Prototype injection in oRPC's @orpc/zod smart-coercion plugin (versions prior to 1.14.10) allows a remote, unauthenticated client that can reach any procedure accepting object or record input to supply a crafted __proto__ key, causing attacker-controlled inherited properties to surface in subsequent application lookups, or to trigger an unhandled TypeError when keys such as constructor or toString are treated as inherited Zod schemas before validation. The impact is bounded: only the attacker's own crafted request object is affected - the global Object.prototype, other requests, other users, and persistent process state are untouched - which keeps this a moderate-severity information-disclosure and integrity issue (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) rather than a cross-tenant compromise. No public exploit code or confirmed active exploitation was identified at time of analysis; the fix is a public upstream change shipped in oRPC 1.14.10.
Unauthenticated shortcode injection in The Events Calendar WordPress plugin before 6.17.5.1 allows remote attackers to trigger any shortcode registered on a target site by submitting crafted data to an AJAX action that is merged into the rendering context without validation or sanitisation. No authentication, user interaction, or special configuration is required on default installs, but practical impact is limited to the set of shortcodes actually registered by WordPress core, the active theme, or installed plugins, and the assessed CVSS vector shows no availability impact and only low confidentiality and integrity impact. Public exploit code exists, but there is no CISA KEV confirmation of active exploitation; this is a moderate-priority issue rather than a critical one.
Unauthenticated shortcode injection in the All in One SEO (AIOSEO) WordPress plugin before 5.0.2.1 lets remote attackers smuggle registered shortcodes past the plugin's shortcode-stripping routine and have them executed in content derived from user input; on sites upgraded from older plugin versions the stripping protection is disabled entirely, so no crafted payload is required. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5) reflects unauthenticated, no-interaction reachability with limited confidentiality and integrity impact rather than full compromise, and the practical severity depends on which shortcodes are registered on the target (from the plugin, theme, or other plugins). Publicly available exploit code exists and a vendor patch is available in 5.0.2.1; there is no evidence of confirmed active exploitation (no CISA KEV listing), so this is best treated as a moderate-priority, patched issue with a public PoC.
SQL injection in SourceCodester Online Reviewer Management System 1.0 allows a remote attacker, likely with a valid administrative session, to manipulate the Title parameter of /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity and alter backend SQL queries, exposing or modifying limited application data. Publicly available exploit code exists, but CISA KEV does not list this as actively exploited, and the assessed CVSS 3.1 vector is PR:L, so successful exploitation is gated by access to the administrative module. This is a low-priority finding despite the medium headline score because the vulnerable endpoint is inside the admin path and the assessed impact is limited to low confidentiality, integrity, and availability effects.
Server-side request forgery in the Model Context Protocol reference Fetch Tool (mcp-server-fetch, and the related mcp-server-everything) up to 2026.6.4 lets unauthenticated remote callers direct the fetch_url function at internal or otherwise restricted destinations by supplying a crafted url/path argument, with no destination validation in the default configuration. Impact is bounded but real: the assessed vector rates confidentiality and integrity impact as low with no availability impact, and the primary abuse case is reaching loopback services, private RFC1918 ranges, and cloud instance metadata endpoints (for example 169.254.169.254 and 100.100.100.100) from the server's network position rather than executing code. Publicly available exploit code exists (a public GitHub issue plus a VulDB entry) and the CVSS 4.0 vector carries an E:P proof-of-concept maturity flag, but there is no confirmed active exploitation (no CISA KEV listing); exposure depends on whether the Fetch Tool and its URL argument are reachable by an attacker, since these are reference servers frequently run locally beside an AI assistant.
