Stored cross-site scripting in the W3 Total Cache plugin for WordPress (all versions up to and including 2.10.6) lets unauthenticated attackers submit a comment containing crafted script payload that is later rendered unsanitized in a page, executing in the browser of any user or administrator who views it - but only on sites where the 'Remove query strings from static resources' option is enabled, since the plugin's output-buffer URL rewrite must strip the '?' delimiter and the closing quote of the enclosing HTML attribute to break out of the attribute context. The issue is fixed in 2.10.7, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because the required caching option is not the default configuration and execution depends on a victim subsequently viewing the injected page, the assessed vector rates this as attack complexity High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) even though the vendor-published score is 7.2 with AC:L.
Code injection in CTX Feed Pro (WooCommerce Product Feed Pro by Webappick) versions up to and including 7.6.12 allows an authenticated attacker with Administrator-level privileges to execute arbitrary PHP code on the server by supplying malicious input to the plugin's 'Feed Config' field, which is passed unsanitized to PHP's eval(). The vulnerability is not exploitable by anonymous or low-privileged users because it requires Administrator access, making the realistic threat model a stolen or malicious admin account or a multi-admin environment where a lower-trust admin should not have code-execution rights. No public exploit identified at time of analysis, and no confirmed active exploitation was reported.
Unauthenticated stored cross-site scripting (XSS) in Kubio AI Page Builder up to and including version 2.9.2 allows remote attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits an injected page. The vulnerability has a CVSS score of 7.2 and a scope change, but no public exploit code has been identified and there is no evidence of active exploitation. A vendor patch version is not confirmed, though an upstream code change exists.
Stored cross-site scripting in the WordPress Download Monitor plugin up to 5.2.10 lets an unauthenticated attacker initiate a cross-origin postMessage attack that injects arbitrary web scripts into Download post content, which then execute for frontend visitors when the [download_data] shortcode renders the stored payload. Exploitation is not a simple unauthenticated request: it requires tricking a logged-in Administrator who has unfiltered_html and an open Download edit screen into visiting an attacker-controlled page, and the site must use the affected shortcode for delivery. No public exploit identified at time of analysis, and the assessed severity is conditional rather than a drop-everything emergency; the published CVSS is 7.2, while our assessment uses CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Stored cross-site scripting in the CMB2 WordPress plugin, affecting versions through 2.13.1, lets unauthenticated attackers inject arbitrary scripts into pages that expose a public front-end CMB2 form saving a textarea_code field such as kl_code or kl_post_code. The root cause is insufficient sanitization and output escaping of that field, and the front-end save path is reachable without credentials because it requires only a CMB2 box nonce that is emitted to all visitors, including guests; the injected payload then executes when a victim loads the affected page. CVSS 3.1 rates this High (7.2, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), but real-world exposure is limited to the non-default case of public textarea_code forms, and no public exploit identified at time of analysis or CISA KEV confirmation was provided.
Stored cross-site scripting in the BA Book Everything plugin for WordPress (all versions up to and including 1.8.28) lets unauthenticated attackers inject arbitrary JavaScript through the 'booking_service_qty' parameter of a public booking submission, which is saved inside the resulting order record. The payload is later emitted without escaping in the plugin's wp-admin order management screens, so it executes in the browser of an administrator or other privileged user the moment that order is opened - the plugin's ordinary order-review workflow - giving a scope-changing (S:C) impact despite the injection itself needing no authentication. No public exploit code and no CISA KEV entry are associated with this issue at time of analysis, and the assessed base score is 7.2 (High) under the corrected vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, reflecting that a privileged user's review action is the required trigger.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions up to and including 3.15.4) enables unauthenticated attackers to inject arbitrary web scripts into form submissions, which then execute when a victim-typically an authenticated administrator-views the stored entry. Exploitation is contingent on the targeted form containing a Paragraph Text field with the non-default Rich Text Editor (RTE) option explicitly enabled, per the independent assessment. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with changed scope but limited confidentiality and integrity impact; no public exploit code or CISA KEV entry was identified at time of analysis.
