DOM-based cross-site scripting (XSS) in the All in One SEO WordPress plugin, versions up to and including 5.0.1.1, allows unauthenticated attackers to inject arbitrary web scripts via a crafted URL pathname, but successful exploitation requires a victim who holds the aioseo_manage_seo capability to open the SEO Preview panel in the WordPress admin toolbar while visiting the malicious URL. No public exploit code or active exploitation in the wild has been identified at time of analysis, and the substantial victim interaction and privilege requirements make this a moderate-risk, defense-in-depth issue rather than an urgent threat.
Reflected cross-site scripting in the Greenshift - animation and page builder blocks WordPress plugin (all versions up to and including 13.2.0) allows an unauthenticated remote attacker to inject arbitrary script that is echoed unescaped inside a <script type="module"> tag when the '{{GET:...}}' dynamic placeholder is used in an element block's Custom JS field. Exploitation is conditional rather than universal: a site administrator must previously have configured a block's Custom JS to include a {{GET:...}} placeholder and that JavaScript must contain the token 'import', and the victim must then be tricked into visiting an attacker-crafted link (assessed CVSS:3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N; base 6.1 per the vendor CVE record). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so the realistically exposed population is the subset of Greenshift ≤13.2.0 sites that use {{GET:}} placeholders in Custom JS containing 'import'.
SQL injection in CodeAstro Simple Loan Management System 1.0 allows authenticated attackers to manipulate the g_name parameter in /admin/index.php, potentially leading to unauthorized data access or modification. Publicly available exploit code exists, increasing the risk for systems with exposed admin panels. The vulnerability requires a low-privilege authenticated session, and the CVSS score of 5.3 indicates a moderate severity issue.
SQL injection in itsourcecode Pet Shop Management System 1.0 allows an authenticated, low-privilege user to manipulate the 'filter' parameter of admin_reservefilter.php and inject arbitrary SQL into the backend query, exposing or altering database contents with low impact to confidentiality, integrity and availability. The flaw is remotely reachable over the network with no user interaction, but requires a valid session on the application's administrative component, so risk is concentrated in deployments that expose the admin panel or run the product in production. Publicly available exploit code exists for this issue, though there is no confirmation of active exploitation; the practical risk is further limited by the narrow real-world deployment base of this educational PHP product.
SQL injection in the admin_reject_completed.php script of itsourcecode Pet Shop Management System 1.0 lets an attacker who can reach the administrative back-office area manipulate the ID parameter to inject arbitrary SQL against the application's database, enabling unauthorized reads and modifications of stored data. Exploitation is network-reachable but requires at least low-privileged authenticated access to the admin interface (CVSS:4.0 PR:L, no user interaction), and the accompanying CVSS 4.0 vector carries an E:P exploit-maturity flag consistent with the public disclosure of working exploit code; there is no indication of confirmed active exploitation (not in CISA KEV). The issue is real but moderate-priority: it is bounded to version 1.0 deployments whose admin scripts are exposed to the attacker, and no vendor patch has been identified at time of analysis.
Reflected cross-site scripting in the Avada theme for WordPress (Website Builder For WordPress & WooCommerce) affects all versions up to and including 7.16.1, allowing an unauthenticated attacker to inject arbitrary script into the post-editor metabox by convincing a user who can access that editor to click a crafted link carrying a malicious 'lang' query parameter. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) confirms the attack is network-reachable without attacker credentials but requires victim interaction, and the changed scope (S:C) reflects that the injected script executes in the victim's browser session rather than compromising the server directly. No public exploit code was identified at time of analysis and there is no CISA KEV entry, so this should be treated as a medium-severity, social-engineering-dependent flaw rather than an actively exploited one. Assessed risk: this is a reflected Cross-Site Scripting flaw (CWE-79) with a CVSS 3.1 base score of 6.1 (Medium).
RafflePress Giveaways and Contests WordPress plugin before 1.12.27 contains an open redirect (CWE-601) that allows unauthenticated attackers to manipulate a giveaway's parent page URL so that the plugin's confirmation and referral links redirect visitors to an arbitrary external site. Exploitation requires an active giveaway on the target site and user interaction (a victim clicking the crafted link), limiting the impact to phishing or malware staging rather than direct compromise of the WordPress host. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in CodeAstro Simple Pharmacy Management System 1.0 allows an authenticated remote attacker to inject arbitrary SQL through the ID parameter of /SimplePharmacy-PHP/product/delete.php, exposing and potentially altering backend database contents. Exploitation requires a valid low-privilege session (CVSS PR:L in both the vendor vector and our independent assessment), needs no user interaction, and is low complexity over the network; publicly available exploit code exists but there is no confirmation of active exploitation (not in CISA KEV). The vendor's own CVSS 4.0 score is only 2.1 given limited confidentiality/integrity/availability sub-scores and the E:P exploit-maturity flag, while our independent 3.1 assessment rates confidentiality impact High with integrity and availability Low, so real-world risk is driven mainly by the authentication prerequisite and the narrow deployment footprint of this niche PHP application.
SQL injection in CodeAstro Simple Pharmacy Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /SimplePharmacy-PHP/product/view.php, leading to high confidentiality impact and limited integrity impact. Exploitation requires a low-privileged account, and no user interaction is needed. Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported. The product has extremely limited deployment, making this a low-to-moderate priority issue.
SQL injection in the ID parameter processed by confirm.php in itsourcecode Online Admission System Project 1.0 lets an authenticated remote user with only low privileges inject arbitrary SQL into backend queries and read or alter the underlying database. The flaw is a textbook CWE-89 case in a small open-source PHP sample/tutorial application, and the required low-privilege session (CVSS 4.0 PR:L, UI:N) plus the product's limited real-world deployment keep practical risk at LOW-to-MODERATE despite the public availability of exploit code. No CISA KEV entry indicates confirmed active exploitation, but a public proof-of-concept has been released (referenced via the VulDB report and a GitHub issue), so any internet-reachable instance should be treated as exposed. The assessed impact is limited confidentiality, integrity, and availability loss (CVSS 5.3), not full system compromise.
Invalid intermediate VM state can be exposed in Wasmtime 46.0.0 through 46.0.1 and 47.0.0 through 47.0.2 when an embedder mutates a Store from inside its fuel or epoch preemption callback - or keeps using the Store after a trap/cancellation - while a guest is mid-way through a bulk operation such as memory.copy, table.grow, table.fill, or array.copy. Hitting that preemption window can leave null elements in a non-nullable table, invalidate retained raw pointers after linear-memory growth during memory.copy, or invalidate GC pointers when the callback triggers garbage collection during array.copy, yielding a crash, invalid memory access, or GC heap corruption (integrity and availability impact only, no confidentiality loss). Exploitation is gated on a non-default embedding configuration (assessed CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L; PR:H in the assessed vector), requires winning a timing race, and no public exploit has been identified at time of analysis. Vendor-released patches are available in Wasmtime 46.0.2 and 47.0.3.
A crafted flat CSS selector can stall a synchronous parser thread in postcss-selector-parser versions prior to 7.1.6, because class and ID index lists are scanned repeatedly inside parsing passes that should be linear, producing quadratic (O(n^2)) parse cost. Only consumers that synchronously parse untrusted selector strings on an exposed request path are affected; the vendor explicitly notes ordinary build-time parsing of trusted sources is not affected. The issue is remotely triggerable by unauthenticated attackers where that precondition holds (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9), is availability-only with no confidentiality or integrity impact, and there is no public exploit code and no confirmed active exploitation (no KEV listing) at time of analysis. A vendor-released patch, version 7.1.6, is available.
Arbitrary file writes outside uv's installation prefix on Windows can occur when a user installs a crafted wheel in uv 0.12.7 through 0.12.17, potentially planting an executable in a directory already on the user's PATH. Exploitation is conditional-it requires a Windows host, a vulnerable uv version, and the victim actively installing the malicious wheel-so this is a medium-severity issue rather than an emergency; non-Windows systems are unaffected. Vendor-released patch: 0.12.18. No public exploit identified at time of analysis.
Database account usernames are silently emitted into telemetry traces by the OpenTelemetry JavaScript Contrib database instrumentation packages, which attach the `db.user` span attribute to every instrumented database operation by default, independent of the `enhancedDatabaseReporting` opt-in setting. Every deployment running the affected packages below their fixed versions - @opentelemetry/instrumentation-cassandra-driver before 0.66.0, -knex before 0.65.0, -mongoose/-mysql/-mysql2 before 0.67.0, -oracledb before 0.46.0, -pg before 0.73.0, and -tedious before 0.40.0 - that exports traces to a shared observability backend therefore leaks its database usernames, and indirectly hints about service topology, role assignment, and environment naming, to any actor with read access to that telemetry pipeline. Scored CVSS 5.8 (CWE-532), this is a default-configuration information-disclosure weakness rather than a remotely triggerable attacker compromise: no public exploit code has been identified at time of analysis, there is no confirmed active exploitation, and the only credential material exposed is account names - not passwords, query contents, or result data.
Unauthenticated HTTP proxying in Zilliz Attu before 3.0.0 lets remote attackers abuse the Playground feature as an open proxy or server-side request forgery (SSRF) pivot, forwarding arbitrary HTTP and HTTPS requests to URLs on the public internet with no credentials required. The flaw is CWE-306 (missing authentication for a critical function) and is rated CVSS 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N), meaning the attacker needs no authentication and no user interaction, and the main constraint is network reachability of the Attu management interface. Impact is bounded to proxied outbound requests rather than code execution or disclosure of Attu data, and there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis.
Path traversal in Nx's migration planner lets a hostile dependency write attacker-controlled bytes outside the temporary migration directory - or truncate an existing writable file - because the `nx-migrations.migrations` value read from a target package manifest is joined onto the temp directory without being validated as a contained relative path. The affected range is Nx 13.10.0 through 22.7.9 and 23.2.x before 23.2.1 (fixed in 22.7.10 and 23.2.1), and exploitation requires both a malicious package already present (a direct dependency or one injected through a trusted package's packageGroup) and the victim running `nx migrate` with the normal `nx@latest` handoff bypassed via NX_USE_LOCAL, NX_MIGRATE_USE_LOCAL, NX_MIGRATE_CLI_VERSION, --run-id, or the fallback after a temporary-install failure; the write occurs during migration planning, before the migration list is reviewed or --run-migrations is used. This is a moderate-risk path traversal (CWE-22) with a vendor-assigned CVSS 4.0 base score of 5.8 and an independent assessment of CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L (high integrity impact, no confidentiality impact); no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in FreeType's CID-keyed font loader allows attackers to exhaust memory and CPU by supplying a crafted font that triggers repeated allocation and decryption of subroutine data across multiple font dictionaries, causing the consuming application or service to hang or terminate. The issue is rated CVSS 5.5 with availability-only impact (A:H, C:N/I:N) and is gated by user interaction - someone or some automated process must actually load and parse the malicious font, which can be delivered by embedding it in a document, web page, or other parsed content. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the Red Hat advisory points to an upstream FreeType fix commit (f3ca71c9900fe860849b3163a6e2c1e765b291d9) and tracks the flaw under Bugzilla 2462295, so a patched release should be expected; the practical risk is highest for unattended font- or document-processing pipelines rather than interactive desktop use.
Improper authentication in onetwothreeneth HospitalManagementSystem (rolling release, code up to commit 9ef91ed6007314b6473110ed699dff76d158f61d) allows unauthenticated remote attackers to bypass authentication by manipulating the ID argument in php/sessions.php. The flaw is rated medium severity (CVSS 4.0 base 5.5, CWE-287) with limited confidentiality impact, and publicly available exploit code exists, though the project is niche and likely to have low real-world exploitation priority.
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) allows unauthenticated attackers to inject arbitrary JavaScript through the blog comment Author Name field, which is stored and later rendered without adequate escaping, executing in the browser of anyone viewing the affected page. The attack is tightly gated, however: an administrator must have enabled Autoptimize's 'Lazy-load images?' option, a disabled W3 Total Cache installation must still have w3-total-cache/w3-total-cache.php present on disk, a class named Minify_HTML must be loaded into scope by some other plugin, and a comment moderator must approve the malicious comment before the payload renders. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a low-priority, high-friction issue affecting only sites that happen to match that exact plugin and file combination; default WordPress plus Autoptimize installations are not exploitable.
An authenticated authorization bypass (IDOR) in the PublishPress Series WordPress plugin (organize-series), affecting versions through 3.1.3, lets a low-privileged logged-in user supply an attacker-chosen object key to reach and manipulate series resources that belong to other users. The flaw is rated CVSS 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), meaning impact is limited to partial integrity and availability with no confidentiality loss, and exploitation requires a valid low-privilege account on a site running the vulnerable plugin. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); risk is moderate and depends on whether the site permits self-registration or otherwise grants untrusted users low-privilege accounts.
Unbounded key-derivation cost parameters in Bouncy Castle for Java before 1.86 allow a denial of service against applications that parse attacker-influenced cryptographic structures: PBKDF2 iteration counts, derived-key lengths, scrypt parallelization factor p, and OpenSSH v1 bcrypt round counts were read straight from untrusted input and used to drive the KDF before any password or MAC verification could reject the data. Affected code paths include the RFC 9579 PBMAC1 MAC calculator builders (JcePBMac1CalculatorBuilder, PKCS12PBEUtils.createPBMac1Calculator reached via PKCS12PfxPdu.isMacValid), the PKCS#8/PKCS#12 scrypt cost guards, the raw JCA PBKDF2 provider, and OpenSSH v1 private-key parsing in Bouncy Castle for Java, LTS (before 2.73.13) and FIPS (bcpkix-fips before 1.0.13 / 2.0.13 / 2.1.13). Impact is availability-only (CVSS:4.0 5.3; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L): exploitation requires the victim application to passively process a malicious blob and is unauthenticated (PR:N), but no key material or data is exposed, and there is no public exploit identified at time of analysis.
Authorization bypass in the ThimPress LearnPress WordPress plugin (versions through 4.4.9) allows unauthenticated remote attackers to read sensitive learner, order, or course data by manipulating a user-controlled key in an insecure direct object reference (IDOR) pattern. Assessed as medium severity (CVSS 5.3) with confidentiality-only impact; no public exploit identified at time of analysis.
Unbounded process memory growth in the multidict C extension (versions 6.7.0 up to but excluding 6.9.1) lets unauthenticated remote attackers drive a denial of service by repeatedly invoking two items-view set operations. The reflected union 'operand | md.items()' and the subtraction 'md.items() - operand' each fail to release one key-identity reference and one value reference per operand element, and because these are strong references the garbage collector cannot reclaim them, so memory grows without bound as operations repeat. The issue is availability-only (CVSS 5.3: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), patches only reachable in compiled C-extension builds with non-tuple, attacker-influenced operands, and there is no public exploit identified at time of analysis; the vendor-released fix is multidict 6.9.1.
Cleartext logging of the monitoring user's password in Canonical's postgresql-operator charm allows an attacker with read access to the Prometheus postgres_exporter logs to recover credentials granting read-only pg_monitor access to PostgreSQL. The flaw (CWE-532) affects charm revisions prior to 1189/1190 on the 14/edge track and prior to 1216/1217 on the 14/stable track, and exploitation additionally requires that a database connection error has occurred so the password is written to logs. This is a modest-severity information-disclosure issue (CVSS 5.3, PR:L) with no public exploit identified at time of analysis, fixed in the specified revisions via upstream patches.
Canonical MAAS exposes the region controller's RPC secret in plaintext through the vendor-data metadata endpoint, letting an unauthenticated attacker who can reach that endpoint and knows or guesses a target machine's MAAS system ID recover the shared secret used for rack-controller RPC authentication (CVSS 5.3 / assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Exposure is conditional: it only affects instances where a machine was deployed with the non-default 'register as rack' (install_rackd) option enabled, and it further requires network reachability to the preseed/metadata server plus knowledge of the system ID. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but vendor patches exist in MAAS 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0, and the fix disables the vulnerable deploy-as-rack feature entirely.
Unauthorized disclosure of event metadata in MISP lets any authenticated user enumerate the titles, dates, and correlation counts of events they are not permitted to open. The related-events listing feature retrieved correlated events straight from the correlation table without re-checking the caller's access rights against each target event, and that table stores only a snapshot of distribution level and sharing group (with no published flag), so unpublished events and events whose distribution or sharing group changed after the correlation was recorded were still returned. Exploitation requires an authenticated account with access to at least one event plus pre-existing correlation entries crossing a sharing boundary, and it leaks metadata only - never attribute payloads; no public exploit was identified at time of analysis and the vendor has published a fix commit, making this a genuine but low-to-moderate priority exposure bounded to community members rather than anonymous internet attackers.
Unauthenticated remote attackers can enumerate and manipulate customer invoices in the WordPress plugin Appointment Booking Plugin - LatePoint | Calendar & Scheduling for WordPress through version 5.7.1, because the OsPaypalConnectController::create_order_for_transaction() handler is exposed as a public wp_ajax_nopriv_latepoint_route_call route and loads an OsInvoiceModel using a bare sequential integer invoice_id with no ownership or access-key check. An attacker who iterates invoice IDs can confirm the existence of invoices belonging to arbitrary customers and cause transaction-intent rows to be created against those invoices, and can overwrite the intent_key of any in-flight NEW-status transaction intent, breaking the Stripe/Razorpay checkout and webhook flows those customers are waiting on. No public exploit identified at time of analysis, and exploitation is limited in practice by the need to guess sequential IDs and by the fact that meaningful intent_key disruption requires a victim to be mid-checkout; the affected code path remains otherwise reachable without authentication and without user interaction.
Server-side request forgery and cross-site scripting in YesWiki before 4.6.7 allow an authenticated page editor to abuse the Bazar 'valeur' action to make the server fetch arbitrary URLs, including loopback and internal addresses, and to inject unescaped remote HTML that executes script in a victim's browser. Exploitation requires an editor-level account (CVSS PR:L) and, for the XSS half, a separate victim viewing the poisoned page, so anonymous remote exploitation is not possible; no public exploit identified at time of analysis. Risk is medium severity per the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, and a vendor-released fix is available in 4.6.7.
Improper access control in MISP's attribute search and paginated attribute listing endpoints discloses soft-deleted (retracted) threat intelligence attributes belonging to other organizations to any authenticated user who already holds read visibility of the event, yielding a confidentiality-only impact rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Exploitation requires an authenticated MISP account (PR:L) and an explicit query for deleted attributes via the deleted-attributes search or the paginated attribute view with the deleted filter; the normal event detail view is not affected because it already restricts soft-deleted attributes to the owning organization and sync-permission users. All MISP versions prior to v2.5.48 are affected, the issue is rated a genuine but low-to-moderate priority information-disclosure problem rather than a critical emergency, no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV) exists, and practical relevance is highest on multi-organization, federated, or community instances where cross-organization event visibility exists.
Missing authorization (CWE-862) in HAVELSAN's Sef - AI Chatbot Platform allows an authenticated, low-privileged user to reach functionality that is not properly constrained by access control lists, resulting in unauthorized access to data (confidentiality impact only, no integrity or availability effect). The vulnerability affects all versions before 2.1 and carries a moderate CVSS 3.1 base score of 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning exploitation requires valid credentials and additional non-trivial conditions - the high attack complexity reflects the need for specific request state, timing, or knowledge of protected object identifiers rather than a single trivial request. There is no public exploit code and no confirmed active exploitation at time of analysis; the issue was reported by TR-CERT and is documented in the Turkish national CERT advisory TR-26-1241.
Account enumeration in Softtr Informatics Trading Limited Company's E-Commerce Pack lets unauthenticated remote attackers determine whether specific user accounts exist by observing differing responses from login, registration, or password-recovery functions. All versions up to and including the 2026-10-02 release are affected, and exploitation requires only network reachability to an instance that actually fronts a user-account system on the public internet - no credentials or user interaction are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Impact is limited to confidentiality of account-existence data (C:L, no integrity or availability effect), so this is a low-to-moderate priority information-disclosure issue and reconnaissance aid rather than a direct compromise path; no public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS data was not provided.
Server-side request forgery (SSRF) in UTMStack before 11.2.16 is a genuine but moderate-severity issue rather than a top-tier emergency: an authenticated user who can reach the POST/PUT /api/identity-providers endpoint can supply a crafted metadata URL that IdentityProviderService.validateMetadataUrl() accepts without validating target host, IP, or scheme, causing the server to issue attacker-directed requests to internal or cloud metadata hosts. The practical consequence is internal network reconnaissance and port scanning, plus exposure of cloud instance-metadata services such as 169.254.169.254 when UTMStack is deployed in a cloud environment; impact is otherwise confined to confidentiality (scope-changed C:L/I:N/A:N) and is gated by the requirement for a valid UTMStack account (PR:L). No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and the vendor has released version 11.2.16 as the fixed version.
Privilege escalation in Ghost CMS (TryGhost Ghost) versions 0.5.0 through before 6.64.0 allows an authenticated Editor or Super Editor to assign their own elevated role to other staff accounts, promoting existing Author and Contributor users to Editor or Super Editor without holding the authority to do so. Exploitation is gated by the attacker already holding an Editor or Super Editor account (PR:L in the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, vendor CVSS 4.0 score 5.3), so anonymous outsiders cannot abuse it, and the effect is limited to integrity rather than confidentiality or availability. A vendor-supplied patch is available and no public exploit code has been identified at time of analysis.
Unauthenticated information disclosure in the Request a Quote WordPress plugin (versions through 2.5.6) lets any remote attacker retrieve the contact details stored for quote-request submissions - including entries the site owner has not published - by calling an AJAX handler that is exposed to logged-out visitors without any authorization check. No authentication, nonce, capability, or user interaction is required, and the impact is limited to confidentiality of this plugin's stored quote data (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); there is no write access, privilege escalation, or availability impact. No public exploit identified at time of analysis and no confirmed active exploitation.
Information disclosure in the Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 exposes the reCAPTCHA secret key to unauthenticated visitors on any active giveaway page that has reCAPTCHA configured. Retrieval requires no authentication, no user interaction, and no special tooling because the plugin embeds the secret key in the public giveaway settings rather than keeping it server-side. No public exploit code has been identified at time of analysis, and the issue is configuration-dependent: sites running a vulnerable version without an active reCAPTCHA-enabled giveaway are not exposed.
Unauthenticated remote attackers can forge payment gateway callbacks against WordPress stores running the Paytm Payment Gateway plugin before 2.8.9, marking arbitrary unpaid orders as paid and reducing stock levels. The bypass (CWE-287) stems from the plugin skipping origin verification of callbacks while the merchant secret key is unset - the default state immediately after activation - so each affected site is exposed only during the post-activation, pre-configuration window. CVSS 3.1 scores it 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and no public exploit has been identified at time of analysis, making this a moderate, context-dependent risk rather than a top priority.
Cross-site request forgery in the admintag action of YesWiki before 4.6.7 allows an attacker requiring no privileges (CVSS 4.0 PR:N, UI:P) to trick a logged-in administrator into clicking a crafted GET link that bulk-deletes tag associations via a wide id range in the delete_tag parameter. The attack works only because the request is issued as a top-level navigation, which lets the SameSite=Lax administrator cookie be sent; background cross-site requests such as iframes or XHR are blocked by SameSite=Lax, and the admin must have an active session and interact with the link. Impact is confined to integrity and availability of tag triples (C:N/I:L/A:L) rather than broader data or code compromise, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in MISP versions below 2.5.48 allows an attacker who can create or modify events on a linked (remote) MISP server to embed HTML or JavaScript in an event identifier, which is then rendered unescaped in the local instance's remote event preview index and executes in the browser session of any authenticated user who opens that page. The flaw is rated CVSS 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), meaning the attacker must be authenticated on the remote server and the payload only fires once a victim navigates to the vulnerable preview view, so exploitation requires a fully pre-established trust chain rather than unauthenticated access. This is a moderate-severity stored XSS (CWE-79) with no signals of elevated real-world risk: there is no CISA KEV listing and no public exploit identified at time of analysis, and the vendor has released a fix.
Information disclosure in the WordPress plugin Smart One Click Setup - Complete Demo Import & Export through version 1.4.3 allows unauthenticated remote attackers to retrieve sensitive data that the plugin embeds into the content it sends to clients. Per the independent assessment, exploitation requires no special conditions beyond the plugin being installed and active - the vector is AV:N/AC:L/PR:N/UI:N with a confidentiality-only impact (C:L) and no effect on integrity or availability - and no public exploit code has been identified at time of analysis, so this is best treated as a low-to-moderate priority finding whose exposure is gated primarily by whether the affected plugin is deployed. No CVE has been confirmed as actively exploited (CISA KEV) and no EPSS score was supplied with the available intelligence.
Cross-site request forgery in YesWiki before 4.6.7 allows a remote unauthenticated attacker to delete or permanently purge page attachments by luring a logged-in page owner or administrator into a top-level GET navigation that invokes the filemanager page handler with do=del, erase, or emptytrash. Exploitation requires the victim to have an active privileged session and to perform the crafted navigation, and the resulting impact is limited to integrity and availability of page attachments; there is no confidentiality exposure or code execution. No public exploit code was identified at time of analysis, and the vendor has released a patch.
Cross-site request forgery in YesWiki before 4.6.7 lets unauthenticated remote attackers silently revert wiki pages to older or vandalized revisions by luring a write-capable user into a top-level navigation that invokes RevisionsHandler with the restoreRevisionId parameter. The flaw is a state-changing GET request that lacks CSRF token validation; successful exploitation requires an authenticated victim with page-edit rights and only impacts page integrity, not confidentiality or availability. No public exploit identified at time of analysis; a vendor patch is available in version 4.6.7.
Unauthenticated remote attackers can retrieve embedded sensitive data from WordPress sites running the Shahjada Download Manager plugin versions up to 3.3.71 by exploiting an authorization bypass through a user-controlled key (CWE-639). The vulnerability allows access to data that should be restricted, though impact is limited to confidentiality (C:L) with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in Loglama.net's TurkHotspot captive-portal software allows an attacker positioned on an adjacent network segment to inject script into a victim's browser session inside the portal context when the victim loads a crafted link. All versions up to and including those released as of 2026-10-02 are affected (CPE cpe:2.3:a:loglama.net:turkhotspot:*), and the assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 5.2) shows exploitation requires adjacent-network reachability plus victim interaction, with impact limited to low confidentiality and integrity effects and no availability impact. No public exploit identified at time of analysis, and because Loglama.net did not respond to the coordinated disclosure there is no vendor-released patch identified at time of analysis, leaving the flaw a moderate-severity concern whose real-world risk is tempered by the adjacency and user-interaction prerequisites.
Reflected cross-site scripting in YesWiki (all versions before 4.5.3 per EUVD, with the vendor's GitHub Security Advisory stating the fix lands in 4.6.0) lets remote attackers inject JavaScript via unsanitized parameters such as incomingurl, id, file, tags and template, and publicly available exploit code exists in the GHSA proof-of-concept links. Successful exploitation requires the victim to open an attacker-crafted URL (UI:A), after which script runs in the context of the YesWiki origin and can hijack sessions or fire authenticated requests against backend functionality; the listpages/tags and bazariframe/template vectors are explicitly reachable without authentication (PR:N). No confirmed active exploitation (CISA KEV) has been reported, and the assessed impact is bounded to the victim's browser session, making this a medium-severity, moderate-priority issue rather than an urgent one.
Reflected cross-site scripting in YesWiki versions prior to 4.6.7 lets an unauthenticated remote attacker inject JavaScript through the 'field' parameter of the mail handler, breaking out of the ajax-mail-form action attribute and executing script in the victim's browser context. Exploitation is not autonomous: the CVSS:4.0 vector carries UI:A and the assessed CVSS:3.1 vector carries UI:R, so a victim must click an attacker-crafted link, making this a phishing-style, social-engineering-dependent attack that does not require the attacker to hold any account (PR:N). The vendor/CVSS 4.0 base score is 5.1 and no public exploit code or confirmed active exploitation was identified at time of analysis; scope is changed (S:C) with only low confidentiality and integrity impact, and the primary mitigating factor is the mandatory victim interaction.
Stored cross-site scripting in the YesWiki wiki platform (all versions before 4.6.7) allows an authenticated user who can submit Bazar entries to upload an SVG file containing embedded script, because the Bazar FileField handler checks only the file extension and never routes the upload through HtmlPurifierService::cleanFile. The payload is stored verbatim and later served inline with the image/svg+xml content type from the wiki origin, so script executes in that origin when a victim - typically an administrator - opens or views the file, exposing session cookies and account context. Exploitation is constrained by the need for a low-privileged authenticated account plus a victim's interaction (CVSS 4.0 base 5.1, Medium; CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor fix is available in 4.6.7.
Cross-site scripting in MISP’s ID Translator feature (before version 2.5.48) lets a malicious linked MISP server return a crafted event ID that executes arbitrary JavaScript in the browser of any authenticated user who views the ID Translator page, leading to session hijacking or credential theft. Exploitation requires a configured linked server, a compromised remote instance, and victim interaction (UI:R); it is unauthenticated from the attacker’s perspective (PR:N) but does not affect availability. No public exploit or active exploitation is identified, and the vendor has released a patch (commit bd5e80c84) that casts remote event IDs to integers and applies output encoding.
Stored cross-site scripting in YesWiki before 4.6.7 allows authenticated users with page-edit or comment-posting privileges to inject an event handler into rendered markdown image markup, causing JavaScript to execute in the browsers of anyone who later views the poisoned page - including administrators. The flaw lives in the wakka formatter (formatters/wakka.php), where a quote character inside a markdown image URL breaks out of the src attribute and permits an onerror handler to be attached; exploitation is gated on a victim rendering the stored content (passive interaction), matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Vendor-supplied CVSS 4.0 rates it 5.1 (medium), a fixed release (4.6.7) is available from the vendor, and no public exploit code has been identified at time of analysis.
Server-side request forgery (SSRF) in HAVELSAN's Sef AI Chatbot Platform before version 2.1 allows an authenticated attacker with high privileges (PR:H) to cause the server to make requests to arbitrary URLs, potentially reading internal resources reachable from the server. This moderate-severity flaw (CVSS 4.9) is network-reachable without user interaction, but requires a privileged session, limiting exploitation to trusted or compromised elevated accounts. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Repasat application allows an authenticated, low-privileged user to inject script content through the 'nomCompetidor' parameter processed at the '/es/competitors/store' endpoint, where the value is persisted and later rendered to other users. Payload execution happens in the victim's browser session once that page is viewed, yielding limited confidentiality and integrity impact confined to the browser context with no direct server compromise; successful exploitation requires both a valid low-privileged account (CVSS vector PR:L) and victim interaction (UI:A/UI:R). No public exploit code has been identified at time of analysis, and no vendor-released patch is documented in the available intelligence, making this a genuine but low-to-moderate priority issue rather than an emergency; the primary reference is the INCIBE advisory covering multiple Repasat application vulnerabilities.