Stored cross-site scripting in the Entradium event-ticketing platform allows an authenticated event organizer to inject JavaScript into the Help text and Title parameters of the /events/<event_name>-<event_city>/custom_form/edit endpoint when creating or editing forms tied to an event's ticket sales; the payload persists and executes in the browser of any user who subsequently loads that event's public ticket-purchase page. Rated CVSS 4.8 (CVSS 4.0) and assessed independently as AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, the issue is bounded by the low-privileged organizer account required for injection and the victim-visit condition needed for execution, yielding low confidentiality and integrity impact scoped to the affected event page. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
Stored cross-site scripting in Entradium lets an authenticated promoter inject JavaScript into the Business Name field at the /promoters/edit endpoint, and that payload executes in the browser of anyone who later loads the promoter's public profile page. Because the injection point is a field the attacker already controls, the payload only reaches visitors of that specific promoter page rather than arbitrary chosen victims, and it requires victim interaction (the page must be loaded) - authentication as a promoter is required (PR:L in the assessed vector). No public exploit code or confirmed active exploitation was identified at time of analysis, and the low CVSS 4.0 base score (4.8) reflects limited confidentiality and integrity impact.
Stored cross-site scripting in Entradium (by Crocantickets) allows an authenticated attacker with privileges to create event discounts to inject JavaScript into the Name or Field parameters of the /tools/discount_wizard/discount_config endpoint; the payload executes when a victim views an event's discount list page, potentially leading to session data theft if the victim interacts with a crafted URL. The vendor-assigned CVSS 4.0 score is 4.8 (MEDIUM), consistent with the independent assessment that this is a low-to-moderate priority issue requiring authentication and user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Stored and reflected cross-site scripting in Entradium (by Crocantickets) lets an authenticated promoter-level account inject JavaScript through the event creation/editing workflow: the City parameter at /events/<event_name>/edit_general is stored and executes on the event's public page, while the Description parameter at /events/<event_name>/edit-general is reflected when required fields are left blank and the resulting crafted URL is delivered to a victim. Both variants require victim interaction (viewing the public event page or clicking the attacker-supplied link) and a promoter-level account, which keeps realistic exploitability low to moderate; the vendor CVSS 4.0 base score is 4.8, and the independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. No public exploit identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status. Successful exploitation could allow theft of session data from users who view the affected event page or follow the crafted link.
Reflected cross-site scripting in the MISP threat-intelligence platform allows an authenticated attacker to inject arbitrary JavaScript into the analyst data notes panel by supplying a crafted value in the 'seed' URL path parameter, which the application reflects unsanitized into inline JavaScript in the rendered page. The victim must already be logged into MISP and be persuaded to open the malicious link (for example via phishing), so exploitation depends on user interaction and prior authentication; impact is confined to the victim's browser session (session token or page-data theft, interface manipulation) rather than the server. The issue affects MISP builds prior to commit 58925dbf0 (post v2.5.48), where the parameter is forcibly cast to an integer; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor assessment rates overall risk as low.
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.3) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted link, provided the targeted form contains a Text Area field configured with a 'url.<name>' Predefined Value and predefinedClick disabled - a documented, commonly used but per-form configuration the attacker does not control. With a CVSS of 4.7 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), the practical risk against arbitrary installs is limited by that configuration prerequisite and the required user interaction, and the impact is scoped to the victim's session rather than the server. No public exploit code was identified at time of analysis and the vulnerability is not listed in CISA KEV.
Reflected cross-site scripting in the If-So Dynamic Content WordPress plugin (versions 1.8 through before 1.10.2) lets remote unauthenticated attackers inject arbitrary JavaScript into an AJAX response served as HTML, because a request-supplied value is reflected without output escaping. Exploitation is not passive: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) requires a victim to open an attacker-crafted link, so each target must be individually lured via phishing or social engineering, which confines practical impact to targeted campaigns. The issue is rated 4.7 (MEDIUM) with no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor patch is available.