Stored cross-site scripting (XSS) in the CMB2 WordPress library (all versions up to and including 2.13.0) allows unauthenticated attackers to inject arbitrary web scripts via the 'file_list' field type, which execute when a user views an injected page. Exploitation requires that an integrating plugin or theme has registered a file_list field on a publicly accessible front-end form or a user meta box; CMB2 by default does not expose such fields, so a stock installation is not vulnerable. No public exploit identified at time of analysis, and the assessed CVSS vector (AC:H) reflects the non-default configuration prerequisite, making real-world risk lower than the 7.2 base score suggests.
Unauthenticated stored cross-site scripting in the Newsletter plugin for WordPress through 9.4.0 allows remote attackers to inject JavaScript that executes when a victim renders the stored content. Attackers can reach the public subscription endpoint (na=sa) without a nonce, capability check, or CAPTCHA, place the payload in the 'np1' custom field, and bypass email-address validation by embedding the '{profile_1}' placeholder in the local part of the submitted address. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis, and this is a credible, moderately-high priority issue rather than an inflated high-CVSS score.
Stored cross-site scripting in Smash Balloon's Social Post Feed / Custom Facebook Feed plugin for WordPress, in all versions up to and including 4.13.0, allows an unauthenticated attacker who merely holds a Facebook account to plant a malicious comment message on the connected Facebook Page, which the plugin ingests and later renders with the Vue v-html directive in the administrator-facing feed builder preview. Because the preview template uses v-show instead of v-if, the injected HTML - including onerror handlers - is evaluated in the DOM even when the comments area is not visually displayed, so the script executes as soon as an administrator opens the builder preview page; chained with the missing URL validation in the cff_install_addon AJAX handler, that script can coerce the admin session into installing a plugin from an attacker-controlled URL, potentially yielding server-side code execution. No public exploit code is identified at time of analysis, and real-world urgency is moderate because exploitation depends on a non-universal configuration (a connected public Facebook Page with comments ingested) and on an administrator actually loading the preview page.
Stored cross-site scripting in the MW WP Form plugin for WordPress (all versions up to and including 5.1.7) lets an unauthenticated visitor persist arbitrary JavaScript into a site by submitting a crafted 'post_id' value to a public form. The plugin's CSRF gate (MW_WP_Form_Csrf) is a double-submit cookie check that any visitor can satisfy simply by loading the public form page first, so there is no meaningful barrier to storing the payload; the script then executes whenever a victim - potentially an administrator - later views the injected page. Rated CVSS 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N by the reporter; assessed as UI:R by our team), this is a genuine but moderate-priority issue rather than a drop-everything emergency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Stored cross-site scripting in the GSpeech TTS - WordPress Text To Speech plugin (all versions up to and including 3.22.0) allows unauthenticated attackers to plant script content in a post's comment field that survives WordPress kses sanitization and only becomes executable when the plugin rewrites the rendered HTML at request time. Any visitor who subsequently loads the affected page can have attacker-controlled script run in their browser session, though exposure depends on the site accepting and auto-publishing unauthenticated comments and on GSpeech output being rendered on that page. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (not in CISA KEV); exploitation requirements include the plugin being active and its output-buffer rewrite running on the page displaying the comment.
Stored cross-site scripting in the No External Links WordPress plugin (all versions up to and including 5.2.0) lets an unauthenticated remote attacker inject arbitrary web scripts through the Log URL handling of the /goto/{base64} redirect path, with the injected payload executing when a privileged user views the affected page. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (base 7.2 HIGH), and per the independent assessment the attack is network-reachable and unauthenticated but is gated by a non-default prerequisite: the administrator must have enabled the 'Link Encoding: Base64' option, and the payload only fires once a victim later loads the poisoned page, such as an admin reviewing the plugin's log table. Sites running 5.2.0 or earlier without Base64 link encoding enabled are not affected, and no public exploit code was identified at time of analysis.