Unauthenticated SQL injection in onetwothreeneth HospitalManagementSystem lets remote attackers inject arbitrary SQL through the user_id, patient_id, physician_id, discounts_id, and services_id parameters handled by the get function in edit_accounts.php, allowing them to read from or manipulate the underlying database. The CVSS 4.0 base score is 5.5 with a PR:N/UI:N vector, so no credentials or user interaction are required against an affected build, although the assessed impact is limited to low confidentiality, integrity, and availability loss. Publicly available exploit code exists and the issue was reported to the project without any response, but there is no evidence of confirmed active exploitation (CISA KEV), and realistic exposure is constrained by the project's very small install base and the absence of any fixed release.
Unrestricted file upload in onetwothreeneth HospitalManagementSystem lets a remote attacker submit arbitrary files through the 'img' parameter handled by the add_patient, add_physician, add_account, update_account, update_subaccount, edit_physician, and edit_patient actions in php/controller.php, potentially leading to server-side code execution if the upload lands in a web-accessible, script-enabled directory. The project ships on a rolling-release basis, so no fixed or affected version numbers are published, and publicly available exploit code exists (no CISA KEV listing and no EPSS score was supplied). The vendor's CVSS 4.0 vector scores this 5.5 with PR:N, but the underlying actions are account and record management functions that are normally gated behind an authenticated admin or staff session, so effective exploitability depends on whether the target deployment actually enforces login on those endpoints.
Authenticated attackers holding only Subscriber-level WordPress credentials can abuse Popup Maker WP through 1.4.5 to store display-targeting values that the plugin later invokes as zero-argument PHP callables on public page loads, resulting in sensitive information disclosure and denial of service. The flaw stems from missing authorization checks on several of the plugin's actions and its management page, which the plugin exposes to any logged-in user; publicly available exploit code exists and the WPScan disclosure makes the attack path straightforward to reproduce. The main practical prerequisite is that the target site permits user self-registration or that the attacker already holds a low-privileged account, and because only zero-argument callables are invoked the impact stays below full remote code execution, consistent with the CVSS 5.4 Medium rating.
Authenticated WordPress users holding a role as low as Subscriber can cause arbitrary shortcodes to be executed on sites running Unlimited Elements for Elementor before 2.0.21, because the plugin's widget-rendering path never verifies that the requester is permitted to invoke it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and our independent assessment keep this at moderate severity: it is an authorization bypass gated behind a low-privileged account, not an unauthenticated code-execution emergency, even though publicly available exploit code exists (WPScan). Exposure is greatest on builds below 2.0.18, where a Subscriber account - trivially obtainable on any site with open registration - is sufficient; from 2.0.18 through 2.0.20 the minimum role rises to Contributor or above. There is no CISA KEV entry, so confirmed active exploitation in the wild has not been established.
Unauthenticated attackers can manipulate gift-card amounts in WebToffee Gift Cards for WooCommerce before 1.3.1 to bypass configured denominations and reduce or eliminate order totals, obtaining products without full payment. Publicly available exploit code exists, and the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N confirms remote, unauthenticated, no-user-interaction exploitation with low integrity impact only. The affected component requires WordPress with the vulnerable plugin and WooCommerce gift-card purchasing enabled; no server or data compromise is involved.
Content disclosure in WordPress sites using the CMP - Coming Soon & Maintenance plugin before version 4.1.20 allows unauthenticated visitors to bypass the maintenance/coming-soon gate by shaping a request that the plugin mistakes for a login request, reaching hidden published pages and other gated content. This moderate-severity access-control flaw (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) requires no authentication or user interaction and only matters while the site is actively in maintenance or coming-soon mode. Publicly available exploit code exists (WPScan advisory), but there is no CISA KEV confirmation of active exploitation; impact is limited to information disclosure with no write access, code execution, or availability impact, and disappears once the site is fully public and the plugin mode is off.
Price manipulation in the Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 lets remote attackers set an arbitrarily low purchase price by editing a client-supplied amount field that the plugin never recomputes on the server, so a buyer can pay far less than the merchant intended. The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3) and affects any site running the plugin at a version below 2.0.6 with an exposed checkout. Impact is limited to transaction integrity and direct financial loss to the merchant - no data confidentiality or availability impact - and publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV).
