (CVSS vector PR:L) plus administrator interaction (UI:P), so it is a social-engineering-dependent, admin-only reflected XSS rather than a passively triggered or remotely reachable flaw; no public exploit code or active exploitation was identified at time of analysis, though a technical writeup is publicly available. The vendor-supplied CVSS 4.0 score of 5.1 is modest and consistent with the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Reflected cross-site scripting in the QloApps back-office room type editor (all versions through 1.7.0) allows an attacker to execute arbitrary JavaScript in a logged-in administrator's session by inducing that administrator to submit a crafted POST request whose room_num, floor, or comment values are reflected unescaped into HTML input attributes. Exploitation is not self-triggering: it requires an authenticated back-office user and active user interaction, so the practical risk is moderate-to-low despite the administrative context, and each attempt needs a fresh lure because the XSS is non-persistent. No public exploit identified at time of analysis, and an upstream fix is available via the vendor's GitHub pull request and commit, though a tagged patched release version is not independently confirmed.
Reflected cross-site scripting in QloApps 1.7.0 and earlier lets remote attackers inject JavaScript through the date_to and id_room_type parameters of the back-office Hotel Reservation System 'Book Now' search, which executes in the browser of an authenticated administrator who follows a crafted link. Exploitation requires a logged-in back-office administrator (PR:L) and user interaction (UI:R) - the payload is reflected, not stored, so it does not self-propagate and depends on social engineering of a privileged user, which meaningfully constrains real-world impact. This is a genuine but modest-severity issue, not a top-tier priority; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), though public technical write-ups describing the bug exist.
Reflected cross-site scripting in Digiwin EasyFlow .NET allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a crafted link, but requires the victim to click the link (phishing). No public exploit identified at time of analysis. The CVSS 4.0 score is 5.1, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates low-to-moderate risk.
Stored cross-site scripting in baserCMS lets an authenticated user with a low-privileged editorial account inject arbitrary script through the 'custom content' description field, which is stored and later rendered without sanitisation in other users' browsers. Exploitation requires victim interaction (the poisoned page must be viewed) and the vulnerable endpoint is reachable remotely, giving the medium-severity rating of CVSS 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue was reported through JPCERT/CC coordination and published via JVN.
Stored cross-site scripting in the baserCMS mail (email form) feature allows an attacker who can submit crafted strings into email form fields to inject a script that executes in a victim's browser when the stored submission is later viewed, as recorded in JVN#14353754. The flaw is scored 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning it is remotely reachable, requires a low-privileged actor to plant the payload, and requires a victim to view the affected content; impact is limited to low confidentiality and integrity loss with no availability effect and a scope change because the script runs in the victim's browser session. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so exploitation is not confirmed at this time.
Missing authorization in the notification template preview of JetBrains YouTrack (versions before 2026.2.19197) allows an authenticated attacker who holds Project Administrator rights to read issues that are otherwise restricted from them. The flaw is network-exploitable with low attack complexity and no victim interaction, but the CVSS vector (PR:H) means the attacker must already be a privileged, semi-trusted insider within a project, which is why the score stays at 4.9 (Medium). There is no public exploit identified at time of analysis and no KEV listing; the vendor has released a fix in YouTrack 2026.2.19197 (tracked as EUVD-2026-90016).
Kiteworks Core deployments earlier than 9.5.0 allow an authenticated administrator to silently render a security-policy control ineffective by setting its configurable value outside the intended range, while the control continues to appear enabled in the administrative interface and audit log. The assessed impact is correspondingly limited - CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) with no confidentiality or availability impact - because exploitation requires full administrative privileges and produces a masking of enforcement rather than direct system compromise. No public exploit code was identified at time of analysis, and the realistic risk is confined to insider misuse or an already-compromised administrator session; a vendor patch is available.