Unauthenticated stored cross-site scripting in the Mang Board plugin for WordPress (all versions up to and including 2.4.2) lets remote attackers inject arbitrary JavaScript through the unsanitized 'data_type' parameter, which is persisted and then executes in the browser of any user who subsequently loads the affected board page. Exploitation is possible against any board left at the plugin's out-of-the-box defaults (write_level=0 for guest posting and editor_type=N), so newly created boards are vulnerable without any special configuration; the main limiting factor is that a victim must later view the injected page for the script to fire. No public exploit code or confirmed active exploitation has been identified at time of analysis, and while the CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C) makes this a genuine elevated-priority issue for sites running the affected plugin, it is not an emergency across the broader internet.
Stored cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin through version 3.6.5.4 lets unauthenticated remote attackers plant arbitrary JavaScript that later executes in the browser of any visitor viewing an affected page. The payload is submitted through the plugin's public wp_ajax_nopriv_jet_form_builder_submit endpoint, persisted verbatim into post meta by the Insert/Update Post action, and rendered without escaping by a Select Field block whose options are populated by the get_from_db generator. No confirmed active exploitation or public exploit code has been identified at time of analysis, and the impact is constrained by configuration: the payload only fires on sites that combine a publicly submittable form with an Insert/Update Post action and a Select/get_from_db field bound to the poisoned meta key.
Stored cross-site scripting in the Relevanssi - A Better Search WordPress plugin through 4.28.3 lets unauthenticated attackers submit comment content that is later rendered as executable markup in search-result excerpts, so scripts run in the browser of any visitor or administrator who views an affected excerpt page. Exploitation is conditional rather than universal: the site's 'Allowable tags in excerpts' option must be non-empty (for example the documented default example of <p><a><strong>), comment content must be indexed and displayed (relevanssi_index_comments enabled), and the injected tag name must be prefixed by an allowed tag name - allowed <a> permits injected <audio>, allowed <p> permits <picture> - because of a prefix-matching regex flaw that fails to require complete tag names. Wordfence rates this 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while this assessment applies AC:H in recognition of the operator-configuration dependency; no public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation.
Stored cross-site scripting (XSS) in the Customer Reviews for WooCommerce plugin for WordPress, all versions up to and including 5.122.0, allows unauthenticated remote attackers to inject malicious scripts via the Comment Author Name when the image attachment feature (ivole_attach_image) is enabled. The vulnerability arises from insufficient input sanitization and output escaping, and the payload executes when a victim (such as an administrator viewing the reviews list table or a site visitor) loads the affected page. No public exploit code has been identified at time of analysis, but the CVSS 7.2 rating reflects the scope change and low confidentiality/integrity impact; exploitation is conditional on the non-default attachment setting being active.
Stored cross-site scripting in the DoFollow Case by Case WordPress plugin (all versions up to and including 3.6.0) allows unauthenticated attackers to inject arbitrary JavaScript through the public comment content field, with the payload persisting and executing in the browser of every subsequent visitor to the affected post once an administrator approves the comment. Exploitation requires the site to have public comment submission enabled and depends on a moderation workflow that approves the tainted comment - no attacker authentication is needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2), and impact is bounded to script execution in victims' browsers with no availability impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; this is a genuine but moderate-priority issue whose practical risk is dictated by how permissive a site's comment moderation is.
Stored cross-site scripting in Relevanssi Premium through 2.31.4 lets unauthenticated attackers inject arbitrary web scripts through the '_rt' parameter when the plugin's click-tracking and logging feature is enabled. A valid _rt_nonce is publicly emitted on every search-results page, so the nonce does not stop unauthenticated exploitation, and the payload executes when a user later visits the injected page. No public exploit identified at time of analysis; exploitation requires the non-default click-tracking feature and is therefore not applicable to default-configuration sites.
Unauthenticated stored cross-site scripting in the Visitors Traffic Real Time Statistics Pro WordPress plugin (all versions up to and including 11.22) lets any logged-out visitor write raw HTML/JavaScript into the plugin's traffic database through the page_title parameter of the ahcpro_track_visitor AJAX action, which is deliberately exposed to unauthenticated callers via wp_ajax_nopriv_ahcpro_track_visitor. The injected script stays dormant in the ahc_title_traffic.til_page_title column until an administrator opens the plugin's dashboard, where the 'Traffic by Title' DataTable renders the stored value with innerHTML and no output escaping, executing attacker-controlled JavaScript inside the admin's authenticated session. No public exploit code has been identified at time of analysis and the vulnerability is not in CISA KEV; because execution depends on a subsequent admin dashboard view, the attack is passive and deferred rather than immediate, placing it in the medium-priority tier despite the PR:N, UI:N base score of 7.2.