Unauthenticated information disclosure in WP Edit Password Protected (WordPress plugin) before 2.0.7 allows remote attackers to read published posts and pages that the plugin's site-wide access mode was configured to hide, because the plugin fails to enforce that restriction on the WordPress REST API. Exploitation requires that the site uses the plugin's access-mode feature to hide content; publicly available exploit code exists. CVSS 3.1 score 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects limited confidentiality impact; sites not using the access-mode feature are not meaningfully affected.
Unauthenticated session prediction in Monta App's WebSocket backend permits remote attackers to impersonate other charging station sessions or cause denial of service by reusing predictable charging-station identifiers. The CVSS 3.1 base score of 7.3 reflects network reachability, low complexity, no privileges required, and limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Authentication identifiers for Monta-managed charging stations are published on publicly accessible web-based mapping platforms, so any remote, unauthenticated party can retrieve them simply by browsing those maps. The exposure is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and stems from insufficiently protected credentials (CWE-522); EUVD-2026-91820 lists all versions of monta.app as affected. Impact is bounded to a confidentiality disclosure that enables follow-on misuse rather than direct station or account takeover, since how far the leaked identifiers can be abused depends on how Monta's backend trusts them; there is no public exploit identified at time of analysis and CISA ICSA-26-274-02 does not confirm active exploitation.
Missing ownership and permission verification in the Meari IoT Cloud Platform OpenAPI Service lets any holder of a valid platform account alter the configuration of devices they do not own, enabling unauthorized setting changes and unintended device behavior. The flaw is CWE-862 (Missing Authorization) with a vendor/ICS-CERT CVSS 4.0 base score of 6.3; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network reachability and high integrity impact, but exploitation requires an authenticated account (PR:L) and has no direct confidentiality or availability effect. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; the low attack complexity and multi-tenant nature of the service nonetheless make it attractive to any legitimate-but-malicious tenant.
Stored HTML and CSS injection in the WP Mail Logging WordPress plugin before 1.17.0 lets unauthenticated users plant deceptive styled content and hyperlinks inside emails that the plugin records, because the plugin renders that email content in its admin log screens without properly restricting the HTML and CSS it contains. An attacker who can cause a logged email to be generated - for instance by submitting a public contact form - can deceive a logged-in administrator viewing the log into following a spoofed link that redirects the browser to an attacker-controlled page. The issue is rated CVSS v3.1 4.3 and publicly available exploit code exists, but it is not in CISA KEV and the impact is confined to content and link spoofing, with no confidentiality or availability loss and no confirmed script execution.
The MStore API WordPress plugin (versions before 4.22.1) fails to restrict which order fields a customer may update, allowing any authenticated customer to mark their own unpaid order as paid or fulfilled and receive goods without paying; no admin rights or victim interaction are needed. Exploitation requires only a self-registerable customer account and an existing unpaid order belonging to the attacker, matching the CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (4.3) and bounding the impact to payment fraud rather than account takeover or data exposure. Publicly available exploit code exists according to WPScan, but there is no indication of confirmed active exploitation (the CVE is not in CISA KEV).
Authenticated users holding subscriber-level access or above can bypass the subscription-purchase requirement enforced by WP User Frontend before version 4.3.12, creating posts through forms that are intended to be reserved for paying subscribers - and, depending on how the individual form is configured, having those posts published immediately rather than held for review. The issue is rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting a bounded integrity-only impact with no confidentiality or availability loss, and publicly available exploit code exists. Practical risk is low-to-moderate: an attacker needs a valid low-privilege account on an affected WordPress site that actually uses the plugin's subscription-gated post-creation forms, and sites that disable open registration raise that bar further.