Improper authorization in JetBrains YouTrack before 2026.2.19197 allows an authenticated user with restricted project permissions to edit and hide other users' comments. The flaw is an incorrect authorization check (CWE-863) that yields only integrity impact - no data disclosure or service disruption - and exploitation requires an existing YouTrack account. No public exploit code has been identified at the time of analysis, and a vendor patch is available in version 2026.2.19197.
PHP object injection in the ShortPixel Image Optimizer WordPress plugin through version 6.5.5 allows an authenticated user with Subscriber-level access or higher to pass attacker-controlled data into an unsafe deserialization path, potentially achieving limited confidentiality and integrity impact inside the plugin's scope. Exploitation is conditional and high-complexity: it only yields meaningful escalation if a usable POP gadget chain exists in WordPress core, another installed plugin, or the active theme, and no public exploit identified at time of analysis. The main exposure is sites that permit open Subscriber registration, since the attacker must first hold a low-privileged account.
Insufficient verification of user-supplied data (CWE-345) in Kiteworks Core before version 9.5.1 allows an authenticated administrator to import a file whose header passes validation while its full contents remain forged or unverified, undermining the integrity of the imported data. The flaw is reachable over the network but requires high privileges (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), so only attackers holding a Kiteworks Core administrative account and access to the administrative import function can trigger it; there is no confidentiality or availability impact and no user interaction is needed. The CVSS base score of 4.9 (Medium) accurately reflects this constrained, integrity-only issue, and no public exploit code or confirmed active exploitation was identified at time of analysis. Kiteworks has released a fix in Core 9.5.1.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.19197 allows an attacker with privileges to create or modify workflows-effectively a project administrator or workflow author-to store script content that is later rendered in a workflow error notification toast. The victim must trigger the affected workflow error path (UI:R) for the payload to execute in their authenticated YouTrack browser session; this is not a remote unauthenticated attack against default configurations, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N keeps confidentiality and integrity impact low. Vendor-released patch 2026.2.19197 is available, and no public exploit identified at time of analysis.
UsernameToken replay protection in Apache WSS4J can be bypassed by re-encoding the Nonce, allowing a captured authentication token to be reused against the same service. Affected are deployments of WSS4J 4.0.0 through 4.0.1, 3.0.0 through 3.0.5, and all 2.x releases before 2.4.4, but only where a nonce replay cache is configured - which Apache CXF enables by default - and only for UsernameTokens that use a password digest. An attacker who already holds a valid captured request (via a MITM, proxy, or shared network path) can re-send it with, for example, a whitespace character appended to the base64 Nonce; the password digest still verifies while the token no longer matches the cached entry in unpatched WSS4J, and because a UsernameToken does not cover the message body, the captured credential can be reused on arbitrary attacker-chosen requests until the token expires. Apache rates this as moderate severity, no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no CVSS vector, EPSS score, or SSVC decision was supplied by any source; the vendor has released fixed versions, so remediation is straightforward.
An authenticated user of Kiteworks Core can abuse the file-request feature to send a request that appears to originate from a different, trusted account, because the server fails to verify that the requester is authorized to act on behalf of the identity they specify. Exploitation is gated by three conditions that substantially lower real-world risk: the attacker must hold a valid account (PR:L), the file-request feature must be enabled for the attacker's profile, and the targeted recipient must actively act on the spoofed request (UI:R). There is no memory corruption, code execution, or availability impact - the flaw only enables identity misrepresentation to solicit files or information. Consistent with an assessed CVSS of 4.6, a public exploit has not been identified at time of analysis and there is no confirmed active exploitation.
Read-only users in JetBrains YouTrack can read project settings they are not entitled to see because the application fails to enforce an authorization check on that data path in all versions before 2026.2.18991. Exploitation requires a valid, authenticated YouTrack account at the read-only privilege level (CVSS vector PR:L), and the resulting impact is limited to disclosure of project settings configuration data - no modification of data, no privilege escalation, and no impact on availability. Scoring is low at CVSS 4.3, there is no CISA KEV listing and no public exploit code identified at time of analysis, and JetBrains has shipped a fixed build (2026.2.18991), so this is a low-priority information-disclosure issue that should be handled through normal patch cadence.
