Missing authentication in the Instant Buy component of ZongXR SuperMarket 1.0.0.0 lets remote attackers invoke the startBuy function without proving a valid session, simply by manipulating the Username argument passed to InstantBuyController.java. Impact is limited to integrity and availability at low severity (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), with no confidentiality loss, and publicly available exploit code exists though there is no confirmation of active exploitation. The authentication prerequisite is ambiguous - the CWE-306 classification and description imply no credentials are needed, while the vendor's CVSS 4.0 vector encodes low-privilege (PR:L) access - so the true auth requirement should be treated as unconfirmed. Real-world risk is low primarily because this is an obscure hobby/open-source project that is rarely exposed in production.
Server-side request forgery in Form Tools through 3.1.1 allows an authenticated low-privileged user to make the server issue arbitrary outbound HTTP requests by supplying a crafted 'url' argument to the smart_fill function in /global/code/actions.php, with no user interaction required. Impact is confined to low confidentiality (probing internal services and cloud metadata endpoints reachable from the host) rather than code execution, so realistic risk is modest and depends heavily on what the server can reach. Publicly available exploit code exists, the flaw is not confirmed as actively exploited (no CISA KEV listing), and no vendor-released patch has been identified at time of analysis.
Improper access control in David-Crty databasement up to and including 1.7.1 allows an authenticated low-privileged user to read snapshot records that belong outside their authorized organization or scope through the /api/v1/snapshots endpoint, where SnapshotPolicy.viewAny and SnapshotPolicy.view fail to enforce proper scoping. Because the CVSS vector carries PR:L, exploitation requires a valid account on a multi-user or multi-organization deployment, and the assessed impact is limited to low confidentiality with no integrity or availability effect (CVSS 4.0 base 5.3; independently assessed CVSS 3.1 5.3). Publicly available exploit code exists, and the flaw is fully addressed by upgrading to version 1.7.2, which hardens organization scoping.
OpenConstructionERP through 14.8.1 can leak one user's data to another user's session through the AI Provider Configuration Handler implemented in backend/app/modules/ai/ai_client.py. The issue is only reachable by an account that is already authenticated on the instance (CVSS vector PR:L) and impact is limited to confidentiality and integrity of AI provider configuration data rather than full system compromise; the independent assessment rates the overall risk as low-to-moderate rather than a priority issue. Publicly available exploit code exists and the CVSS 4.0 vector carries an E:P (proof-of-concept) exploit-maturity score, so the flaw should still be treated as practically exploitable, but there is no confirmed actively exploited (CISA KEV) status for this CVE.
Unrestricted file upload in Form Tools 3.1.1 and earlier lets an authenticated, low-privileged user push attacker-controlled files onto a self-hosted instance by invoking the Files::uploadFile function in the Ajax Handler (global/code/actions.php). Publicly available exploit code exists, but the attack is access-gated: it requires a reachable Form Tools deployment plus a valid low-privilege session, and practical severity depends on whether uploaded files are written to a web-executable directory. No vendor-released patch is available because the project has not responded to the reported issue, so overall risk is best characterized as low-to-moderate and access-gated rather than urgent.
Server-side template injection (SSTI) in formtools.org Form Tools up to and including version 3.1.1 allows an authenticated low-privilege user to inject template-engine metacharacters via the page_titles argument in Clients::updateClientSettingsTab, potentially causing limited information disclosure and modification within the application. Publicly available exploit code exists, but exploitation requires a valid low-privilege account and the assessed impact is capped at Low for confidentiality, integrity, and availability. The vendor was notified early through a GitHub issue but has not responded, and no patched version has been released.
Cross-site scripting in rhukster/dom-sanitizer through 1.0.15 lets an attacker who can submit HTML that the library sanitizes slip script-capable URLs into attributes the filter never checked - form action, cite, poster, src, srcset, and background - because DOMSanitizer::isDangerousUrl() only scheme-validated href and xlink:href. The headline case is a form action="javascript:..." that survives end-to-end as a complete, submittable form (form, button/input and type are all allow-listed), firing when a victim views the stored content and interacts with it. Publicly available exploit code exists (published alongside the GHSA-mrpv-6x26-mf6c advisory); there is no confirmed active exploitation and this CVE is not in CISA KEV. Vendor-released patch: 1.0.16.
Path traversal in David-Crty databasement up to 1.7.1 lets a high-privileged authenticated user escape the intended backup volume by supplying a crafted schema_name to the database-servers restore API endpoint, reaching filesystem locations outside the restore target. The attack is network-reachable but rated high-complexity and difficult to exploit, and its assessed impact is limited to low confidentiality, integrity and availability with no scope change. Publicly available exploit code exists, though there is no confirmed evidence of active exploitation; the issue is fixed in 1.7.2.
Apache HTTP Server versions 2.4.60 through 2.4.68 can execute the target of an internal redirect as a CGI program even when that target was never intended to run as code, producing a limited integrity impact rather than code execution by the attacker. Exploitation is heavily gated: a CGI-enabled directory must be in play, a running CGI program must emit an attacker-influenced internal redirect, and the redirect target must lack any file extension that mod_mime recognizes so Apache falls back to the CGI handler. No public exploit has been identified at time of analysis, the assessed vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N (CVSS 3.7), and SSVC rates it non-automatable, making this a genuinely low-priority issue.
BigFix Service Management API endpoints can disclose sensitive information in error messages when invalid input is submitted, enabling a remote, unauthenticated attacker to perform reconnaissance that may facilitate further attacks. Impact is limited to confidentiality (C:L), with no ability to modify data or execute code, and SSVC rates exploitation as not automatable with no public exploit identified at time of analysis. The vendor-assessed CVSS score is 3.7, while the assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; the low severity and reconnaissance-only value make this a low-priority issue despite network reachability without authentication.
Missing Content-Security-Policy response headers in the HCL AION web interface remove the browser-enforced allowlist that restricts where scripts, styles, and other resources may be loaded from, degrading a key defense-in-depth control against cross-site scripting (CWE-1032, security misconfiguration). The gap has no standalone exploit path: an attacker would first need a separate, independently exploitable content-injection or XSS flaw in AION, and the assessed vector (CVSS 3.1, 3.7 base, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) caps the resulting impact at limited confidentiality exposure with no integrity or availability effect. No public exploit code exists and no active exploitation has been confirmed at time of analysis, so this should be treated as a low-severity hardening finding rather than a directly exploitable vulnerability.
Insufficient session expiration in HCL iControl allows anyone who reaches a legitimate user's still-valid session to operate inside the application as that user, because the product does not enforce an adequate session timeout for unattended or abandoned sessions. Practical risk is low by every available signal: exploitation requires a victim to authenticate and then leave the session live on a shared, unlocked, or physically accessible workstation or an unterminated browser, and the independent assessment rates this AV:L/AC:H/PR:N with only low confidentiality and integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, EPSS/KEV data is absent, and the only published reference is the vendor advisory (HCL KB0133940); note that the vendor's own AV:N/PR:L vector overstates the reach of what is fundamentally a local or shared-workstation attack.
Session cookie interception in HCL iControl allows an on-path attacker to capture sensitive information such as session identifiers when the Secure attribute is missing and cookies are transmitted over unencrypted HTTP. Exploitation requires a victim with an authenticated session, transmission of the cookie over HTTP, and the attacker to occupy a man-in-the-middle position; no public exploit or active exploitation has been identified. This is a low-priority information disclosure issue (CVSS 3.1) with confidentiality-only impact.
Improper error handling in HCL iControl causes verbose database and system error output to be returned to whoever triggers an unhandled input path, disclosing internal infrastructure details (hostnames, schema or driver information, filesystem paths) that are useful for reconnaissance and planning follow-on attacks. The issue carries a low CVSS v3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) - vendor scoring, with our independent assessment re-scoring it slightly higher in attack prerequisites (PR:N) while agreeing on scope and confidentiality-only impact - meaning the exposure is informational and there is no integrity or availability effect. Authentication requirements are not definitively confirmed: the CVSS vector encodes PR:L (a valid low-privileged account) while the vendor description and our assessed vector (PR:N) imply the error disclosure may be reachable without credentials, so defenders should validate which path applies in their deployment. There is no KEV listing and no public exploit identified at time of analysis, so this is a genuinely low-priority issue by every available signal and does not warrant emergency response.
Stored cross-site scripting in the If-So Dynamic Content WordPress plugin (1.9.9 through 1.10.1, i.e. all releases before 1.10.2) lets an authenticated attacker with editor-level capability save a JavaScript payload inside a conversion name, which is neither sanitized on write nor escaped when the plugin's analytics page is rendered. The script then executes in the browser session of a higher-privileged user, typically an administrator, who later opens that admin page - so exploitation requires both a pre-existing trusted editor account and victim interaction (UI:R). Impact is bounded to the victim's session with low confidentiality and integrity effects and no availability impact (CVSS 3.1 base score 3.1); no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was supplied in the available intelligence.
Insecure cookie attribute configuration in HCL BigFix Service Management allows attackers to facilitate cross-site request forgery, session hijacking via cross-site scripting, and unauthorized access when a pre-existing enabler - such as an active XSS vector, a cross-site attack page, or an on-path network position - is present. This is a low-priority, defense-in-depth weakness rather than a directly exploitable flaw; no public exploit code has been identified at time of analysis. The vulnerability requires an application deployed without hardened cookie attributes (missing Secure, HttpOnly, SameSite, and restrictive Path), and exploitation yields only low-level confidentiality impact.
Prototype-pollution-assisted cross-site scripting in the KaTeX math-rendering JavaScript library (versions 0.11.0 through 0.18.2) lets attacker-controlled expressions end up in trusted-rendering mode when an inherited `trust` property is picked up from a polluted prototype, producing clickable `javascript:` links or attacker-chosen external resources in any consuming page that inserts unsanitized KaTeX output. This is not a standalone remote exploit: KaTeX does not create the prototype pollution itself, so a separate pollution primitive (or attacker control over the options object's prototype) must already exist in the host application, rendering an expression alone never executes script, and script execution requires the victim to actively click a crafted link. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the CVSS 4.0 base score is only 2.1 (our independent 3.1 assessment is AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting the compounding prerequisites rather than a broadly reachable XSS bug.
Authenticated SQL injection in itsourcecode Leave Management System 1.0 allows a remote low-privilege user to read or modify database contents by manipulating the LEAVEID parameter in /module/leave/controller.php. Publicly available exploit code exists, but no active exploitation is confirmed (CISA KEV); the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and CVSS 4.0 score of 2.1 indicate a low-priority issue with only partial confidentiality and integrity impact.
Cross-site request forgery in Apache APISIX 3.17.0 through 3.18.0's feishu-auth and dingtalk-auth plugins allows an attacker who lures a user into clicking a crafted link to bind that user's browser session to the attacker's identity, so subsequent user actions (uploads, form submissions, account bindings) are recorded under the attacker's account. The issue requires the affected OAuth plugin to be configured and active on a protected route; the victim must click the link and then perform sensitive actions. No public exploit identified at time of analysis; the vendor fix is Apache APISIX 3.19.0.
Authenticated SQL injection in itsourcecode Leave Management System 1.0 allows low-privilege users to execute arbitrary SQL commands via the LEAVTID parameter in /module/leavetype/controller.php. Exploitation requires a valid session (PR:L) and publicly available exploit code exists, but the product is a free sample/hobby PHP application with negligible production deployment, making real-world exposure minimal.
BlueALSA's LC3plus A2DP sink decoder uses an attacker-supplied RTP frame count as a divisor without validating it, so a single non-fragmented LC3plus media header carrying a frame count of zero causes a SIGFPE that terminates the bluealsad daemon. Only builds compiled with the optional LC3plus decoder support are affected, and only when bluealsad acts as an A2DP sink; the attacker must be within Bluetooth-adjacent range and able to establish an A2DP source connection that negotiates an LC3plus session (CVSS 4.0 base 2.1; independent assessment CVSS 3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Impact is limited to a restartable daemon crash - no code execution, data exposure, or integrity loss beyond the availability hit - and no public exploit code was identified at time of analysis.
Genian SSL PNS (both the frodo-core and watchcat-ui components) performs insufficient file extension and integrity verification on files submitted through its patch/update upload feature, so an artifact that is not an official vendor patch can be accepted by the appliance. Exploitation requires a high-privileged local actor on the appliance plus a specific non-default precondition (CVSS:4.0 AV:L/AC:H/AT:P/PR:H/UI:N), and the resulting impact is limited to integrity (VI:L) with no confidentiality or availability effect, giving a base score of 1.8 - a low-priority, high-friction issue despite belonging to the usually severe CWE-434 unrestricted upload class. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; KR-CERT is credited with reporting the issue.