Cleartext credential disclosure in the Armatura One message broker causes client connection credentials and their associated passwords to be written to the broker's operational log in plain text during normal operation, so anyone who can read that log - or a backup or diagnostic/support bundle containing it - obtains a usable credential. The exposure is local rather than network-reachable: per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) an attacker must already have low-privileged read access to the host filesystem or to an exported log, backup, or support bundle, and there is no public exploit identified at time of analysis. Assignment of CWE-532 means the credential never needs to be decrypted or brute-forced; the weakness is simply that the protocol exchanges are logged verbatim, which is why this is rated a low-to-moderate priority issue whose practical blast radius depends on how widely logs and support bundles are copied and shared.
Unbounded resource allocation and decompression amplification in Apache Thrift's C++ bindings (all versions before 0.25.0) let remote, unauthenticated clients force excessive memory and CPU consumption by sending highly compressed or amplified Thrift payloads to a service that deserializes attacker-controlled input, degrading or denying service availability. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no confidentiality or integrity loss, and no public exploit code was identified at time of analysis, so real-world risk is driven mainly by whether a Thrift endpoint is exposed to untrusted clients. No EPSS score or CISA KEV listing was supplied in the source intelligence, so no exploitation-probability or active-exploitation claim can be made.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust resources through the Delphi bindings' buffered transport (TBufferedTransport), causing service unavailability. The flaw is an unbounded resource allocation issue (CWE-770) scored 6.9 (CVSS 4.0) with availability-only impact; exploitation requires a reachable service built with the Delphi bindings and buffered transport. No public exploit code has been identified at time of analysis, and the vendor has released version 0.25.0 as the fix.
Remote, unauthenticated denial of service in the Zcash Foundation's Zebra node: any attacker who can reach the getblock JSON-RPC method - directly or through a lightwalletd instance that forwards block queries - can crash the node process, and by repeating the call hold it in a crash loop, by requesting verbosity 2 for a side-chain block. All Zebra versions before 11.0.0 are affected, and default configurations are vulnerable because the flaw is triggered by a routine, unprivileged RPC request requiring no credentials, privileges, or user interaction. Impact is limited to availability (node crash/crash loop) with no data exposure or code execution; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the low complexity and remote reachability make it operationally significant for operators exposing the RPC surface.
Zcash Zebra before 6.3.0 can falsely report a ready-to-serve state when a sync peer returns a valid FindBlocks response containing only the next block hash, because the ChainSync::obtain_tips logic discards that response as exceptional and produces a zero-length sync sample. The /ready endpoint then returns 200 OK while the node is still behind the chain tip. This is an unauthenticated remote correctness/reliability issue with low availability impact per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L); no public exploit was identified at time of analysis, and a vendor patch is available in Zebra 6.3.0.
Unauthenticated peer misbehavior-ban bypass in Zcash Foundation Zebra nodes before 6.3.0 lets any remote peer that can open a Zcash P2P connection repeatedly force block download and Equihash verification work while escaping the node's misbehavior scoring, degrading availability through resource exhaustion. The flaw is a type-cast error (CWE-704) in the inbound block cleanup path, where a RouterError is incorrectly downcast to VerifyBlockError so the accumulated misbehavior score is discarded instead of triggering a ban; it affects all Zebra releases from 0 through 6.3.0 in the ZcashFoundation:zebra CPE. CVSS 4.0 scores it 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N, with only low availability impact and no confidentiality or integrity impact), and the independent assessment rates it a medium-severity resource-consumption issue rather than a critical one. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but a vendor fix is available in Zebra 6.3.0.
Unauthenticated server-side request forgery in YesWiki before 4.6.7 allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter, submitted through the content parameter of handlers/page/render.php. This can be used to probe internal HTTP services and read back responses matching fiche markup, though impact is limited to information disclosure and no public exploit code is identified at time of analysis. The vulnerability is medium severity (CVSS 4.0 base 6.9) and is unauthenticated (PR:N).