Local attackers with low privileges can inject crafted text into the kernel log on Linux systems running the NVIDIA GPU Display Driver because the kernel mode layer fails to sanitize a supplied version string, leading to denial of service and data tampering. The vulnerability requires local access (AV:L) and low privileges (PR:L) with no user interaction, and has low impact on integrity and availability (I:L/A:L) with no confidentiality loss. No public exploit identified at time of analysis, and the overall risk is low despite the wide deployment of NVIDIA GPUs.
Denial of service in the NVIDIA GPU Display Driver for Windows and Linux occurs when a NULL pointer dereference is triggered in the kernel-mode layer, crashing or hanging the graphics subsystem on the affected host. Only systems with a physical NVIDIA GPU (GeForce, RTX/Quadro/NVS, or Tesla branches) running a driver older than the branch-specific fixed release are exposed, and exploitation requires an attacker who already holds HIGH privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), so an unprivileged local user cannot reach the vulnerable interface. There is no confidentiality or integrity impact, no public exploit code and no confirmed active exploitation (not in CISA KEV), and the EPSS score was not reported; the high-privilege prerequisite caps real-world priority at LOW despite the nominal MEDIUM CVSS.
Denial of service in NVIDIA GPU Display Driver on Windows and Linux is possible when a highly privileged local attacker reaches a firmware code path that dereferences a null pointer. Affected products include GeForce, RTX/Quadro/NVS, and Tesla driver branches prior to the fixes documented in NVIDIA bulletin 5861, with some older branches limited to Maxwell, Volta, and Pascal GPUs. The assessed vector is local and requires high privileges, with availability impact only; no public exploit identified at time of analysis, and the low CVSS score of 4.4 reflects those constraints.
Administrator-level users on WordPress installations running the EWWW Image Optimizer plugin before 8.8.0 can rename or delete existing WebP-derivative image files outside the current site's own uploads directory, because the plugin's WebP-derivative file migration routine is not confined to that directory. On a WordPress multisite network this crosses a real authorization boundary, allowing an administrator of one site to tamper with image files belonging to a different site they have no access to; on a single-site install the practical benefit to an already-privileged administrator is minimal, which is consistent with the modest CVSS 3.1 base score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L) and with CISA SSVC signals showing no exploitation and no automation. No public exploit identified at time of analysis, and the vendor has released a fix in version 8.8.0.
Authorization bypass in JetBrains YouTrack before 2026.2.19197 lets an authenticated low-privileged user circumvent a helpdesk project's Authorized Reporters allowlist and file reports that the configuration was meant to block. The issue is network-reachable with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, score 4.3), but its impact is limited to integrity - unauthorized report submission - with no confidentiality or availability effect. It applies only to instances where a helpdesk project has actually been configured with an Authorized Reporters restriction, and the CVSS PR:L metric confirms the attacker must already hold a valid low-privileged account rather than being fully anonymous; no public exploit identified at time of analysis.
Content injection in the Kiteworks Core PDF viewer in versions before 9.5.1 allows remote attackers to load an attacker-controlled document inside the application's own trusted domain, because a URL parameter used by the viewer is not sufficiently validated (CWE-601). Under the assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (base 4.3), no authentication is required of the attacker, but exploitation depends on a victim clicking a crafted link and then trusting the rendered content; the resulting impact is limited to integrity/content spoofing (I:L) with no reading of Kiteworks data, no code execution, and no availability impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the primary abuse case is raising the credibility of phishing that relies on links embedded in the displayed content. A vendor-released patch exists in Kiteworks Core 9.5.1.