OS command injection in PeaZip before 11.3.0 allows an attacker to run arbitrary commands on a victim's machine by embedding a specially crafted filename in an archive, provided PeaZip is running in a specific non-default configuration. The root cause is mishandling of the 'quotation character already used in the string' condition, which lets the injected filename escape the application's quoting and reach the shell; the CVSS 4.0 vector records no required privileges (PR:N) but explicitly captures attack prerequisites (AT:P), and exploitation is local with user interaction, meaning the victim must open or process the malicious archive. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor has addressed it in PeaZip 11.3.0, and the independent assessment rates this moderate priority - worth patching, but not an emergency.
Stored cross-site scripting in LimeSurvey Community Edition 7.4.0 lets an authenticated user holding the global "Surveys: create" permission inject a JavaScript-breaking value into the date_min (and, per the vendor patch, date_max) attribute of a Date/Time question, which is then executed in the browser of any other user who renders that question. The payload does not fire at storage time: exploitation is gated on a separate victim actively viewing the affected survey, which is why the assessed CVSS 4.0 vector (PR:L, UI:A, AT:P) requires both a privileged authoring account and victim interaction. No public exploit code or confirmed in-the-wild exploitation is identified at time of analysis. Real-world exposure is concentrated in multi-user or multi-tenant deployments that delegate survey-creation rights to lower-trust users; instances where only trusted administrators can author surveys carry minimal risk.
Stored cross-site scripting in the JetAppointment plugin for WordPress (all versions up to and including 2.5.2.1) allows unauthenticated attackers to plant arbitrary JavaScript through the 'friendlyTime' parameter of the public booking form; the payload is persisted in the wp_jet_appointments_meta table and later executes in an administrator's browser when that appointment's details popup is opened in WordPress admin. The injection path requires no authentication and no special non-default setup beyond a live, reachable booking form (the jet_engine_form_booking_submit endpoint), but execution is not automatic - the script lies dormant until a privileged user opens the affected appointment record, so realistic impact hinges on that administrator interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied; the finding is an elevated-priority issue rather than a drop-everything emergency.
Second-order SQL injection in YesWiki before 4.6.7 allows a low-privileged authenticated user to read database contents and bypass read ACLs by self-registering an account whose username contains a double-quote SQL payload, which AclService::updateRequestWithACL later concatenates unescaped into the read-ACL LIKE clause when a non-admin ACL-filtered listing is loaded. Exploitation requires the instance to permit account self-registration and to accept a username carrying the payload, per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L vector, so instances with self-registration disabled or with strict username validation are substantially harder to attack, and no victim interaction is needed. Although the vendor has released a fix in 4.6.7, no public exploit code has been identified at time of analysis; impact is confined to database read-out and read-ACL bypass rather than write or remote code execution, making this a genuine but moderate-priority issue, not an emergency.
Cross-site request forgery in YesWiki before 4.6.7 allows unauthenticated attackers to permanently delete arbitrary wiki pages (including their ACLs, links, triples, comments, and referrers) by luring a logged-in administrator or page owner to a crafted URL that invokes the ajaxdeletepage handler with a jsonp_callback parameter. The vulnerability requires user interaction (UI:P) and a privileged victim session, and it has no public exploit identified at time of analysis, though a vendor patch is available.
Authenticated users on YesWiki instances running versions prior to 4.6.7 can bypass ownership scoping in the triples delete API by submitting an empty filter, letting them delete or forge arbitrary semantic triples regardless of who owns them (CWE-863, CVSS 7.2). The most damaging abuse path removes the triple that records admins-group membership, emptying the administrator group and locking every administrator out of the site's authorization layer. The flaw is network-reachable and requires only a low-privilege authenticated account (CVSS PR:L) with no user interaction; no public exploit code has been identified at time of analysis, and the vendor has released a fix in 4.6.7.
CPU-exhaustion denial of service in Bouncy Castle for C# (bc-csharp) before 2.7.0 allows attackers who can get an application to decrypt a supplied encrypted private key to force an effectively unbounded PBKDF2 key-derivation workload, because the iteration count (near 2^31) is read directly from unauthenticated algorithm parameters and the key derivation runs before either the password or the ciphertext can be checked. The CVSS vector carries PR:N, so no credentials are required, but exploitation hinges on the victim choosing to load or decrypt the attacker's key material (UI:P) - realistically only services that ingest externally controlled PKCS#8 EncryptedPrivateKeyInfo objects, "ENCRYPTED PRIVATE KEY" PEM files, or CMS password recipients (CmsPbeKey) are exposed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is a moderate-severity availability issue rather than a confidentiality or integrity compromise; related PKCS#12 paths are tracked separately under CVE-2026-63572 (Pkcs12Store loading) and CVE-2026-63575 (zero/negative counts with PKCS#12 PBE algorithms).
CPU exhaustion denial of service in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 lets unauthenticated remote attackers tie up a process by supplying a crafted PKCS#12 (PFX) keystore. Pkcs12Store.Load and Pkcs12Utilities.ConvertToDefiniteLength take the key-derivation iteration count straight from the file - in MacData or in the PBE parameters of an encrypted SafeContents or shrouded key bag - without an upper bound, so a count approaching 2^31 forces enormous key-derivation work before the MAC or password is ever validated (PR:N per the assessed CVSS:3.1 vector). Exploitation is not autonomous: the assessed UI:R/UI:P condition means some victim application or user must actually accept and load the malicious keystore, so no public exploit code has been identified at time of analysis and there is no CISA KEV listing; this is a genuine but moderate-priority availability issue rather than remote code execution despite the 7.1 CVSS 4.0 score.
Authenticated JPQL injection in UTMStack SIEM deployments before 11.2.16 lets any holder of a low-privilege account read arbitrary database entities through the GET /api/utm-network-scans/searchPropertyValues endpoint, including sensitive credential tables such as jhi_user. The flaw is reachable by remote attackers (CVSS:4.0 AV:N/PR:L, assessed equivalently as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), so exploitation is confined to malicious insiders or attackers who have already obtained a valid credential - no unauthenticated internet path or non-default configuration is required beyond an authenticated session. No public exploit code has been identified and no confirmed active exploitation (CISA KEV) has been recorded at time of analysis; the primary risk is direct confidentiality loss, not data integrity or availability, and vendor-released patch 11.2.16 is available.
Denial of service in the Java bindings of Apache Thrift (all versions before 0.25.0) allows an accepted protocol peer to exhaust server resources by triggering unbounded allocation while Thrift messages are received and parsed. Per the assessed CVSS vector (PR:L), the attacker must already be an authenticated or otherwise accepted client of the Thrift service rather than an anonymous internet actor, which materially narrows exposure for deployments that only accept connections from trusted peers. The impact ceiling is availability loss only - no data disclosure, integrity impact, or code execution is declared - and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis; the vendor-released fix is version 0.25.0.
Authenticated API key holders can read restricted issue contents and comments in Phproject (versions 1.1.6 through 1.8.6) because the REST API issue endpoints single_get, single_comments, and single_comments_post never invoke the allowAccess() authorization routine, silently bypassing the security.restrict_access confidentiality control. Attackers with any valid, active API key can retrieve restricted issues and comments - including owner and author email addresses - and post unauthorized comments to issues they should not be able to access. Exploitation requires the target instance to have 'Restrict issue access' enabled and a valid API key; no public exploit code has been identified at time of analysis, and impact is bounded to information disclosure plus limited unauthorized writes with no availability impact. Fixed in Phproject 1.8.7.
Denial of service in the Legion of the Bouncy Castle C# library (bc-csharp) before 2.7.0: Pkcs12Store.GetCertificateChain follows AuthorityKeyIdentifier issuer links without tracking already-visited certificates, so a crafted PKCS#12 file containing certificates that reference each other in a cycle drives the chain-building loop to run indefinitely, consuming CPU and memory until an OutOfMemoryException is thrown. Applications are affected only if they load an attacker-supplied PKCS#12 keystore and then request a key entry's certificate chain; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates no authentication is needed but some user or process interaction is required to feed in the malicious file, and the impact is confined to availability. No public exploit identified at time of analysis, and the upstream fix commit ships a crafted cyclic keystore as a regression test fixture rather than as released exploit tooling.
Improper authorization in MISP's correlation handling lets an authenticated user with at least read access to some events retrieve attribute values and event metadata from events they are no longer permitted to view, in deployments running MISP before v2.5.48. The leak occurs because correlation lookups are authorized against a point-in-time distribution snapshot stored on the correlation row, which carries no published flag, so the check diverges from the live event ACL once a correlated event is unpublished or moved to a different sharing group; the CVSS vector (PR:L) confirms the attacker must be authenticated, and no public exploit code has been identified at time of analysis. Impact is confined to confidentiality - read-only exposure bounded to those correlated events that were restricted after the correlation was created - making this a moderate-severity, measured-priority patch rather than an emergency.
Uncontrolled CPU consumption in Legion of the Bouncy Castle Inc.'s bc-csharp library before 2.7.0 lets an attacker who can supply a crafted PKCS#12 (PFX) file, or a PKCS#8 encrypted private key that uses a PKCS#12 password-based encryption algorithm, pin a CPU core for minutes at a time. The root cause is CWE-835, a loop with an unreachable exit condition: the PKCS#12 key-derivation loop in Pkcs12ParametersGenerator compared its counter with '!=' rather than '<', so an iteration count of zero or a negative value caused roughly 2^32 iterations to run before the MAC or password could ever be validated; a 75-byte PFX with a negative MacData iteration count kept Pkcs12Store.Load busy for many minutes. The impact is availability-only (CVSS 4.0 7.1, AV:N/AC:L/PR:N/UI:P, VA:H, with no confidentiality or integrity effect), so the flaw is an unauthenticated denial of service that depends on the victim application actually parsing attacker-controlled keystore data; only services that accept untrusted PFX/PKCS#8 input are realistically exposed, and no public exploit code was identified at time of analysis.
Authenticated SQL injection in GG Soft Software Services Inc.'s Paperwork (versions through 2026-09-09) lets a logged-in low-privileged user inject arbitrary SQL through network-reachable input, giving high confidentiality impact on stored data (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The PR:L prerequisite means the attacker must already hold a valid Paperwork account before the injection can be triggered, and the low integrity rating indicates limited write capability rather than broad database manipulation. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the flaw was reported by TR-CERT.
Cleartext credential disclosure in the Armatura One message broker causes client connection credentials and their associated passwords to be written to the broker's operational log in plain text during normal operation, so anyone who can read that log - or a backup or diagnostic/support bundle containing it - obtains a usable credential. The exposure is local rather than network-reachable: per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) an attacker must already have low-privileged read access to the host filesystem or to an exported log, backup, or support bundle, and there is no public exploit identified at time of analysis. Assignment of CWE-532 means the credential never needs to be decrypted or brute-forced; the weakness is simply that the protocol exchanges are logged verbatim, which is why this is rated a low-to-moderate priority issue whose practical blast radius depends on how widely logs and support bundles are copied and shared.
Improper input validation in MISP's decaying model import endpoint allows an authenticated user with the perm_decaying permission to overwrite, re-own, or re-flag decaying models belonging to other organisations in MISP versions before 2.5.48. The import handler strips only the top-level id and uuid fields and pins org_id/default on the outer array before saving the record flat, so a nested 'DecayingModel' key can smuggle its own primary key, organisation identifier, and default flag past those guards, letting an attacker modify an existing model in place, reassign its organisation, or set it as the organisation default and thereby alter scoring behaviour for other users. This is a bounded authorization/mass-assignment flaw rather than an unauthenticated critical: successful exploitation requires network access to the instance plus an account holding perm_decaying (not granted to ordinary users by default), and there is no confidentiality or availability impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and an upstream fix commit (70e319e4b) exists.
Cross-site request forgery in YesWiki before 4.6.7 lets an attacker delete installed packages from a wiki instance by luring a logged-in administrator to a crafted link. The autoupdate UpdateAction processes state-changing deletions through unprotected GET requests - accepting action=delete together with a package parameter - with no anti-CSRF token check, so a request issued from an attacker-controlled page is executed with the administrator's session privileges. Deleting packages such as bazar strips functionality the site depends on, breaking core operation (CVSS 4.0 base 7.1; high availability impact, low integrity impact, no confidentiality impact). Exploitation is context-dependent: it requires a live administrator session in the victim's browser plus a lure/click, and no public exploit code has been identified at time of analysis.
Authenticated low-privilege users of YesWiki before 4.6.7 can bypass per-page write ACLs through the comments API editComment route (api/comments), overwriting arbitrary pages or comments and reparenting existing content by placing a victim page's identifier in the pagetag field. Because the route trusts the attacker-supplied key rather than validating it against the caller's write permissions, the flaw yields high integrity impact with limited availability impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) and requires only a valid account, so instances with open or self-service registration are most exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix in YesWiki 4.6.7.
Unauthenticated user enumeration in YesWiki before 4.6.7 allows remote attackers to confirm registered email addresses by observing differing responses from the MotDePassePerdu lost-password recovery endpoint, which lacks rate limiting. This CWE-204 information disclosure does not expose credentials or account contents but enables targeted phishing and password-spraying campaigns. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 4.6.7.
An authenticated RPC client can crash a Zcash Foundation Zebra full node by calling the z_listunifiedreceivers RPC method with a crafted Unified Address whose Sapling receiver carries 43 bytes that fail Jubjub subgroup validation, triggering a reachable assertion (.expect()) that aborts the entire zebrad process because Zebra's release profile is built with panic = "abort". Affected releases are zebra-rpc through 7.0.0 and zebrad through 4.4.1 (fixed in zebra-rpc 8.0.0 and zebrad 4.5.0), and the request is repeatable on restart, so a node can be kept persistently offline. Exploitation requires the RPC server to be explicitly enabled via rpc.listen_addr and the attacker to authenticate - with the default enable_cookie_auth=true this generally implies local access to the .cookie file, making fully remote exploitation a non-default configuration - and no public exploit code was identified at time of analysis.
Improper access control in Apache Traffic Server 9.0.0-9.2.14 and 10.0.0-10.1.3 allows unauthenticated remote requests that should have been denied to be forwarded to backend systems the proxy is meant to protect, yielding high confidentiality and integrity impact on those subsequent systems (SC:H/SI:H) with no direct impact on the Traffic Server host itself (VC:N/VI:N/VA:N). Exploitation is conditional, not routine: the CVSS 4.0 vector carries AT:P, meaning a specific attack requirement outside the attacker's direct control must be satisfied before a request succeeds, and this is corroborated by the independent assessment as a genuine but conditional risk rather than an urgent emergency. No public exploit code or confirmed active exploitation was identified at time of analysis; fixed versions are 9.2.15 and 10.1.4, and this CVE supersedes CVE-2026-41920, whose record understated the 9.x affected range as 9.0.0-9.1.14.
Unbounded resource allocation and decompression amplification in Apache Thrift's C++ bindings (all versions before 0.25.0) let remote, unauthenticated clients force excessive memory and CPU consumption by sending highly compressed or amplified Thrift payloads to a service that deserializes attacker-controlled input, degrading or denying service availability. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no confidentiality or integrity loss, and no public exploit code was identified at time of analysis, so real-world risk is driven mainly by whether a Thrift endpoint is exposed to untrusted clients. No EPSS score or CISA KEV listing was supplied in the source intelligence, so no exploitation-probability or active-exploitation claim can be made.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust resources through the Delphi bindings' buffered transport (TBufferedTransport), causing service unavailability. The flaw is an unbounded resource allocation issue (CWE-770) scored 6.9 (CVSS 4.0) with availability-only impact; exploitation requires a reachable service built with the Delphi bindings and buffered transport. No public exploit code has been identified at time of analysis, and the vendor has released version 0.25.0 as the fix.
Remote, unauthenticated denial of service in the Zcash Foundation's Zebra node: any attacker who can reach the getblock JSON-RPC method - directly or through a lightwalletd instance that forwards block queries - can crash the node process, and by repeating the call hold it in a crash loop, by requesting verbosity 2 for a side-chain block. All Zebra versions before 11.0.0 are affected, and default configurations are vulnerable because the flaw is triggered by a routine, unprivileged RPC request requiring no credentials, privileges, or user interaction. Impact is limited to availability (node crash/crash loop) with no data exposure or code execution; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, though the low complexity and remote reachability make it operationally significant for operators exposing the RPC surface.
Zcash Zebra before 6.3.0 can falsely report a ready-to-serve state when a sync peer returns a valid FindBlocks response containing only the next block hash, because the ChainSync::obtain_tips logic discards that response as exceptional and produces a zero-length sync sample. The /ready endpoint then returns 200 OK while the node is still behind the chain tip. This is an unauthenticated remote correctness/reliability issue with low availability impact per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L); no public exploit was identified at time of analysis, and a vendor patch is available in Zebra 6.3.0.
Unauthenticated peer misbehavior-ban bypass in Zcash Foundation Zebra nodes before 6.3.0 lets any remote peer that can open a Zcash P2P connection repeatedly force block download and Equihash verification work while escaping the node's misbehavior scoring, degrading availability through resource exhaustion. The flaw is a type-cast error (CWE-704) in the inbound block cleanup path, where a RouterError is incorrectly downcast to VerifyBlockError so the accumulated misbehavior score is discarded instead of triggering a ban; it affects all Zebra releases from 0 through 6.3.0 in the ZcashFoundation:zebra CPE. CVSS 4.0 scores it 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N, with only low availability impact and no confidentiality or integrity impact), and the independent assessment rates it a medium-severity resource-consumption issue rather than a critical one. No public exploit code was identified at time of analysis and there is no CISA KEV listing, but a vendor fix is available in Zebra 6.3.0.
Unauthenticated server-side request forgery in YesWiki before 4.6.7 allows remote attackers to make the server fetch arbitrary hosts and ports via the {{valeur}} action's url parameter, submitted through the content parameter of handlers/page/render.php. This can be used to probe internal HTTP services and read back responses matching fiche markup, though impact is limited to information disclosure and no public exploit code is identified at time of analysis. The vulnerability is medium severity (CVSS 4.0 base 6.9) and is unauthenticated (PR:N).
Improper certificate validation in the Perl bindings of Apache Thrift before 0.25.0 leaves TLS peer verification effectively disabled by default, allowing an active man-in-the-middle to impersonate the RPC server, read and alter traffic, and return forged responses. The flaw is unauthenticated (PR:N) and needs no user interaction, but exploitation is conditional on the deployment actually using the Perl bindings for TLS-protected RPC and on the attacker holding a network interception vantage point (vendor CVSS 4.0 AT:P; independent CVSS 3.1 AC:H), which limits real-world exposure to a moderate, conditional TLS trust issue rather than a broadly exploitable one. Upgrading to 0.25.0 remediates the flaw; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Account enumeration in UTMStack before 11.2.16 lets unauthenticated remote attackers submit arbitrary email addresses to POST /api/account/reset-password/init and learn which ones are registered, because known accounts return HTTP 200 while unknown accounts return HTTP 500 with backend error details. The exposure is limited to confirming account existence - no credentials, session data, or code execution are obtained - making this a medium-severity information-disclosure issue (CWE-204) consistent with the independent assessment vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, which requires only that the web interface and the reset endpoint be network-reachable on a default deployment. No public exploit code and no confirmed active exploitation were identified at time of analysis; VulnCheck reported the issue and a vendor-released fix is available as v11.2.16, with the practical risk being follow-on targeted phishing or credential attacks that leverage a confirmed mailbox list.