Improper certificate validation in the Perl bindings of Apache Thrift before 0.25.0 leaves TLS peer verification effectively disabled by default, allowing an active man-in-the-middle to impersonate the RPC server, read and alter traffic, and return forged responses. The flaw is unauthenticated (PR:N) and needs no user interaction, but exploitation is conditional on the deployment actually using the Perl bindings for TLS-protected RPC and on the attacker holding a network interception vantage point (vendor CVSS 4.0 AT:P; independent CVSS 3.1 AC:H), which limits real-world exposure to a moderate, conditional TLS trust issue rather than a broadly exploitable one. Upgrading to 0.25.0 remediates the flaw; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Account enumeration in UTMStack before 11.2.16 lets unauthenticated remote attackers submit arbitrary email addresses to POST /api/account/reset-password/init and learn which ones are registered, because known accounts return HTTP 200 while unknown accounts return HTTP 500 with backend error details. The exposure is limited to confirming account existence - no credentials, session data, or code execution are obtained - making this a medium-severity information-disclosure issue (CWE-204) consistent with the independent assessment vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, which requires only that the web interface and the reset endpoint be network-reachable on a default deployment. No public exploit code and no confirmed active exploitation were identified at time of analysis; VulnCheck reported the issue and a vendor-released fix is available as v11.2.16, with the practical risk being follow-on targeted phishing or credential attacks that leverage a confirmed mailbox list.
SiYuan before v3.8.5 allows unauthenticated publish visitors to learn unpublished notebook box IDs through missing authorization in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time. This medium-severity information disclosure requires the Publish feature to be enabled and reachable; no public exploit code has been identified at time of analysis, and vendor patch v3.8.5 is available.
TLS hostname verification in the Apache Thrift C++ and D libraries can be bypassed, letting a man-in-the-middle present a certificate that chains to an already-trusted CA and still be accepted for the wrong hostname. The default access managers shipped with the C++ TSSLSocketFactory (versions 0.7.0 through 0.24.0) and the D accessManager property (versions 0.9.0 through 0.24.0) treat a non-matching subjectAltName dNSName as a 'skip' instead of a rejection and then fall back to the certificate Common Name, which violates RFC 6125 section 6.4.4 and RFC 9525 section 2. Because public CAs have not issued on Common Name alone for years, the practical exposure is confined to private or enterprise PKI deployments where such certificates still exist, and exploitation additionally requires an on-path attacker plus a CN-matching certificate from a trusted CA; unauthenticated per the CVSS 4.0 vector (PR:N) and no public exploit identified at time of analysis.
Improper TLS certificate validation in the Apache Thrift Python bindings (all versions before 0.25.0) allows a man-in-the-middle attacker to present a forged or otherwise invalid certificate and have it accepted, breaking the confidentiality and integrity guarantees of Thrift RPC traffic. Because the flaw also returns an incorrect status code on the failed validation path, code that inspects the returned status may mistakenly treat a rejected or malicious connection as legitimate. Exploitation is conditional rather than opportunistic: the attacker must already occupy a man-in-the-middle position on the network path (AT:P, AC:H) and the victim deployment must actually rely on Thrift's Python TLS transport for trust; authentication is not required (PR:N) and no user interaction is needed (UI:N). No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the independent assessment rates this as a moderate, conditional risk rather than an urgent priority.
Improper access control in Samsung's ManagedProvisioning system component allows a locally present application to install arbitrary packages on affected Galaxy devices running firmware older than the September 2026 Security Maintenance Release (SMR Sep-2026 Release 1). Exploitation requires an attacker-controlled app already executing on the device (AV:L) but demands no additional privileges (PR:N) and no user interaction (UI:N), so a malicious or sideloaded app can drive a privileged provisioning path to install software the user never authorized. No confirmed actively exploited (CISA KEV) status and no publicly available exploit code identified at time of analysis, and the independent reassessment (CVSS 3.1 6.9, C:N/I:H/A:N) frames this as a moderate, locally scoped integrity risk rather than an urgent, remotely reachable one.