Server-side request forgery in JetBrains YouTrack before 2026.2.18991 lets an authenticated user coerce the server-side PDF export renderer into making outbound requests to attacker-influenced URLs by storing crafted XHTML content that is rendered when that content is exported to PDF. The assessed impact is confidentiality-only (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and the attack requires a valid YouTrack account plus write access to a stored field that reaches the PDF renderer; no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Kiteworks Core versions below 9.5.1 fail to enforce which roles a shared folder's Manager is allowed to assign, so an authenticated user who already holds the Manager role on a folder can grant the Owner role on that same folder to themselves or to other members. The weakness works in a default configuration, but its impact is bounded: it is an escalation to Owner within that one folder and does not by itself confer tenant-wide or system-administrator rights. Rated CVSS 4.3 (integrity-only, low confidentiality and availability impact), with no public exploit code identified at time of analysis and no CISA KEV entry.
Improper access control in JetBrains YouTrack before 2026.2.18991 lets an authenticated user who has only view-only permission on a Gantt chart perform edit operations that the access model should block. The flaw is network-reachable but requires a valid YouTrack account (PR:L), has no user-interaction component, and is confined to low-severity integrity impact on scheduling/Gantt data with no confidentiality or availability effect (CVSS 4.3, CWE-863). There is no confirmed active exploitation (CISA KEV not listed) and no public exploit identified at time of analysis; the vendor has released a fixed build in 2026.2.18991.
JetBrains YouTrack before 2026.2.19197 fails to enforce read permissions when creating a project from a custom template, allowing an authenticated low-privileged user to read template data they are not authorized to access. This missing authorization flaw (CWE-862) has a low confidentiality impact (CVSS 3.1) and requires high attack complexity, a valid account, and the existence of an unreadable custom template; no public exploit code has been identified. The vendor has released a patch in version 2026.2.19197.
Direct URL access to Moodle's manual enrolment management page allows authenticated users who already hold enrolment-management permissions to modify manual enrolments even after an administrator has disabled the manual enrolment plugin in the UI. The issue is a forced-browsing access-control weakness rated low real risk with integrity-only impact: it does not let unauthenticated or ordinary users exploit it, read data, or escalate privileges. No public exploit identified at time of analysis, and no CISA KEV entry was reported.
An authenticated teacher in Moodle can add users to groups that belong to courses they are not authorized to manage, because the enrol-user-into-course-with-group-assignment workflow fails to verify that the supplied group actually belongs to the target course. The flaw is a low-severity authorization weakness (CVSS 4.3, CWE-842, Placement into Incorrect Group) that requires a valid teacher-level account (PR:L) and causes only limited integrity impact to group membership; no public exploit code was identified and there is no evidence of active exploitation at time of analysis. Confidentiality and availability are unaffected, so the practical risk is unauthorized group placement and possible exposure of course-group context rather than data theft or service disruption.
Missing capability check in Moodle's grade-penalty recalculation routine allows any authenticated low-privileged user to trigger unauthorized recalculation and modify grade penalty records, potentially altering student assessment scores. The flaw requires a valid Moodle account but no additional user interaction; it is not known to be actively exploited, and no public exploit code has been identified at time of analysis. Impact is limited to integrity of grade-penalty data with no confidentiality or availability impact.
Broken access control in the miniOrange "Prevent files / folders access" WordPress plugin (versions through 2.6.7) lets an authenticated Subscriber - the lowest standard WordPress role - read the contents of files and folders the plugin is configured to protect. The condition is a missing-authorization flaw (CWE-862) scored CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so the impact is confidentiality-only: protected content can be disclosed, but nothing can be modified or taken offline. No KEV listing, public exploit code, or EPSS signal accompanies this disclosure, so no public exploit identified at time of analysis; practical risk depends on whether self-registration is enabled on the target site or the attacker otherwise holds a Subscriber account.
Authenticated users with Subscriber-level access or higher can exploit an insecure direct object reference in Webba Booking (webba-booking-lite) versions 6.5.0 and earlier to read booking records belonging to other users, resulting in limited information disclosure. The vulnerability requires a valid WordPress account (PR:L) and no user interaction, but has a low CVSS score of 4.3 due to its limited confidentiality impact and lack of integrity or availability effects. No public exploit code has been identified, and the issue is considered a low-priority, low-real-risk vulnerability per independent assessment, though sites with open user registration face greater exposure.
Subscriber-level insecure direct object reference (IDOR) in the Omnisend WordPress plugin through version 1.9.0 allows an authenticated low-privilege user (Subscriber or higher) to modify certain objects they do not own. The flaw is rated CVSS 4.3 with a limited integrity-only impact, requires no user interaction, and can be reached remotely; no public exploit was identified at time of analysis. Sites running the plugin 1.9.0 or earlier with open registration are at higher practical risk because obtaining the required Subscriber account is trivial.
Authenticated WordPress users with Contributor-level access can exploit an insecure direct object reference (IDOR) in the Safe SVG plugin (versions 2.5.0 and earlier) to read data they are not authorized to access. The vulnerability requires a low-privileged account, network access, and no user interaction, but only results in limited confidentiality impact. No public exploit identified at time of analysis.
An authenticated, low-privilege Grafana user can read alert rule configurations from folders they are not authorized to view through the alert rules API list endpoint, because the folder-based authorization filter is dropped when the caller's set of readable folders is empty - causing the endpoint to return every alert rule in the organization. Starting with Grafana 13.1.0, any user can also trigger cross-folder disclosure by simply supplying a folder filter to that same endpoint. The impact is confidentiality-only and limited to rule configuration metadata (data source credentials are not exposed); the vendor (security@grafana.com) is the reporting source, and no public exploit code has been identified at time of analysis.
Authenticated Moodle users who hold Report Builder audience-management permissions can abuse an improperly validated audience class name to instantiate arbitrary internal PHP classes, producing unexpected internal objects and altered application behavior (CWE-470, unsafe reflection). The vendor and independent assessment both rate real-world risk as low: the assessed vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N (score 2.2), because reaching the flaw requires a semi-privileged authenticated account able to create or manage Report Builder audiences, and the attack is rated high complexity with no victim interaction. Impact is bounded to integrity - no confidentiality or availability effect is described - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in Moodle's grade web service allows an authenticated student to view profile details of other students enrolled in the same course even though they lack the required capability. The issue is a low-severity confidentiality-only flaw (CVSS 4.3, CWE-359) reachable over the network with low attack complexity but requiring a valid student account. No public exploit code or confirmed active exploitation was identified in the provided data, and an upstream fix commit (MDL-89381) is referenced but a released patched version is not independently confirmed.
Authenticated remote users of Moodle can bypass the URL downloader's host-blocking logic by encoding a restricted destination as an IPv4-mapped IPv6 address (for example ::ffff:<internal-ip>), causing the server to fetch resources from internal or otherwise blocked hosts on the attacker's behalf. Successful abuse yields Server-Side Request Forgery limited to confidentiality impact (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), meaning the practical damage depends on what the Moodle server itself can reach - typically cloud instance-metadata endpoints or internal-only services - and is reduced on segmented networks. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this is a genuine but modest-priority issue that should be scheduled alongside routine patch cycles rather than treated as an emergency.
Information disclosure in the Image Optimizer WordPress plugin before 1.7.7 allows any authenticated user to read attachment metadata and site-wide statistics that are meant to be administrator-only, because several read REST routes fail to enforce the intended capability check (CVSS:3.1 4.3, PR:L, confidentiality impact only). The only real prerequisite is a valid WordPress account of any privilege level on a site running the vulnerable plugin, so exposure is greatest where open registration or low-privilege user accounts are available; no victim interaction is required and attack complexity is low. There is no confirmed active exploitation (CISA SSVC: exploitation none, not automatable) and no public exploit code identified at time of analysis, and a vendor patch is available.
