SQL injection in CodeAstro Simple Loan Management System 1.0 allows authenticated attackers to manipulate the g_name parameter in /admin/index.php, potentially leading to unauthorized data access or modification. Publicly available exploit code exists, increasing the risk for systems with exposed admin panels. The vulnerability requires a low-privilege authenticated session, and the CVSS score of 5.3 indicates a moderate severity issue.
SQL injection in itsourcecode Pet Shop Management System 1.0 allows an authenticated, low-privilege user to manipulate the 'filter' parameter of admin_reservefilter.php and inject arbitrary SQL into the backend query, exposing or altering database contents with low impact to confidentiality, integrity and availability. The flaw is remotely reachable over the network with no user interaction, but requires a valid session on the application's administrative component, so risk is concentrated in deployments that expose the admin panel or run the product in production. Publicly available exploit code exists for this issue, though there is no confirmation of active exploitation; the practical risk is further limited by the narrow real-world deployment base of this educational PHP product.
SQL injection in the admin_reject_completed.php script of itsourcecode Pet Shop Management System 1.0 lets an attacker who can reach the administrative back-office area manipulate the ID parameter to inject arbitrary SQL against the application's database, enabling unauthorized reads and modifications of stored data. Exploitation is network-reachable but requires at least low-privileged authenticated access to the admin interface (CVSS:4.0 PR:L, no user interaction), and the accompanying CVSS 4.0 vector carries an E:P exploit-maturity flag consistent with the public disclosure of working exploit code; there is no indication of confirmed active exploitation (not in CISA KEV). The issue is real but moderate-priority: it is bounded to version 1.0 deployments whose admin scripts are exposed to the attacker, and no vendor patch has been identified at time of analysis.
SQL injection in CodeAstro Simple Pharmacy Management System 1.0 allows an authenticated remote attacker to inject arbitrary SQL through the ID parameter of /SimplePharmacy-PHP/product/delete.php, exposing and potentially altering backend database contents. Exploitation requires a valid low-privilege session (CVSS PR:L in both the vendor vector and our independent assessment), needs no user interaction, and is low complexity over the network; publicly available exploit code exists but there is no confirmation of active exploitation (not in CISA KEV). The vendor's own CVSS 4.0 score is only 2.1 given limited confidentiality/integrity/availability sub-scores and the E:P exploit-maturity flag, while our independent 3.1 assessment rates confidentiality impact High with integrity and availability Low, so real-world risk is driven mainly by the authentication prerequisite and the narrow deployment footprint of this niche PHP application.
SQL injection in CodeAstro Simple Pharmacy Management System 1.0 allows authenticated remote attackers to execute arbitrary SQL queries via the ID parameter in /SimplePharmacy-PHP/product/view.php, leading to high confidentiality impact and limited integrity impact. Exploitation requires a low-privileged account, and no user interaction is needed. Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported. The product has extremely limited deployment, making this a low-to-moderate priority issue.
SQL injection in the ID parameter processed by confirm.php in itsourcecode Online Admission System Project 1.0 lets an authenticated remote user with only low privileges inject arbitrary SQL into backend queries and read or alter the underlying database. The flaw is a textbook CWE-89 case in a small open-source PHP sample/tutorial application, and the required low-privilege session (CVSS 4.0 PR:L, UI:N) plus the product's limited real-world deployment keep practical risk at LOW-to-MODERATE despite the public availability of exploit code. No CISA KEV entry indicates confirmed active exploitation, but a public proof-of-concept has been released (referenced via the VulDB report and a GitHub issue), so any internet-reachable instance should be treated as exposed. The assessed impact is limited confidentiality, integrity, and availability loss (CVSS 5.3), not full system compromise.
Invalid intermediate VM state can be exposed in Wasmtime 46.0.0 through 46.0.1 and 47.0.0 through 47.0.2 when an embedder mutates a Store from inside its fuel or epoch preemption callback - or keeps using the Store after a trap/cancellation - while a guest is mid-way through a bulk operation such as memory.copy, table.grow, table.fill, or array.copy. Hitting that preemption window can leave null elements in a non-nullable table, invalidate retained raw pointers after linear-memory growth during memory.copy, or invalidate GC pointers when the callback triggers garbage collection during array.copy, yielding a crash, invalid memory access, or GC heap corruption (integrity and availability impact only, no confidentiality loss). Exploitation is gated on a non-default embedding configuration (assessed CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L; PR:H in the assessed vector), requires winning a timing race, and no public exploit has been identified at time of analysis. Vendor-released patches are available in Wasmtime 46.0.2 and 47.0.3.
Unauthenticated remote attackers can win a timing race against the booking/availability logic in WPdevelop's Booking Calendar WordPress plugin through version 11.8.4, producing inconsistent or corrupted booking state (integrity-only, CVSS 3.1 score 3.7). The scored vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects that no credentials or user interaction are required, but success is non-deterministic and normally demands many rapid parallel requests to the public booking submission flow, with no data disclosure or availability impact. This is a low-severity, low-real-world-priority issue: there is no CISA KEV listing and no public exploit identified at time of analysis.
Code execution concealment in MathWorks Simulink before R2026b allows an attacker-crafted .slx model to include blocks that are never visible in the Simulink Editor yet execute when the model is opened. Exploitation is local and requires a victim to open an untrusted model, with high attack complexity and low confidentiality/integrity impact (CVSS 3.6), so the practical risk is low despite the code-execution wording. The supplied data shows a public technical disclosure of the concealed-block technique but no CISA KEV confirmation, and no public exploit identified at time of analysis.
Sensitive information exposure in the Otter Blocks WordPress plugin (all versions up to and including 3.2.6) allows any authenticated user with subscriber-level access or above to retrieve the email addresses and submission dates of the five most recent form submitters, along with the site's total form submission count, by manipulating the 'otter_form_widget_filter' parameter. The vulnerable widget is registered whenever the themeisle_blocks_form_emails option is non-empty - the normal state on any site that has saved a Form block - so the exposure is live on standard sites using the plugin's form feature. No public exploit identified at time of analysis, and no evidence of active exploitation; the exposed data set is small and fixed, and the independent assessment rates real-world risk as consistently low (low-severity information disclosure under CVSS 3.1, assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Missing authorization in the Motors WordPress plugin before 1.4.124 lets an authenticated user with subscriber-level access or higher set metadata on posts they do not own, including overwriting WooCommerce product prices, by invoking one of the plugin's listing management actions. The attack path only exists when the site has WooCommerce active and the plugin's paid featured-listing option enabled, neither of which is a default configuration, so default or non-WooCommerce installations are not exploitable. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV does not list this CVE), and the assessed severity is low at CVSS 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting integrity-only impact and heavy prerequisite constraints.
Trivy versions before 0.71.0 allow directory traversal through Terraform filesystem functions during misconfiguration scanning of untrusted input, potentially exposing sensitive files located outside the scan root. An attacker able to supply a malicious Terraform configuration (e.g., via a third-party pull request) can use relative paths like '../secret' in file() or filebase64() to include the contents of files above the scan directory in scan output. Exploitation requires the sensitive file to exist at a guessable traversal path and is confined to information disclosure (C:L) with high attack complexity; no public exploit has been identified at time of analysis.
Cross-site request validation weakness in the Next.js `next dev` development server (versions 16.0.0 through 16.3.7) allows a malicious website, when visited by a developer who is simultaneously running the dev server, to reach the Model Context Protocol endpoint at /_next/mcp and read development-only metadata: the project's disk location, source-code snippets embedded in error reports, the application's route inventory, and development logs. The CVSS 4.0 score is only 2.3 (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N by our review) because exploitation requires the victim to actively run the affected dev server and browse to an attacker-controlled page during that session, and because the impact is limited to read-only disclosure with no code execution or data modification. Production and built deployments do not serve this endpoint at all, so only developer workstations during active local development are exposed; no public exploit code was identified at time of analysis and the issue is not known to be actively exploited. A vendor-released patch is available in Next.js 16.3.8.
Ghost CMS versions from 0.7.2 up to (but not including) 6.64.0 leak password-hash ordering information to authenticated, staff-level users through the Admin API, allowing an insider or a holder of a compromised staff account to learn how other staff members' password hashes are sorted relative to one another. Exploitation requires authenticated staff access with Admin API reachability (PR:L), is rated high complexity (AC:H) because it depends on repeated, carefully crafted queries and the analysis of response discrepancies, and is bounded in impact: per the vendor advisory and independent assessment, the hashes themselves are not disclosed and practical password recovery is not enabled. No public exploit code and no confirmed active exploitation were identified at time of analysis, consistent with the very low CVSS 4.0 score of 2.3 and the assessed CVSS 3.1 vector of AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N.
Stored cross-site scripting in SourceCodester Student Result Management System 1.0 lets an attacker who can create an announcement record inject JavaScript through the 'title' or 'announcement' fields of script/academic/core/new_announcement.php, which then executes in the browser of any user who later views the rendered announcement. The exploitation prerequisite is low-privileged authenticated access to the announcement-posting function plus victim interaction (the target must load the affected page), and the authoritative assessment confirms impact is confined to the victim's browser session (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), with no server-side confidentiality or availability impact. Publicly available exploit code exists and disclosure has been coordinated through VulDB, but there is no indication of confirmed active exploitation (no CISA KEV listing) and no vendor-released patch identified at time of analysis, keeping this a genuinely low-priority issue despite the public disclosure.
Missing authorization in the cal.diy (Cal.com) PBAC Permission Engine lets any authenticated low-privilege user read and modify bookings that do not belong to them, because the doesUserIdHaveAccessToBooking function in BookingAccessService.ts relies on a PermissionCheckService whose permission checks were replaced by stubs that unconditionally return true. All builds up to and including 6.2.0 are affected, and publicly available exploit code exists, though the CNA-assigned CVSS 4.0 base score is only 2.1 (Low) because per-request confidentiality, integrity and availability impact is limited and a valid account on the target instance is required. No patched release is available yet: the fix is proposed in pull request #30253, which is still awaiting acceptance, so defenders cannot remediate by upgrading at time of analysis.
Denuvo Anti-Tamper (through 2026-03-04) can be bypassed by locally authenticated administrators with kernel-level privileges who load a hypervisor driver that intercepts CPUID instructions and spoofs hypervisor-absence results, defeating the anti-tamper check on AMD (SimpleSvm.sys) and Intel (hyperkd.sys, hyperhv.dll) platforms. The vulnerability has a CVSS score of 1.9 (AV:L/AC:H/PR:H) and only affects the integrity of the DRM check on the attacker's own system, with no third-party victim or escalation. No public exploit identified at time of analysis.