Server-side request forgery in YesWiki before 4.6.7 allows unauthenticated attackers to make the WebFinger subscription ('abonnements') view issue outbound HTTPS requests to attacker-supplied numeric internal hosts and ports, enabling blind probing of internal services. The flaw sits in WebfingerService, which processes a POSTed actor_handle without validating the destination host, and carries a CVSS 4.0 base score of 6.9 (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N), confirming no authentication or user interaction is required wherever the ActivityPub/WebFinger feature is reachable. Impact is constrained to triggering outbound HTTPS connection attempts - an information-disclosure/port-probing primitive rather than full-response or arbitrary-scheme SSRF - and no public exploit code has been identified at time of analysis, although the request pattern is straightforward to script. This is a moderate-priority vulnerability.
An access control bypass in YesWiki before 4.6.7 allows unauthenticated remote attackers to read 500-character excerpts of restricted page content, including read-restricted drafts and notes, by requesting the XML method of a page that hosts the recentchangesrssplus RSS action. The attack is possible without authentication or user interaction when such an action page exists, but it is limited to excerpt disclosure and depends on the site actually using the recentchangesrssplus action. This is a moderate-severity CWE-200 information disclosure issue; no public exploit identified at time of analysis, and the independent assessment rates confidentiality impact as low with no integrity or availability impact.
Unauthenticated algorithmic-complexity denial of service in YesWiki before 4.6.7 lets remote attackers exhaust PHP-FPM worker pools by posting a small crafted body of bracket characters to the page-edit preview endpoint, which feeds the O(n^2) markdown-link regex in the wakka.php formatter. Per the authoritative assessment, this is a genuine but moderate-priority resource-exhaustion issue rather than a system-compromise vulnerability: exploitation requires network reachability to the preview endpoint and needs no login, special configuration, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with impact confined to availability and no data disclosure or modification. No public exploit identified at time of analysis, and no CISA KEV entry indicates confirmed active exploitation.
Unauthenticated open mail relay in YesWiki versions before 4.6.7 allows remote attackers to send arbitrary email through the wiki's configured SMTP server, enabling spam and phishing campaigns. The flaw resides in the contact mail AJAX handler, where omitting the field and type parameters bypasses authentication and input validation. Although exploitability is straightforward (no credentials or user interaction, CVSS 4.0 base 6.9), impact is limited to unauthorized outbound email-there is no access to wiki data or code execution-making it a moderate risk. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated server-side request forgery in YesWiki before 4.6.7 lets remote attackers force the wiki server to fetch arbitrary URLs by supplying a syndication action through the content parameter of the render handler. The CVSS vector indicates PR:N and UI:N, so any network-reachable instance running a default configuration can be triggered without credentials or victim interaction; fetched feed content is echoed back into the rendered page, and feed enclosures are written into the files directory, yielding an internal-network read primitive plus a limited file-write side effect. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low complexity and unauthenticated reach make exposed instances a practical target; the vendor has released YesWiki 4.6.7 to remediate the flaw.
Unauthenticated blind server-side request forgery (SSRF) in YesWiki versions prior to 4.6.7 allows remote attackers to coerce the server into making arbitrary outbound HTTP requests through the idtypeannonce parameter of the /api/entries/bazarlist endpoint. Because the isValidURL() validation routine unconditionally returns true, any attacker-supplied URL - including internal network addresses and cloud metadata endpoints - is accepted and then fetched by curl inside loadURLContent(). The vulnerability is network-reachable and requires no authentication (CVSS v4.0 PR:N/UI:N), but its practical impact is limited by the blind nature of the flaw, since response content is not returned to the attacker; assessment scores it medium severity, and no public exploit code has been identified at time of analysis.