Broken access control in the Robin Image Optimizer WordPress plugin before 2.0.8 lets any authenticated subscriber-level user render admin-only plugin pages and read the plugin's stored settings, because a bundled admin-framework request handler dispatches requests without performing a capability check. The flaw is network-reachable but authenticated (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3 Medium), so practical exploitation depends on the target site permitting open or self-service registration; otherwise the attacker must already hold any low-privilege credential. Impact is limited to disclosure of the plugin's own configuration data - there is no integrity or availability effect, no escalation to administrator, and no public exploit code identified at time of analysis, so this is a low-real-risk issue despite its 'Authentication Bypass' tag.
Missing authorization in the All in One Files Upload WordPress plugin before 2.0.17 lets any authenticated user - a subscriber-level account is sufficient per the reported issue - rewrite the plugin's saved settings, because the settings-save handler performs neither a capability check nor a request-authenticity (nonce/CSRF) check. The impact is integrity-only and limited to plugin configuration; there is no data disclosure, no denial of service, and no server-side code execution, which is consistent with the assessed CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and the CISA SSVC decision of exploitation: none, automatable: no, technical impact: partial. No public exploit code was identified at time of analysis, and vendor-released patch 2.0.17 is available. The practical exposure is greatest on sites that allow open or self-service registration, since the attacker must first hold a valid WordPress account.
All In One WP Security & Firewall 5.4.8 and earlier contains an authentication-bypass-by-spoofing flaw that lets a logged-in Subscriber-level user slip past a plugin security check by supplying a spoofable or predictable value, yielding limited confidentiality and integrity impact (CVSS 4.2, C:L/I:L/A:N). Exploitation is not trivially repeatable: it requires an account at Subscriber level or higher (PR:L) and is gated by high attack complexity (AC:H), meaning the attacker must satisfy conditions outside their direct control such as specific plugin state or timing. No public exploit code and no confirmed active exploitation have been identified at time of analysis, so the practical risk is modest despite the plugin's very large WordPress install base.
An authenticated administrator on Kiteworks Core can bypass server-side content validation for administrative file uploads, allowing storage of files with dangerous content. While this alone does not execute code, it could be leveraged in a chained attack with a separate vulnerability. Affected versions are prior to 9.5.1, and a vendor patch is available. The low CVSS score (4.1) reflects the high privilege requirement and complex bypass, and no public exploit has been identified.
Apache WSS4J versions 4.0.0 through 4.0.1, 3.0.0 through 3.0.5, and all 2.x releases before 2.4.4 can accept SOAP messages in which a required element was never signed or encrypted, because the StAX streaming WS-SecurityPolicy validator converts relative or otherwise unsupported XPath expressions into paths that never match the real XML element path. The result is a fail-open integrity failure: a remote, unauthenticated SOAP peer (CVSS 3.1 AV:N/PR:N/UI:N) can send a policy-required element without the expected signature or encryption and the validator will not object. Exploitation is conditional on the deployment using WSS4J's StAX/streaming policy validator with a security policy whose SignedElements, EncryptedElements, or RequiredElements assertions use relative or unsupported XPath; our independent assessment rates the exploit vector AC:H and limits impact to integrity (I:H) with no confidentiality or availability effect, well below the vendor's 9.1 score, and no public exploit code has been identified at time of analysis.
Uninitialized stack memory disclosure in apcupsd's optional CGI web interface (upsstats.cgi, multimon.cgi, upsfstats.cgi) allows remote attackers to read non-deterministic stack contents from HTTP responses when a matched STATUS line contains fewer than three whitespace-separated tokens. All versions through 3.14.14 are affected per the CPE range, but exposure requires that the non-default CGI component be built, deployed, and network-reachable; the core apcupsd daemon itself is not affected. The issue is rated low severity (CVSS 3.1 base 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) both because the parsing condition is narrow and because the leaked bytes are uninitialized memory whose contents are unpredictable and frequently non-sensitive; no public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (CISA KEV).