Local user-mode threads in Zephyr RTOS builds that enable CONFIG_USERSPACE and CONFIG_SMBUS can invoke the smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() syscalls with an arbitrary pointer, silently unregistering SMBALERT or Host Notify callbacks that supervisor-mode code registered and thereby disabling alert handling system-wide; the same pointer can also be probed for valid kernel addresses because the syscall returns 0 on a hit versus -ENOENT on a miss. Exploitation is authenticated and local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, 4.4), requiring a user-mode thread that has already been granted the SMBus device object, and is limited to configurations using the Intel PCH SMBus driver with CONFIG_SMBUS_INTEL_PCH_SMBALERT or CONFIG_SMBUS_INTEL_PCH_HOST_NOTIFY, or the STM32 SMBus driver with CONFIG_SMBUS_STM32_SMBALERT; builds with CONFIG_ASSERT=y additionally turn a bogus pointer into a supervisor-mode fault and fatal system error, leaking which addresses are mapped. There is no impact on builds without CONFIG_USERSPACE or without an SMBus driver supporting SMBALERT/Host Notify, and no public exploit identified at time of analysis.
An authorization bypass in the Redux Framework WordPress plugin, affecting all versions up to and including 4.5.14, lets an authenticated subscriber-level user delete arbitrary media library attachments - including files owned by administrators - by supplying an attacker-chosen attachment_id. Exploitation depends on a non-default configuration: a Custom Fonts field must be registered on the user profile page via Redux_Users::set_profile(), which causes the required redux_custom_fonts nonce to be rendered into the Subscriber's wp-admin/profile.php and hands the attacker the token needed for the unprotected deletion action. The impact is limited to integrity (deletion of attachments) with no confidentiality exposure or code execution; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV. Vendor-released patch: 4.5.15.
Denial of service in the mod_dav module of Apache HTTP Server 2.4.67 and earlier (EUVD lists affected versions as up to and including 2.4.68) allows remote attackers who hold an account permitted to create WebDAV locks to crash server child processes, degrading or interrupting service availability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, score 4.3) confirms the attacker must be authenticated with lock-creation privileges and that impact is limited to availability - there is no data exposure, integrity loss, or code execution. Only servers that have loaded and enabled mod_dav with lock support are reachable, so default Apache installations are not affected; no public exploit has been identified at time of analysis (CISA SSVC records Exploitation: none, Automatable: no). Vendor-released patch: Apache HTTP Server 2.4.69.
An authorization bypass in Red Hat Satellite's Katello RegistryProxiesController allows an authenticated low-privilege attacker to enumerate valid Users, Organizations, and Products across the instance via differential responses. The flaw stems from a missing return statement in the registry_authorize filter, which flags unauthorized requests but fails to halt execution, letting the request proceed into database validation filters that leak internal state. No public exploit identified at time of analysis; the vendor has released an errata (RHSA-2026:74503).
Input validation failures in HCL BigFix Service Management allow remote attackers to inject malformed data into the application, potentially causing injection attacks or errors in downstream processing systems. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-accessible, low-complexity, unauthenticated access, but exploitation requires user interaction, so an attacker cannot complete the attack alone. Impact is limited to low integrity with no confidentiality or availability effect, making this a moderate-to-low real-world priority; no public exploit identified at time of analysis.
Authorization bypass in DeepTutor 1.4.0 allows an authenticated remote attacker with a valid account to trigger the regeneration of another user's session turn by supplying a victim's session_id to TurnRuntimeManager.regenerate_last_turn, compromising session integrity. Exploitation requires low privileges and knowledge of a valid session_id; the EPSS score is 0.15% and no public exploit identified at time of analysis.
Insecure cross-origin resource sharing (CORS) configuration in HCL iControl allows an attacker-controlled website to issue credentialed cross-origin requests against the product, letting the attacker read and exfiltrate sensitive data that is reachable within a victim's authenticated browser session. The vendor scores this 4.3 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), while independent assessment also rates it 4.3 but with AV:N/AC:L/PR:N/UI:R - reflecting that although the attacker needs no server-side credentials of their own, the victim must be authenticated to iControl and must be lured to the attacker's page, so the practical prerequisite is user interaction rather than attacker authentication. Impact is confined to confidentiality (read/exfiltration; no integrity or availability effect), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Authenticated low-privilege users can bypass authorization checks in the WordPress plugin Majestic Support through version 1.2.0, because the plugin accepts user-controlled object identifiers without verifying ownership or access-level permissions (CWE-639). Successful exploitation is limited to integrity impact-unauthorized changes to other users' support objects-with no confidentiality or availability effect per the assessed CVSS vector, and it requires a valid low-privilege account while the plugin is installed and active. This is a modest-severity authorization flaw rather than an urgent priority; no public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Authenticated users on JetBrains YouTrack instances running versions prior to 2026.2.19422 can trigger unauthorized reloads of translation catalogs because the endpoint enforcing that operation lacks a proper authorization check (CWE-862). Exploitation is bounded by the CVSS vector (AV:N/AC:L/PR:L/UI:N) - a valid low-privileged account is required, and the impact is confined to availability (A:L) with no data disclosure or modification (C:N/I:N). No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; the overall real-world risk is low, and the vendor has shipped a fixed release.
Denial of service in geopy versions prior to 2.5.0 allows an unauthenticated remote attacker to consume excessive CPU by supplying a long, malformed coordinate string to geopy.Point, Point.from_string(), or a geocoder reverse() method invoked with a string argument. The root cause is catastrophic backtracking (CWE-1333) in the POINT_PATTERN regular expression; the fix in 2.5.0 adds a 256-character input cap that rejects oversized input immediately, while the numeric Point constructor is unaffected. Impact is availability-only (C:N/I:N/A:L) with no code execution or data exposure; no public exploit code was identified at time of analysis, and reachability depends on the host application exposing one of the string-parsing entry points to untrusted input.
Apache HTTP Server before 2.4.69 can be forced into repeated re-authentication by unauthenticated remote attackers sending forged Authorization headers when Digest authentication is enabled with the non-default AuthDigestNcCheck directive. Successful exploitation causes a limited availability impact, denial of service through forced re-authentication, without compromising data confidentiality or integrity. No public exploit code was identified at time of analysis, and the flaw is constrained to the uncommon Digest-auth-plus-AuthDigestNcCheck configuration.
An out-of-bounds write in Apache HTTP Server's mod_proxy_html output filter affects versions 2.4.0 through 2.4.68 and can be triggered by a crafted HTML response body that the server parses and rewrites while proxying upstream content. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates remote unauthenticated attackers can reach the flaw, but high attack complexity reflects a significant deployment prerequisite: mod_proxy_html must be explicitly loaded and actively rewriting proxied HTML, which is not a default configuration, and the attacker must be able to influence the upstream/backend response body being processed. The result is memory corruption with low confidentiality and integrity impact and a high availability impact, and no public exploit has been identified at the time of analysis; servers used solely as origin web servers, or proxies that do not enable mod_proxy_html, are not affected.
Denial of service in Apache HTTP Server 2.4.0 through 2.4.68 arises from a use-after-free in the mod_rewrite module that is reachable only when a RewriteRule or RewriteCond uses the lookahead variables %{LA-U:...} or %{LA-F:...}, which exercise an internal subrequest code path. An unauthenticated remote attacker who can reach a server configured that way can trigger the memory error and crash request-handling processes, degrading or halting service; the independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is confined to availability and the high attack complexity combined with the non-default configuration prerequisite substantially limits real-world exploitability. No CVSS score or vector has been published by NVD or the vendor, there is no EPSS probability and no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Improper privilege management in Apache HTTP Server's mod_ssl (versions 2.4.0 through 2.4.68) causes SSLRequire access-control directives that use file-related expressions to be evaluated in a way that can grant or deny access contrary to the server operator's intent, giving a remote attacker a possible means to reach content that the SSLRequire check was meant to protect or, conversely, to disrupt intended authorization. The flaw is not reachable in a default configuration: exploitation requires mod_ssl to be loaded and the operator to have configured access control specifically through the SSLRequire directive using file-related expressions, a non-default, operator-chosen configuration, which is reflected in the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (high attack complexity, low confidentiality and integrity impact, no availability impact); authentication requirements for the attacker are not confirmed from available data. There is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided.
Authentication bypass in the mod_auth_digest module of Apache HTTP Server 2.4.x allows a man-in-the-middle attacker to capture a victim's HTTP Digest authentication credentials and replay them to impersonate that user against the server. Exploitation is conditional: the server must have mod_auth_digest enabled and the non-default directive AuthDigestNonceLifetime must be explicitly set to 0, and the attacker must additionally occupy a network interception position to capture the digest exchange and send crafted requests that force garbage collection of the client's shared-memory nonce entry. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects high confidentiality impact but a high attack-complexity and MITM prerequisite; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the source supplied no CVSS score or EPSS estimate.
An out-of-bounds write in Apache HTTP Server's optional mod_charset_lite module (affecting versions 2.4.0 through 2.4.68) can corrupt process memory when character-set translation is configured, potentially crashing the server or enabling limited data disclosure or modification. Exposure is narrow: mod_charset_lite is not loaded in default installations and must be explicitly enabled and bound to a content path via directives such as CharsetSourceEnc, CharsetDefault, or an associated input/output filter, which is why the assessed vector rates attack complexity as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Independent signals are otherwise sparse - no public exploit code, no CISA KEV listing, and no EPSS score were available - so no public exploit identified at time of analysis, and the practical severity hinges on whether the module is deployed.
Denial of service in Apache HTTP Server releases before 2.4.69, where the mod_xml2enc filter dereferences a NULL pointer when a proxied response declares a charset whose conversion partially succeeds and then fails, crashing the handling child process. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), the crash is reachable without credentials over the network, but exploitation is gated by a trust boundary: the request path must run proxied backend responses through mod_xml2enc (in practice mod_proxy_html content rewriting), and the attacker must control or have compromised that upstream backend server - ordinary external clients cannot directly trigger it. Impact is limited to availability (worker/child process termination with no confidentiality or integrity effect), and no public exploit code, KEV listing, or EPSS score was provided at time of analysis, so this is best treated as a low-to-moderate priority hardening item for reverse-proxy deployments that transform untrusted upstream content.
Forward proxy deployments of Apache HTTP Server through 2.4.68 that relay FTP traffic can be manipulated by an untrusted FTP server into opening a data connection to an arbitrary third-party host, because mod_proxy_ftp fails to validate the address returned in an FTP PASV reply. Only non-default configurations with forward proxying enabled (ProxyRequests On) and mod_proxy_ftp loaded are affected, and the primary impact is a misdirected outbound data connection rather than compromise of the proxy host itself. No KEV entry, EPSS score, or POC was supplied and no public exploit has been identified at time of analysis, so prioritization signals are limited and authentication requirements are not confirmed from the supplied data.
Inconsistent interpretation of HTTP responses in Apache HTTP Server's mod_proxy_uwsgi module lets a crafted backend uwsgi response that carries a Transfer-Encoding header be parsed differently by Apache than by the backend, enabling HTTP response smuggling and desynchronization between the proxy and downstream clients. Affected deployments are Apache HTTP Server 2.4.30 through 2.4.68 configured as a reverse proxy to a uwsgi backend via mod_proxy_uwsgi; installations that do not load or use mod_proxy_uwsgi are not affected. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) is network-reachable by unauthenticated remote attackers, but exploitation is gated by high complexity because the attacker must control or influence the backend uwsgi response - typically through a malicious or compromised backend application, or a response-header-injection flaw in it - so this is not reachable against a default Apache install. No public exploit code has been identified and there is no indication of confirmed active exploitation (no CISA KEV listing); impact is limited to low confidentiality and low integrity with a scope change, not full remote code execution or denial of service.
Concurrent Digest authentication requests against Apache HTTP Server before 2.4.69 can corrupt authentication state via a use-after-free in the mod_auth_digest module, yielding low integrity and availability impact with no confidentiality impact (per the assessed vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L). Unauthenticated remote clients can reach the flaw, but exploitation is gated by two non-default preconditions: AuthDigestNcCheck must be enabled or AuthDigestNonceLifetime set to 0, and the attacker must win a timing-dependent race by sending concurrent Digest requests - serial requests will not reliably trigger it. There is no public exploit identified at time of analysis, no EPSS score, no CISA KEV entry, and no vendor-supplied CVSS, so the sole source is the Apache advisory; the fix is version 2.4.69.
Apache HTTP Server versions 2.4.60 through 2.4.68 can execute the target of an internal redirect as a CGI program even when that target was never intended to run as code, producing a limited integrity impact rather than code execution by the attacker. Exploitation is heavily gated: a CGI-enabled directory must be in play, a running CGI program must emit an attacker-influenced internal redirect, and the redirect target must lack any file extension that mod_mime recognizes so Apache falls back to the CGI handler. No public exploit has been identified at time of analysis, the assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N (CVSS 3.7), and SSVC rates it non-automatable, making this a genuinely low-priority issue.
BigFix Service Management API endpoints can disclose sensitive information in error messages when invalid input is submitted, enabling a remote, unauthenticated attacker to perform reconnaissance that may facilitate further attacks. Impact is limited to confidentiality (C:L), with no ability to modify data or execute code, and SSVC rates exploitation as not automatable with no public exploit identified at time of analysis. The vendor-assessed CVSS score is 3.7, while the assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; the low severity and reconnaissance-only value make this a low-priority issue despite network reachability without authentication.
Missing Content-Security-Policy response headers in the HCL AION web interface remove the browser-enforced allowlist that restricts where scripts, styles, and other resources may be loaded from, degrading a key defense-in-depth control against cross-site scripting (CWE-1032, security misconfiguration). The gap has no standalone exploit path: an attacker would first need a separate, independently exploitable content-injection or XSS flaw in AION, and the assessed vector (CVSS 3.1, 3.7 base, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) caps the resulting impact at limited confidentiality exposure with no integrity or availability effect. No public exploit code exists and no active exploitation has been confirmed at time of analysis, so this should be treated as a low-severity hardening finding rather than a directly exploitable vulnerability.
Insufficient session expiration in HCL iControl allows anyone who reaches a legitimate user's still-valid session to operate inside the application as that user, because the product does not enforce an adequate session timeout for unattended or abandoned sessions. Practical risk is low by every available signal: exploitation requires a victim to authenticate and then leave the session live on a shared, unlocked, or physically accessible workstation or an unterminated browser, and the independent assessment rates this AV:L/AC:H/PR:N with only low confidentiality and integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, EPSS/KEV data is absent, and the only published reference is the vendor advisory (HCL KB0133940); note that the vendor's own AV:N/PR:L vector overstates the reach of what is fundamentally a local or shared-workstation attack.
Session cookie interception in HCL iControl allows an on-path attacker to capture sensitive information such as session identifiers when the Secure attribute is missing and cookies are transmitted over unencrypted HTTP. Exploitation requires a victim with an authenticated session, transmission of the cookie over HTTP, and the attacker to occupy a man-in-the-middle position; no public exploit or active exploitation has been identified. This is a low-priority information disclosure issue (CVSS 3.1) with confidentiality-only impact.
Improper error handling in HCL iControl causes verbose database and system error output to be returned to whoever triggers an unhandled input path, disclosing internal infrastructure details (hostnames, schema or driver information, filesystem paths) that are useful for reconnaissance and planning follow-on attacks. The issue carries a low CVSS v3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) - vendor scoring, with our independent assessment re-scoring it slightly higher in attack prerequisites (PR:N) while agreeing on scope and confidentiality-only impact - meaning the exposure is informational and there is no integrity or availability effect. Authentication requirements are not definitively confirmed: the CVSS vector encodes PR:L (a valid low-privileged account) while the vendor description and our assessed vector (PR:N) imply the error disclosure may be reachable without credentials, so defenders should validate which path applies in their deployment. There is no KEV listing and no public exploit identified at time of analysis, so this is a genuinely low-priority issue by every available signal and does not warrant emergency response.
Stored cross-site scripting in the If-So Dynamic Content WordPress plugin (1.9.9 through 1.10.1, i.e. all releases before 1.10.2) lets an authenticated attacker with editor-level capability save a JavaScript payload inside a conversion name, which is neither sanitized on write nor escaped when the plugin's analytics page is rendered. The script then executes in the browser session of a higher-privileged user, typically an administrator, who later opens that admin page - so exploitation requires both a pre-existing trusted editor account and victim interaction (UI:R). Impact is bounded to the victim's session with low confidentiality and integrity effects and no availability impact (CVSS 3.1 base score 3.1); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was supplied in the available intelligence.
Insecure cookie attribute configuration in HCL BigFix Service Management allows attackers to facilitate cross-site request forgery, session hijacking via cross-site scripting, and unauthorized access when a pre-existing enabler - such as an active XSS vector, a cross-site attack page, or an on-path network position - is present. This is a low-priority, defense-in-depth weakness rather than a directly exploitable flaw; no public exploit code has been identified at time of analysis. The vulnerability requires an application deployed without hardened cookie attributes (missing Secure, HttpOnly, SameSite, and restrictive Path), and exploitation yields only low-level confidentiality impact.
Prototype-pollution-assisted cross-site scripting in the KaTeX math-rendering JavaScript library (versions 0.11.0 through 0.18.2) lets attacker-controlled expressions end up in trusted-rendering mode when an inherited `trust` property is picked up from a polluted prototype, producing clickable `javascript:` links or attacker-chosen external resources in any consuming page that inserts unsanitized KaTeX output. This is not a standalone remote exploit: KaTeX does not create the prototype pollution itself, so a separate pollution primitive (or attacker control over the options object's prototype) must already exist in the host application, rendering an expression alone never executes script, and script execution requires the victim to actively click a crafted link. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the CVSS 4.0 base score is only 2.1 (our independent 3.1 assessment is AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting the compounding prerequisites rather than a broadly reachable XSS bug.
Authenticated SQL injection in itsourcecode Leave Management System 1.0 allows a remote low-privilege user to read or modify database contents by manipulating the LEAVEID parameter in /module/leave/controller.php. Publicly available exploit code exists, but no active exploitation is confirmed (CISA KEV); the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and CVSS 4.0 score of 2.1 indicate a low-priority issue with only partial confidentiality and integrity impact.
Cross-site request forgery in Apache APISIX 3.17.0 through 3.18.0's feishu-auth and dingtalk-auth plugins allows an attacker who lures a user into clicking a crafted link to bind that user's browser session to the attacker's identity, so subsequent user actions (uploads, form submissions, account bindings) are recorded under the attacker's account. The issue requires the affected OAuth plugin to be configured and active on a protected route; the victim must click the link and then perform sensitive actions. No public exploit identified at time of analysis; the vendor fix is Apache APISIX 3.19.0.
Authenticated SQL injection in itsourcecode Leave Management System 1.0 allows low-privilege users to execute arbitrary SQL commands via the LEAVTID parameter in /module/leavetype/controller.php. Exploitation requires a valid session (PR:L) and publicly available exploit code exists, but the product is a free sample/hobby PHP application with negligible production deployment, making real-world exposure minimal.
BlueALSA's LC3plus A2DP sink decoder uses an attacker-supplied RTP frame count as a divisor without validating it, so a single non-fragmented LC3plus media header carrying a frame count of zero causes a SIGFPE that terminates the bluealsad daemon. Only builds compiled with the optional LC3plus decoder support are affected, and only when bluealsad acts as an A2DP sink; the attacker must be within Bluetooth-adjacent range and able to establish an A2DP source connection that negotiates an LC3plus session (CVSS 4.0 base 2.1; independent assessment CVSS 3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Impact is limited to a restartable daemon crash - no code execution, data exposure, or integrity loss beyond the availability hit - and no public exploit code was identified at time of analysis.
Genian SSL PNS (both the frodo-core and watchcat-ui components) performs insufficient file extension and integrity verification on files submitted through its patch/update upload feature, so an artifact that is not an official vendor patch can be accepted by the appliance. Exploitation requires a high-privileged local actor on the appliance plus a specific non-default precondition (CVSS:4.0 AV:L/AC:H/AT:P/PR:H/UI:N), and the resulting impact is limited to integrity (VI:L) with no confidentiality or availability effect, giving a base score of 1.8 - a low-priority, high-friction issue despite belonging to the usually severe CWE-434 unrestricted upload class. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; KR-CERT is credited with reporting the issue.