Mempool resource exhaustion in Zcash's Zebra (zebrad) node affecting versions 5.0.0 through before 6.0.0-rc.0 allows any inbound P2P peer to flood the node with unique transactions that bypass the per-peer mempool admission cap, crowding out honest peers' transaction relay. The bypass exists because transactions delivered as direct P2P 'tx' messages are queued without the sending peer being recorded as their source, so the per-peer admission limit (CWE-770, uncontrolled resource consumption) is never applied to them. Exploitation requires no authentication, user interaction, or special configuration - any node accepting inbound Zcash P2P connections on an affected version is exposed - although the practical effect is degraded transaction propagation rather than node compromise or crash; no public exploit code identified at time of analysis. Vendor-released patch: 6.0.0-rc.0.
Denial of service in Zcash Foundation's Zebra node software before 6.1.0 lets unauthenticated peers on the Zcash peer-to-peer network degrade block processing by roughly sevenfold. An attacker repeatedly pushes transactions carrying invalid Orchard proofs that are routed into the shared halo2 batch verifier; because these pushed transactions are never misbehavior-scored, the offending peer is neither penalized nor disconnected, and the poisoned batch verifier forces honest block proofs onto the much slower individual-verification path. The impact is availability-only with zero confidentiality or integrity loss, and no public exploit code has been identified at time of analysis.
Block download denial of service in the Zcash Foundation's Zebra node before 6.2.1 lets any unauthenticated peer on the node's P2P block-sync interface stall synchronization and keep the node behind the chain tip by sending a contextually invalid block whose header hash matches that of an honest block, causing the honest block to be skipped. The root cause is an incomplete-cleanup defect (CWE-459) in which rejected hashes linger in Zebra's SentHashes tracking, so Request::KnownBlock keeps treating the legitimate block as already known. The reporting CNA assigns CVSS:4.0 base 6.9, while the independent assessment rates it CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - a genuine but moderate availability/liveness issue rather than a critical flaw, since it causes no crash, no data disclosure, and no chain alteration; no public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV) at time of analysis. Only nodes actively catching up are affected - a fully synced node that is not syncing onward is not impacted.
Path traversal in Ghost's theme translation loader (CWE-22) lets an authenticated administrator read JSON files outside the active theme directory by tampering with the locale/language setting, potentially exposing server configuration secrets. All Ghost releases from 1.20.0 up to but not including 6.64.0 are affected; the flaw requires a high-privilege admin account (CVSS 4.0 6.9 / assessed CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) and yields read-only disclosure of JSON-format files - no write, no code execution. There is no confirmed active exploitation (CISA KEV not listed) and no public exploit identified at time of analysis; a vendor patch is available in 6.64.0.
Metadata disclosure in the SiYuan note-taking and publishing platform before v3.8.5 allows unauthenticated remote attackers to learn details about documents that the publisher deliberately excluded from the public view. By querying the getNotebookInfo endpoint against a publish-visible notebook, an attacker - including an anonymous visitor whenever no reader password is configured - can retrieve the document count, storage size, and modification timestamps of hidden (publish-excluded) documents. This is a genuine but modest-severity exposure (assessed CVSS 3.1 base 5.3, C/L only, no integrity or availability impact) rather than a high-urgency priority; no public exploit has been identified at time of analysis, and a vendor patch is available in v3.8.5. The most consequential aspect is the information leak itself: counts, sizes, and timestamps can reveal the existence, volume, and edit cadence of private material.
Stored cross-site scripting in the Motors WordPress plugin before 1.4.124 lets an authenticated user with an administrator-assigned listing-management role inject arbitrary scripts through a listing badge setting that is written into an HTML attribute without sanitization or escaping. The payload executes when any visitor, including an administrator, views the affected listing, although exploitation is confined to insider or compromised-contributor scenarios because the attacker cannot self-provision the delegated role and a victim must load the listing page. The issue is rated CVSS 6.8 (medium), a vendor patch is available, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Unlimited Elements for Elementor WordPress plugin before 2.0.21 allows an authenticated attacker holding only Contributor-level privileges - a role that does not have the unfiltered_html capability - to save an icon value that the plugin's shared widget-parameter processor concatenates unescaped into an HTML attribute, so the payload executes in the browser of whoever renders the affected page. Exploitation requires three conditions: a valid low-privilege account (Contributor), a victim who views the rendered page (user interaction), and a site that grants Contributor-and-above roles to untrusted users; sites that only hand these roles to trusted staff are not realistically exposed. The reporter rates this 6.8 (Medium); our independent assessment keeps the authenticated/low-privilege prerequisite and user-interaction trigger but scores the confidentiality and integrity impact as low with a scope change, so the practical risk hinges on how permissive a site's contributor registration or membership workflow is. No confirmation of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. Vendor patch is available.
