Authenticated IDOR in the WordPress plugin Flexible PDF Coupons (versions up to and including 1.14.11) lets a Contributor-level account manipulate object identifiers to act on coupon and PDF records it does not own. The vulnerability is network-reachable and low complexity, but requires a valid low-privilege WordPress account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4), and per the assessed vector the impact is limited to low integrity and availability effects with no confidentiality disclosure. No public exploit identified at time of analysis; there is no CISA KEV listing and no EPSS signal was provided, and no vendor-released patch version was identified in the available data.
Grafana's dashboard creation API fails to authorize the file-provisioning annotations grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath, so a user holding only the Editor role can create a dashboard that appears to be file-provisioned and is therefore no longer updatable or deletable by administrators through Grafana. Exploitation needs an authenticated account with at least Editor rights in the target organization (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) and affects default deployments with Editor users; the impact stays inside the attacker's own organization and no data is exposed, making it a management denial on the affected dashboard rather than a data-breach primitive. No public exploit identified at time of analysis.
OS command injection in the PFU Limited Image Scanner Driver for Linux (both the fi series and sp series packages) allows a user who already holds a valid login on the affected host to execute arbitrary operating-system commands, potentially at the privilege level of the driver or its helper processes. Exploitation is not remote and not trivial: the assessed vector (AV:L/AC:H/PR:L/UI:R) and the vendor's own wording that the attacker must make 'certain preparations' indicate that a local account plus staging of specific conditions, and possibly a triggering scan-related action by another user, are prerequisites. No public exploit identified at time of analysis and no CISA KEV listing was present in the supplied intelligence, so this is assessed as a genuinely moderate rather than high priority issue - the confidentiality, integrity and availability impact is high where it is successfully triggered, but the local-access and high-complexity gates sharply limit realistic exposure.
Partial denial of service in Kiteworks Email Protection Gateway before 9.5.1 is achievable by unauthenticated remote attackers who repeatedly invoke a server-side operation that is exposed without any authentication check (CWE-306), consuming disproportionate resources relative to the request. The impact is availability-only and limited (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) - sustained repetition is required, so effectiveness depends on the gateway's resource headroom and any upstream rate limiting or network filtering. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor-released patch is available in version 9.5.1, and the issue is tracked as EUVD-2026-90268 with advisory GHSA-wwhf-5862-rjxq.
Stored cross-site scripting in AJA HELO Plus firmware before 2.1.7 lets an unauthenticated attacker with network access to the device's web configuration API write a malicious JavaScript payload into the eParamID_SystemName field via /config?action=set, which then executes in the browser of any administrator who opens the management interface. The write path is only reachable when device authentication is disabled, making that an operator-chosen configuration the primary gating condition, and successful exploitation requires a victim administrator to load the interface (UI:P passive interaction). Impact is limited to hijacking the authenticated session and exfiltrating stored secrets - web UI credentials, RTMP stream keys, publish URLs, and NFS/SMB share credentials - rather than code execution on the device itself; no public exploit identified at time of analysis, and the vendor has released firmware 2.1.7 as the fix.
HTTP request smuggling in libsoup's SoupServer - as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 - allows remote, unauthenticated attackers to have an attacker-controlled HTTP request processed as an unintended subsequent request on a keep-alive connection. The issue triggers when an HTTP/1.x client sends 'Expect: 100-continue' with a declared body and the SoupServer-based application issues an early final (non-1xx) response before that body is read; SoupServer then neither drains the body bytes nor closes the connection, so the leftover bytes are parsed as the next request. Rated CVSS 3.1 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the flaw carries limited integrity impact on request handling while leaving confidentiality and availability unaffected, and it is inert unless the specific combination of keep-alive, a declared body, and an early final response is present. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Stale authentication material tied to JetBrains YouTrack's mailbox integration continues to be accepted after a user's password reset in versions prior to 2026.2.18991, letting an actor who already holds the pre-reset credentials keep authenticating through that path when the reset should have invalidated them. The flaw is limited to deployments that use the mailbox integration feature and to accounts that have actually undergone a password reset; the impact is integrity-only (no confidentiality or availability effect), and the assessed complexity is higher than the base 5.3 vector implies because a preceding reset plus possession of the stale credentials are both required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor has released a fix.
Server-side request forgery in OpenClaw Windows Node through 2026.9.4 allows an attacker who already holds gateway or agent access to invoke the canvas.present capability and make the node's WebView issue requests to localhost, RFC1918 private ranges, link-local/cloud-metadata addresses, CGNAT and Tailscale (100.64/10) services from the user's machine - destinations that canvas.navigate would reject through its URL risk evaluation, which canvas.present bypasses entirely. The prerequisite is an authenticated control channel to the node (CVSS vector PR:L), so this is not exploitable by anonymous external attackers and yields only limited confidentiality and integrity impact (VC:L/VI:L, no availability impact); a prompt-injected but legitimately connected agent is a realistic delivery path. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but it is a genuine, bounded SSRF risk in deployments that expose the gateway/agent channel. An upstream fix commit exists, though a tagged released version is not independently confirmed in the supplied data.
Unauthenticated sensitive data exposure in the Multiple Pages Generator (MPG) WordPress plugin from Themeisle, affecting versions 4.2.3 and earlier, allows any remote visitor to read information the plugin includes in its HTTP responses without authenticating or interacting with the site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base score 5.3). The consequence is confined to partial confidentiality loss - no integrity or availability impact - making it an information-gathering aid that could support follow-on attacks rather than a direct compromise vector. No public exploit code has been identified at time of analysis, and the flaw has not been confirmed as actively exploited (CISA KEV).
Decodable credential storage in Itron MV-90 xi 3.0 lets an attacker who can read the product's configuration file recover stored passwords and password histories and then log in to MV-90 as any user, including privileged accounts. The attack is local, not remote: the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) requires prior access to the host and a low-privileged account or equivalent filesystem read permission on the config file, after which no user interaction is needed, making this a privilege-escalation and lateral-movement primitive rather than an initial-access flaw. No public exploit has been identified at time of analysis (CISA SSVC records Exploitation: none), and the cross-vendor assessment rates technical impact as partial, so exploitation is opportunistic and contingent on the attacker already having a foothold with file-read access.
Authenticated users with only the read-only dashboard.user.view permission in bbs-go through 4.4.6 can reach the /api/admin/user/synccount endpoint because AdminMiddleware matches the view permission rule before the intended dashboard.user.update rule. Repeated calls trigger expensive full-table user recounts and cache invalidations, causing low-impact denial of service through concurrent database work. No public exploit was identified at time of analysis, and an upstream patch commit is available from the vendor.
An authorization bypass (IDOR, CWE-639) in the Pay with Vipps for WooCommerce WordPress plugin, versions through 6.2.4, lets an authenticated, logged-in user retrieve order or customer records belonging to other users by supplying a manipulated, user-controlled object key. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) shows the attacker must already hold a valid account (PR:L), that no user interaction is needed, and that the impact is limited to low confidentiality loss with no integrity or availability effect. Our independent assessment (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) rates this as moderate-severity and low real-world risk, confined to WooCommerce stores that actually use the Vipps payment method; no public exploit identified at time of analysis.
The Vaadin Spreadsheet component fails to enforce sheet protection when writing cell comments, so any authenticated user of an application that renders a spreadsheet can insert or overwrite comments on a protected sheet - including on cells that are explicitly locked - and can write a comment to a cell that does not yet exist, which creates the underlying row and cell. Only logged-in users of the host application are affected (CVSS v4.0 base 5.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and the impact is confined to spreadsheet integrity: no confidentiality or availability impact, no user interaction, and low attack complexity. Exploitation requires the Spreadsheet component to actually be rendered, sheet protection to be enabled, and a valid session; no public exploit code or CISA KEV entry is identified at time of analysis. Fixed releases (Vaadin 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 and Spreadsheet add-on 3.1.1) are available per the vendor advisory.
Account enumeration in Maksisoft Gym 0.5.10 (and later 0.5.x builds short of 0.5.11) lets unauthenticated remote attackers determine which usernames or email addresses correspond to real accounts by observing inconsistent responses from login, registration, or password-reset endpoints. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3, reflecting a network-reachable, no-authentication, no-interaction information-disclosure issue with confidentiality-only, low-severity impact - there is no direct account takeover, integrity, or availability effect. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV); real-world exposure is further limited by the small, regionally concentrated deployment base and by the attacker's need to supply candidate identifiers to test.
Unauthenticated denial of service in the Two Factor WordPress plugin versions up to and including 0.16.0 allows remote attackers to degrade service availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates a network-reachable, low-complexity attack requiring no authentication or user interaction, but with only low availability impact and no effect on confidentiality or integrity (base score 5.3). No public exploit identified at time of analysis; the vulnerability is tracked as CWE-770 (Allocation of Resources Without Limits or Throttling).
Unauthenticated insecure direct object reference (IDOR) in the RadiusTheme Review Schema WordPress plugin affects all versions up to and including 3.1.0, allowing remote attackers to reach plugin objects by manipulating an identifier without any login or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-reachable and unauthenticated, but the scope is narrow: only low-integrity modification (C:N/I:L/A:N), so the practical outcome is unauthorized alteration of the objects the IDOR exposes rather than data disclosure or site takeover. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and no fixed version is specified in the available intelligence. Overall this is a moderate-severity, low-real-risk issue whose main uncertainty is the undocumented endpoint and parameter.
Unauthenticated sensitive data exposure in the Notivo WordPress plugin (woo-notification) through version 1.4.2 allows remote attackers to retrieve limited confidential information from affected sites without authentication or user interaction. The CVSS vector (PR:N/UI:N) confirms the issue is remotely exploitable on a default installation, but impact is confined to low confidentiality (C:L) with no integrity or availability effect. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the plugin's narrow deployment footprint limits exposure relative to core WordPress.
Unauthenticated attackers can bypass a membership/access-control check in the WordPress plugin Paid Member Subscriptions (CozmoLabs) at versions 3.0.9 and earlier, allowing protected content or functionality to be reached without valid membership credentials. The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms the attack is remote, low-complexity, requires no authentication or user interaction against a default installation, but is capped at a LOW integrity-only impact with no confidentiality or availability effect. Reported by Patchstack; no public exploit identified at time of analysis, and the flaw is not in CISA KEV.
Client Invoicing by Sprout Invoices versions up to and including 20.8.17 exposes an unauthenticated Insecure Direct Object Reference (IDOR) that lets a remote attacker read individual billing, invoice and client records simply by manipulating an object-identifier parameter. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base score 5.3 Medium) confirms the flaw is remotely reachable with low complexity and no authentication or user interaction, although impact is limited to low-severity confidentiality loss with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis; the issue was reported through Patchstack and affects any WordPress site running the plugin at or below version 20.8.17.
Unauthenticated remote attackers can exploit an insecure direct object reference (IDOR) in the GiveWP WordPress donation plugin through versions 4.16.9 and earlier to manipulate another entity's object without authorization. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, yielding a moderate 5.3 score; impact is limited to integrity, with no confidentiality or availability effect, and exploitation depends on enumerating or predicting valid object identifiers. No public exploit identified at time of analysis, and the exact vulnerable endpoint and parameter are not disclosed in the advisory.
Unauthenticated attackers can read appointment and booking records from WordPress sites running the Simply Schedule Appointments plugin at version 1.6.12.31 or earlier by manipulating object identifiers passed to the plugin's public-facing endpoints, an insecure direct object reference (IDOR) issue tracked as CVE-2026-94673. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N): no credentials, no user interaction, and only low-complexity remote requests are required, but impact is limited to confidentiality - data can be viewed, not altered or deleted. Exploitation is feasible against default configurations wherever the plugin is installed and its AJAX/REST endpoints are reachable; no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so real-world urgency is moderate rather than critical, with exposure bounded to the objects the vulnerable endpoint exposes rather than the whole site.
Pgpool-II writes sensitive cluster configuration and topology information into its log files, allowing an authenticated attacker who can read those logs to learn details about the PostgreSQL cluster. Exploitation requires a valid low-privilege account (CVSS vector PR:L, network reachable) plus read access to the log store, and the resulting impact is limited to confidentiality (C:L) with no integrity or availability effect. No public exploit code has been identified at time of analysis, and this rates as a low-to-moderate priority information-disclosure issue rather than a critical one.
Unauthenticated information disclosure in the Course Booking System WordPress plugin (versions 7.0 through before 7.0.9) lets any anonymous visitor download the full booking export, exposing the name, email address, and billing address of every customer who has booked a course. The flaw is an access-control gap in the plugin's export function (CWE-200), reachable over the network with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). This is a genuine but moderate-severity exposure: impact is confined to confidentiality of already-collected booking PII, with no write capability or code execution, and there is no public exploit identified at time of analysis and no indication of active exploitation (CISA SSVC exploitation: none).
Unauthenticated information disclosure in the YayReviews WordPress plugin (all releases before 1.4.1, with the EUVD entry listing 1.0.4 as the earliest confirmed affected version) allows remote attackers to retrieve individual customer review records from an API route that enforces no access control, including reviews still awaiting moderation. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, no authentication, user interaction, or non-default configuration is required - the only prerequisite is that the site runs a vulnerable version with the route reachable - and the consequence is bulk harvesting of reviewers' email addresses and other non-public review content, with no integrity or availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the CISA SSVC assessment records Exploitation: none while flagging the issue as Automatable: yes, so the realistic risk is low-to-moderate PII exposure proportional to the plugin's modest deployment footprint rather than site compromise.
Unauthenticated attackers can forge shipment-status webhook requests to the InPost PL WordPress plugin (versions 1.7.5 through before 1.9.8) and prematurely mark a target order as completed, provided they know that order's parcel tracking number. The webhook handler relies only on a non-secret identifier and an IP allowlist that is not actually enforced, so the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials or user interaction are required; the practical limiting factor is knowledge of a valid tracking number, which scopes abuse toward specific known orders rather than untargeted mass exploitation. This is a low-severity access-control flaw (CWE-862, CVSS 5.3) with no data disclosure or service disruption, and no public exploit code or active exploitation is known at time of analysis (SSVC Exploitation: none; no CISA KEV entry).
Unauthenticated information disclosure in the Connections Business Directory WordPress plugin (versions through 10.4.67) allows remote attackers to read directory entries that should be restricted-including names, organizations, biographies, internal notes, and street addresses-because certain REST API read endpoints omit visibility and moderation-status checks. The plugin has been closed on WordPress.org and no fixed version is available, while no public exploit code has been identified at the time of analysis. The CVSS 3.1 base score of 5.3 reflects a network-reachable, low-complexity, unauthenticated confidentiality-only impact per the assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Unauthenticated information disclosure in the New User Approve WordPress plugin before 3.2.10 lets remote attackers retrieve registered users' ID, username, email address and registration date via integration REST API routes that skip authentication checks while the integration remains unconfigured. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) and is rated moderate severity; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as none with automatable attack potential. Sites running affected versions 3.1.0 through 3.2.10 are exposed in the default unconfigured-integration state, whereas sites that have set up the integration are not affected.
Unauthenticated visitors can read the rendered content of non-published WordPress posts and pages - including drafts, pending, private, and scheduled items - on any site running the Solace Extra plugin before 1.7.2, because the plugin's front-end preview routes omit both authorization and post-status checks. Exploitation is trivial: no credentials, no user interaction, and no non-default configuration are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), though impact is limited to confidentiality, bounded by whatever unpublished content exists on the target site and by what the preview routes can render. There is no public exploit code and no confirmed active exploitation (SSVC exploitation: none) at time of analysis, and a vendor fix is already available in 1.7.2, so this rates as a genuine but low-to-moderate priority information-disclosure issue rather than an emergency.
Unauthenticated account creation in the User Frontend WordPress plugin (versions 2.5.8 through before 4.3.12) lets remote attackers register a new user on sites where WordPress user registration is disabled, because the plugin never verifies that setting before processing its own registration form. The created account receives the site's default role, normally Subscriber, so impact is largely limited to unwanted accounts, spam, and content noise unless an administrator has configured an elevated default role; CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). There is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as none, so this is a genuine but low-to-moderate priority issue best handled as routine hygiene patching rather than an emergency. Vendor-released patch: 4.3.12.
Information disclosure in ZTE U30 Air devices allows remote, unauthenticated attackers to read limited sensitive information from the affected interface, owing to improper permission control in the product's access management. The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning no authentication or user interaction is required but the impact ceiling is low confidentiality only - there is no integrity or availability effect and therefore no route to device takeover from this flaw alone. Exploitation requires network reachability to the vulnerable service, and attack surface is further constrained by the device's niche deployment; no public exploit identified at time of analysis and no evidence of active exploitation.
Missing authentication on AiSOC's realtime service internal fan-out routes allows any caller that can reach the realtime port (adjacent-network access, no credentials, no user interaction) to inject spoofed agent events and unauthorized device notifications for arbitrary tenant IDs into the platform's WebSocket and Redis SSE broadcast channels, corrupting the integrity of what analysts see in AiSOC 5.1.0 through 11.x. The flaw is present by default: the guard protecting POST /internal/agent-event and POST /internal/push treated an unset REALTIME_INTERNAL_TOKEN as authorized, and no shipped manifest ever passed that variable, so authentication was effectively absent in every default deployment of affected versions. Impact is integrity-only with no data disclosure or denial of service, the affected deployment base is small, and exploitation is largely constrained to networks where the target's internal realtime service is reachable; no public exploit identified at time of analysis, and a vendor fix exists in v12.0.0.
Missing authentication on AiSOC's response-action API endpoints lets adjacent-network attackers reach the actions service without credentials in versions 9.0.0 through 11.x when the shipped defaults are in use - AISOC_DEV_MODE enabled and AISOC_ACTIONS_SERVICE_TOKEN left empty. In that state the authorization guard in services/actions/app/security/authz.py exempts itself, so every mutating route answers unauthenticated, allowing an attacker to enumerate response-action integrations, submit and approve actions as arbitrary principals, and trigger host-isolation or account-disable containment actions through the platform's own vendor credentials. Exploitation is deployment-gated rather than universal: it requires network reachability to the actions-service port (adjacent/internal), and no public exploit code was identified at time of analysis. Vendor patching is available in AiSOC v12.0.0.
Arbitrary file overwrite in the PFU/Ricoh Image Scanner Driver for Linux (fi series and sp series) lets an authenticated local user destroy or corrupt files that the driver's privileged operation writes to, by pre-positioning a symbolic link that the driver later follows. The vendor rates this CVSS 4.0 5.2 (AV:L/AC:L/AT:N/PR:L/UI:P), and our independent CVSS 3.1 assessment is AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H - a local-only integrity and availability issue with no confidentiality impact and no remote or unauthenticated path. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exposure is limited to Linux hosts that actually have this specific PFU/Ricoh scanner driver installed.
Reflected cross-site scripting (CWE-79) in QloApps through 1.7.0 lets attackers inject JavaScript through the 'exceptions' parameter of the back-office 'Transplant a module' form, which AdminModulesPositionsController::displayModuleExceptionList() reflects unescaped into an HTML input so the payload executes in an authenticated administrator's browser once the victim follows a crafted link. Exploitation requires a logged-in back-office admin and victim interaction (CVSS 4.0 5.1 Medium; vector PR:L/UI:P, independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), the payload is reflected and non-persistent so each victim must be individually lured, and impact is bounded to low confidentiality/integrity with no availability effect. An upstream fix is available (GitHub PR #1899 / commit 7ed467d, which introduces Tools::safeOutput), and no public exploit is identified at time of analysis.
Stored cross-site scripting in baserCMS lets an authenticated user bypass the CMS's script-validation filter and inject arbitrary JavaScript that then executes in the browser of any other user who loads the affected page. The flaw is scored CVSS 3.0 5.4 (medium) with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, meaning the attacker must already hold a valid baserCMS account with the ability to submit content, and successful execution additionally depends on a second user interacting with the poisoned page. No public exploit code has been identified at time of analysis, and realistic exposure is tempered by the database being reported by JPCERT through Japan's JVN coordination program and by baserCMS's comparatively small deployment base.
Reflected cross-site scripting in the QloApps back-office (through version 1.7.0) allows an attacker to execute arbitrary JavaScript inside an authenticated administrator's browser session by inducing that admin to submit a crafted POST request to the room type editor's length-of-stay configuration. The payload is injected through the restriction_min_los and restriction_max_los parameters, which are echoed unescaped into HTML input value attributes in admin/themes/default/template/controllers/products/lengthofstay.tpl. Exploitation requires an authenticated back-office session (CVSS vector PR:L) plus administrator interaction (UI:P), so it is a social-engineering-dependent, admin-only reflected XSS rather than a passively triggered or remotely reachable flaw; no public exploit code or active exploitation was identified at time of analysis, though a technical writeup is publicly available. The vendor-supplied CVSS 4.0 score of 5.1 is modest and consistent with the independently assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Reflected cross-site scripting in the QloApps back-office room type editor (all versions through 1.7.0) allows an attacker to execute arbitrary JavaScript in a logged-in administrator's session by inducing that administrator to submit a crafted POST request whose room_num, floor, or comment values are reflected unescaped into HTML input attributes. Exploitation is not self-triggering: it requires an authenticated back-office user and active user interaction, so the practical risk is moderate-to-low despite the administrative context, and each attempt needs a fresh lure because the XSS is non-persistent. No public exploit identified at time of analysis, and an upstream fix is available via the vendor's GitHub pull request and commit, though a tagged patched release version is not independently confirmed.
Reflected cross-site scripting in QloApps 1.7.0 and earlier lets remote attackers inject JavaScript through the date_to and id_room_type parameters of the back-office Hotel Reservation System 'Book Now' search, which executes in the browser of an authenticated administrator who follows a crafted link. Exploitation requires a logged-in back-office administrator (PR:L) and user interaction (UI:R) - the payload is reflected, not stored, so it does not self-propagate and depends on social engineering of a privileged user, which meaningfully constrains real-world impact. This is a genuine but modest-severity issue, not a top-tier priority; no public exploit code was identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), though public technical write-ups describing the bug exist.
Reflected cross-site scripting in Digiwin EasyFlow .NET allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a crafted link, but requires the victim to click the link (phishing). No public exploit identified at time of analysis. The CVSS 4.0 score is 5.1, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates low-to-moderate risk.
Stored cross-site scripting in baserCMS lets an authenticated user with a low-privileged editorial account inject arbitrary script through the 'custom content' description field, which is stored and later rendered without sanitisation in other users' browsers. Exploitation requires victim interaction (the poisoned page must be viewed) and the vulnerable endpoint is reachable remotely, giving the medium-severity rating of CVSS 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue was reported through JPCERT/CC coordination and published via JVN.
Stored cross-site scripting in the baserCMS mail (email form) feature allows an attacker who can submit crafted strings into email form fields to inject a script that executes in a victim's browser when the stored submission is later viewed, as recorded in JVN#14353754. The flaw is scored 5.4 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning it is remotely reachable, requires a low-privileged actor to plant the payload, and requires a victim to view the affected content; impact is limited to low confidentiality and integrity loss with no availability effect and a scope change because the script runs in the victim's browser session. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so exploitation is not confirmed at this time.
Missing authorization in the notification template preview of JetBrains YouTrack (versions before 2026.2.19197) allows an authenticated attacker who holds Project Administrator rights to read issues that are otherwise restricted from them. The flaw is network-exploitable with low attack complexity and no victim interaction, but the CVSS vector (PR:H) means the attacker must already be a privileged, semi-trusted insider within a project, which is why the score stays at 4.9 (Medium). There is no public exploit identified at time of analysis and no KEV listing; the vendor has released a fix in YouTrack 2026.2.19197 (tracked as EUVD-2026-90016).
Kiteworks Core deployments earlier than 9.5.0 allow an authenticated administrator to silently render a security-policy control ineffective by setting its configurable value outside the intended range, while the control continues to appear enabled in the administrative interface and audit log. The assessed impact is correspondingly limited - CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) with no confidentiality or availability impact - because exploitation requires full administrative privileges and produces a masking of enforcement rather than direct system compromise. No public exploit code was identified at time of analysis, and the realistic risk is confined to insider misuse or an already-compromised administrator session; a vendor patch is available.
Improper authorization in JetBrains YouTrack before 2026.2.19197 allows an authenticated user with restricted project permissions to edit and hide other users' comments. The flaw is an incorrect authorization check (CWE-863) that yields only integrity impact - no data disclosure or service disruption - and exploitation requires an existing YouTrack account. No public exploit code has been identified at the time of analysis, and a vendor patch is available in version 2026.2.19197.
PHP object injection in the ShortPixel Image Optimizer WordPress plugin through version 6.5.5 allows an authenticated user with Subscriber-level access or higher to pass attacker-controlled data into an unsafe deserialization path, potentially achieving limited confidentiality and integrity impact inside the plugin's scope. Exploitation is conditional and high-complexity: it only yields meaningful escalation if a usable POP gadget chain exists in WordPress core, another installed plugin, or the active theme, and no public exploit identified at time of analysis. The main exposure is sites that permit open Subscriber registration, since the attacker must first hold a low-privileged account.
Insufficient verification of user-supplied data (CWE-345) in Kiteworks Core before version 9.5.1 allows an authenticated administrator to import a file whose header passes validation while its full contents remain forged or unverified, undermining the integrity of the imported data. The flaw is reachable over the network but requires high privileges (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N), so only attackers holding a Kiteworks Core administrative account and access to the administrative import function can trigger it; there is no confidentiality or availability impact and no user interaction is needed. The CVSS base score of 4.9 (Medium) accurately reflects this constrained, integrity-only issue, and no public exploit code or confirmed active exploitation was identified at time of analysis. Kiteworks has released a fix in Core 9.5.1.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.19197 allows an attacker with privileges to create or modify workflows-effectively a project administrator or workflow author-to store script content that is later rendered in a workflow error notification toast. The victim must trigger the affected workflow error path (UI:R) for the payload to execute in their authenticated YouTrack browser session; this is not a remote unauthenticated attack against default configurations, and the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N keeps confidentiality and integrity impact low. Vendor-released patch 2026.2.19197 is available, and no public exploit identified at time of analysis.
UsernameToken replay protection in Apache WSS4J can be bypassed by re-encoding the Nonce, allowing a captured authentication token to be reused against the same service. Affected are deployments of WSS4J 4.0.0 through 4.0.1, 3.0.0 through 3.0.5, and all 2.x releases before 2.4.4, but only where a nonce replay cache is configured - which Apache CXF enables by default - and only for UsernameTokens that use a password digest. An attacker who already holds a valid captured request (via a MITM, proxy, or shared network path) can re-send it with, for example, a whitespace character appended to the base64 Nonce; the password digest still verifies while the token no longer matches the cached entry in unpatched WSS4J, and because a UsernameToken does not cover the message body, the captured credential can be reused on arbitrary attacker-chosen requests until the token expires. Apache rates this as moderate severity, no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no CVSS vector, EPSS score, or SSVC decision was supplied by any source; the vendor has released fixed versions, so remediation is straightforward.
An authenticated user of Kiteworks Core can abuse the file-request feature to send a request that appears to originate from a different, trusted account, because the server fails to verify that the requester is authorized to act on behalf of the identity they specify. Exploitation is gated by three conditions that substantially lower real-world risk: the attacker must hold a valid account (PR:L), the file-request feature must be enabled for the attacker's profile, and the targeted recipient must actively act on the spoofed request (UI:R). There is no memory corruption, code execution, or availability impact - the flaw only enables identity misrepresentation to solicit files or information. Consistent with an assessed CVSS of 4.6, a public exploit has not been identified at time of analysis and there is no confirmed active exploitation.
Read-only users in JetBrains YouTrack can read project settings they are not entitled to see because the application fails to enforce an authorization check on that data path in all versions before 2026.2.18991. Exploitation requires a valid, authenticated YouTrack account at the read-only privilege level (CVSS vector PR:L), and the resulting impact is limited to disclosure of project settings configuration data - no modification of data, no privilege escalation, and no impact on availability. Scoring is low at CVSS 4.3, there is no CISA KEV listing and no public exploit code identified at time of analysis, and JetBrains has shipped a fixed build (2026.2.18991), so this is a low-priority information-disclosure issue that should be handled through normal patch cadence.