Stored cross-site scripting in the Tabs Responsive WordPress plugin (through version 2.5) allows an authenticated shop manager holding product-tab editing capability to persist JavaScript inside a WooCommerce product tab, which then executes in the browser of any user who views that product page, including an administrator. Exploitation depends on a pre-existing WooCommerce installation, the attacker already possessing a shop manager or higher account, and victim interaction (the malicious tab must be rendered by another user), making this a privileged-insider or compromised-account scenario rather than anonymous remote access (CVSS vector PR:H/UI:R). No public exploit identified at time of analysis, no confirmed actively exploited (CISA KEV) status, and no vendor-released patch version is identified in the available data; the assessed impact is limited confidentiality and integrity loss within a changed scope (S:C/C:L/I:L/A:N).
Missing authorization in UTMStack before 11.2.16 allows any authenticated user, regardless of role, to execute arbitrary operating-system commands on connected agents via the /command/{hostname} STOMP destination, with agent processes commonly running as root or SYSTEM. Exploitation requires a valid UTMStack account (no elevated privilege needed) and at least one connected agent; there is no pre-authentication exposure, and no public exploit has been identified at time of analysis. Vendor-released patch: 11.2.16.
Authenticated SQL injection in MultiVendorX (Dc WooCommerce Multi Vendor) 5.0.18 and earlier allows a vendor-level user holding the 'edit_stores' capability to inject arbitrary SQL through the 'order_by' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint, enabling extraction of sensitive data from the WordPress database. The flaw carries a CVSS 3.1 base score of 6.5 (network-reachable, low privileges required, high confidentiality impact, no integrity or availability impact) and there is no public exploit identified at time of analysis. Exposure is limited to sites running an affected version with the MarketplaceCompliance module active; sites that never use the report-abuse feature, or that have updated past 5.0.18, are not affected, and the realistic threat is a malicious or compromised vendor account rather than an unauthenticated internet-wide attacker.
Authenticated SQL injection in the Event Tickets and Registration WordPress plugin (all versions up to and including 5.29.5) allows a contributor-level user to append arbitrary SQL to the Tickets Commerce order-listing query through the unsanitized 'orderby' parameter, enabling extraction of sensitive data from the WordPress database. The exploit path is reachable by any account holding contributor privileges or above, because the can_access_page() check only verifies that the requester authored the supplied post_id rather than requiring the edit_others_posts capability, so a contributor who publishes their own post can reach the vulnerable code without elevated rights. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); with a CVSS of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) the impact is confined to confidentiality, meaning read-only access to database contents with no write or denial-of-service effect.
Prototype-chain manipulation in the oRPC @orpc/json-schema SmartCoercionPlugin (versions prior to 1.14.9) lets a remote, unauthenticated client inject `__proto__` or Object.prototype member names such as `constructor` and `toString` into a request body handled by any procedure that declares an object input schema. Abused successfully, this can steer the single coerced request object so attacker-controlled inherited values are treated as sub-schemas and satisfy the coercer's check, potentially influencing handler logic, Object.assign calls, or configuration lookups, with a secondary information-disclosure angle noted in vendor metadata. Impact is strictly bounded - the global Object.prototype, concurrent requests, other users, and unrelated objects are not modified, legitimate own-property `__proto__` fields are dropped, and downstream schema validation still runs - and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV.