A remote, unauthenticated attacker can cause a denial-of-service condition on NetScaler ADC and NetScaler Gateway appliances running versions prior to the fixed builds (14.1-73.41, 13.1-64.28, 13.1-37.282, and 14.1-73.41 FIPS for ADC; 14.1-73.41 and 13.1-64.28 for Gateway). The vulnerability is network-reachable with low attack complexity and requires no user interaction, making internet-facing Gateway deployments the primary risk surface. No public exploit code or CISA KEV entry was identified at time of analysis, though the CVSS 4.0 base score of 8.7 reflects high severity for the availability-only impact.
Remote unauthenticated OS command injection in AhsayCBS 10.3.0 through 10.3.2 lets an attacker execute arbitrary operating-system commands on the backup server by manipulating the 'random' argument of the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. The flaw is scored 10.0 under CVSS 4.0 (and 9.8 under CVSS 3.1, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), is confirmed actively exploited (CISA KEV), and has been assigned a public PoC reference that is not verified as working exploit code, with EPSS at 1.84% (78th percentile). Successful exploitation yields full compromise of confidentiality, integrity and availability of the backup server and, given the CVSS 4.0 scope-change metrics, likely of dependent systems; version 10.3.4 resolves the issue.
Improper authentication in AhsayCBS up to version 10.3.2 lets an unauthenticated remote attacker bypass credential verification by manipulating the 'random' parameter processed by the checkSysPwd routine in the API component (com/ahsay/obs/api/ApiStructsAction.java). Exploitation requires only network reachability to the exposed AhsayCBS API/management interface and publicly available exploit code exists, so deployments that leave the console internet-facing or broadly reachable are the most at risk. The assessed impact is limited to partial confidentiality, integrity, and availability effects, and no confirmed active exploitation (CISA KEV) has been reported, making this a moderate-priority issue that is nonetheless straightforward to trigger where the API is exposed.
Code injection in InternLM MindSearch 0.1.0 allows unauthenticated remote attackers to execute arbitrary code through the Planner Agent component, specifically by manipulating the inputs argument processed by ExecutionAction.run in mindsearch/agent/graph.py. The issue is rated critical (CVSS 9.3 per the CVSS 4.0 vector; the independent assessment likewise has PR:N/UI:N with high confidentiality, integrity, and availability impact), and publicly available exploit code exists. The vendor was contacted but did not respond, no vendor-released patch has been identified, and risk is concentrated in internet-reachable or otherwise accessible self-hosted MindSearch 0.1.0 deployments.
Cross-site request forgery in the CoCart WordPress plugin before 4.9.7 lets an unauthenticated remote attacker create a new administrator account on a victim site by luring a currently logged-in administrator to an attacker-controlled page. Because the plugin's REST API authentication filter is not scoped to its own endpoints, it disables WordPress core's REST nonce protection for every /wp-json/ route once the plugin is active (versions 4.9.0 through 4.9.6), so the forged write rides the administrator's live cookie session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Publicly available exploit code exists and successful exploitation yields full site takeover, though EPSS is only 0.11% (1st percentile) and the attack cannot be automated against anonymous visitors - it is gated on an active admin session plus social-engineering interaction.
Stored cross-site scripting in the WordPress plugin Horizontal Scrolling Announcements (all versions through 2.6) allows an authenticated user holding access to the plugin's announcement management page - Contributor level or higher, once that permission is granted - to save a payload into an unsanitised announcement setting that is rendered unescaped into an HTML attribute on the front end, so the script executes in the browser of anyone viewing the announcement. Publicly available exploit code exists (the WPScan disclosure is referenced as an exploit source), but EPSS is only 0.15% (4th percentile) and there is no confirmed active exploitation (not listed in CISA KEV). Our independent assessment places real-world priority as LOW: exploitation is not remote-unauthenticated, it is limited to one specific setting, and it additionally requires victim interaction (someone must load a page that renders the stored announcement).
SQL injection in RainyGao DocSys (up to version 2.02.85) allows an attacker to inject arbitrary SQL through the 'url' argument handled by BaseController.createDBForMysql in the Database Management component, potentially exposing or altering backend data. Publicly available exploit code exists, and the CVSS 4.0 vector scores the issue 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N with E:P), while an independent assessment using CVSS 3.1 rates it AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity, and availability impact - the discrepancy regarding privilege requirements reflects the fact that the vulnerable function configures a MySQL connection, an action that in practice is reached from the DocSys management interface and may require an authenticated or administrative session. The vendor was notified via an issue report but has not responded, and no vendor-released patch has been identified at time of analysis.
Information disclosure in Weaviate Verba 2.1.3 and earlier allows remote, unauthenticated attackers to retrieve environment and configuration data by invoking the get_environment function in goldenverba/components/util.py through the generate_stream endpoint. Publicly available exploit code exists (referenced in the VulDB disclosure and a public gist), raising the likelihood of opportunistic scanning, although there is no confirmation of active exploitation (not listed in CISA KEV). Impact is bound to confidentiality (partial disclosure), yielding a 6.9 CVSS v4.0 base score; the main practical prerequisite is that the Verba service be network-reachable.
Unauthenticated remote attackers can exploit a server-side request forgery (SSRF) in SciPhi-AI R2R 3.6.6 and earlier by supplying a crafted generation_config.api_base value to the Retrieval Completion API endpoint, causing the server to make requests to arbitrary internal or attacker-controlled URLs. Publicly available exploit code exists (a GitHub Gist), and the vendor did not respond to disclosure, so no patched version is confirmed at time of analysis. The independent assessment rates this as medium severity (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L; VulDB CVSS 4.0 score 6.9), with impact bounded by what internal targets the R2R server can reach.
Hard-coded JWT signing secrets in SciPhi-AI R2R through 3.6.6 can let remote unauthenticated attackers forge valid JSON Web Tokens and bypass authentication when a deployment still uses the shipped DEFAULT_BCRYPT_SECRET_KEY or DEFAULT_NACL_SECRET_KEY values. The exposure is configuration-dependent: instances that override both defaults with custom secrets are not vulnerable, and the authentication or API endpoints must be reachable over the network for exploitation. Publicly available exploit code exists via the linked disclosure, but there is no KEV confirmation of active exploitation.
SQL injection in the 'location' parameter of admin/donate.php in the kishor-23 food-waste-management-system (PHP, GitHub rolling release) lets remote attackers inject arbitrary SQL into the donation-handling query, exposing or altering backend data. The published CVSS 4.0 vector (6.9, AV:N/AC:L/AT:N/PR:N/UI:N/E:P) asserts unauthenticated, no-interaction exploitation, though the 'admin/' path suggests the page is intended to sit behind an administrative login, so real privilege requirements may be higher if session checks are enforced. Exploit details are publicly available (referenced GitHub issue #7), but the issue is not in CISA KEV, so there is no confirmation of active exploitation in the wild; the vendor was notified and has not responded, and no fixed version exists because the project ships as a rolling release.
SQL injection in the Food Donation Form (fooddonateform.php) of kishor-23's Food Waste Management System allows remote attackers to manipulate the 'image-choice' argument passed to the insert routine, potentially reading or altering data in the backend database. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, E:P) confirms this is remotely reachable with no authentication or user interaction required, and publicly available exploit code exists, so the technical barrier to exploitation is low. However, the product is a niche hobby project distributed via a rolling-release repository with no version pinning and no vendor response to the issue report, meaning real-world exposure depends entirely on whether an operator has deployed and internet-exposed the application - assessed as a LOW priority despite the medium severity score.
SQL injection in the kishor-23 food-waste-management-system delivery/delivery.php Take Order Handler allows unauthenticated remote attackers to read or alter database contents by manipulating the order_id and delivery_person_id parameters. Publicly available exploit code exists (the flaw was reported via a public GitHub issue), and the project has not responded or issued a fix, with its rolling-release model meaning no patched version can be pinned. Real-world impact is limited by the niche deployment of this PHP application, though any internet-exposed instance is at risk of data disclosure or tampering.
Account takeover in ZITADEL affects instances running 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3: an unauthenticated remote attacker who knows a victim's login name can bind an external identity provider (IdP) identity they control to the victim's account and then sign in as that user, obtaining full control of the account and its data. The root cause is that the account-to-IdP linking flow neither verifies a primary authentication factor nor checks the caller's permission, and it is reachable through two distinct paths named in the advisory - identify-only Login V2 sessions and the User Service V2 AddIDPLink endpoint. The vendor has published a fix for the 4.x line in 4.17.3, no public exploit code was identified at time of analysis, and this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk artifact because exploitation requires only knowledge of the victim's login name and network reachability.
Blind SQL injection in the Unlimited Elements For Elementor plugin (versions up to 2.0.20) allows remote attackers to extract sensitive information from the WordPress database by inferring query results. The CVSS vector indicates unauthenticated exploitation (PR:N) with no user interaction, but the specific vulnerable endpoint and whether authentication is truly not required remain unconfirmed. No public exploit code has been identified, and the issue is not known to be actively exploited.
Stored cross-site scripting in WWBN AVideo 12.4 through 29.2.0 allows authenticated users with video-upload privileges to inject arbitrary HTML or JavaScript into video titles using doubly-encoded entities that survive the application's sanitizer. The injected payload executes when a victim views a crafted title on trending, gallery, embed, or playlist pages, enabling limited confidentiality and integrity impact (e.g., session token theft or actions as the victim) when a privileged user loads the page. Exploitation requires an authenticated uploader account and victim interaction; no public exploit identified at time of analysis, and the upstream commit c4b6ca95... provides a fix.
Stored cross-site scripting in WWBN AVideo through 29.2.0 allows an authenticated user who holds video upload permission to store a crafted trailer1 URL that is later rendered without escaping in the YouPHPFlix2 templates (BigVideo.php, BigVideoButtons.php, row_info.php) and in the channel playlist view (channelPlaylistItems.php). The injected value can break out of an onclick='flixFullScreen(...)' / avideoModalIframe(...) JavaScript string or an iframe src attribute, so any visitor who loads an affected page has attacker-controlled JavaScript executed in their browser context. Exploitation requires both a valid upload-capable account (PR:L) and victim interaction with a rendering page (UI:P), and the security impact is realized in the victim's browser rather than directly on the server; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor advisory and fix commit are already public.
Cross-organization account takeover in ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 allows an authenticated attacker who holds user-write permission in one organization to request a passkey or passwordless enrollment code for a user in a different organization on the same multi-tenant instance, then register their own authenticator and seize that account. The flaw is an improper authorization check (CWE-862): the server validates the organization named in the x-zitadel-orgid header instead of the target user's actual organization. Exploitation requires a deployment hosting at least two organizations plus a valid low-privileged user-write role, so single-organization instances and instances already on 3.4.15 or 4.17.1+ are not affected; no public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Unauthenticated retrieval of other users' stored private files is possible on WordPress multisite installations running the User Private Files plugin before 2.2.0. On multisite, the plugin's rewrite rule - the mechanism that routes file requests through its access check - is never reached, so private files can be fetched directly over HTTP with no credentials, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). Publicly available exploit code exists, but EPSS is only about 0.14% (3rd percentile) and a vendor fix is available in 2.2.0; impact is confined to confidentiality, with no write or code-execution capability.
Arbitrary modification of shipping information on WooCommerce orders is possible in the Razorpay for WooCommerce plugin before 4.8.8, allowing unauthenticated attackers to alter shipping details on orders they do not own. The flaw is a missing authorization check (CWE-639) on a REST API route used during checkout; publicly available exploit code exists, but EPSS is only 0.14% (3rd percentile), indicating low predicted exploitation likelihood, and the vendor has released a patch in version 4.8.8.
Account pre-hijacking in ZITADEL lets an unauthenticated remote attacker create a user record already bound to a victim's external identity provider subject, so that the victim's later, legitimate external login is transparently signed into the attacker-controlled account. Affected deployments are ZITADEL before 3.4.14 and 4.x before 4.16.2 that still run the legacy hosted Login V1 UI with at least one external IdP configured; exploitation also requires the attacker to know a valid IDPConfigID and the victim's ExternalUserID, which tempers the 9.3 CVSS 4.0 rating (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact). No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the lack of authentication, low attack complexity, and full account-takeover outcome make this a high-priority patch target.
Remote account takeover in ZITADEL versions before 4.17.1 allows unauthenticated attackers to compromise MFA-protected accounts, including administrator accounts, by reading OTP codes from server-action responses when the 'returnCode' OTP delivery type is enabled and the victim has both OTP-Email and OTP-SMS enrolled. The attack requires prior knowledge of the victim's login name and a non-default deployment configuration; instances using standard out-of-band OTP delivery or users without both factors are unaffected. No public exploit code or active exploitation has been identified at time of analysis, but the complete compromise of confidentiality, integrity, and availability of targeted identities warrants immediate patching.
TLS certificate verification is disabled by default in go-micro before 6.0.0, allowing an unauthenticated on-path attacker to impersonate services and intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic - including authentication tokens and credentials. This is a genuine, structurally serious design defect (CWE-295, CVSS 9.1) rather than an inflated score, but successful exploitation requires both a TLS-enabled deployment that relies on the shared TLS helper and the attacker achieving a man-in-the-middle network position (reflected by AC:H and AT:P). No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor corrected the default in go-micro 6.0.0.
The alexpechkarev/google-maps Laravel package through version 12.16 ships with TLS certificate verification turned off by default: the bundled config file sets ssl_verify_peer to FALSE, which is handed straight to CURLOPT_SSL_VERIFYPEER, so any Laravel application using the package without overriding the config will accept any certificate presented by the Google Maps web-service endpoint. An attacker who occupies an on-path position between the application server and Google (hostile Wi-Fi, rogue proxy, DNS or ARP spoofing, or a compromised upstream hop) can therefore terminate a fake TLS session, read the Google Maps API key carried in the request query string, and modify geocoding or map responses returned to the application. Exploitation requires no authentication and no user interaction, but the on-path vantage point is the limiting factor; no public exploit code was identified at time of analysis, and the vulnerability is not confirmed actively exploited (not in CISA KEV).
Improper TLS certificate validation in the gist RubyGem before 6.1.0 allows an on-path attacker to intercept and alter every HTTPS request the tool makes to the GitHub API, because the http_connection helper in lib/gist.rb unconditionally sets OpenSSL::SSL::VERIFY_NONE. The affected component is the defunkt:gist gem (CPE cpe:2.3:a:defunkt:gist:*:*:*:*:*:*:*:*, all versions below 6.1.0), and a successful man-in-the-middle attacker can present any certificate to harvest OAuth access tokens and login credentials and to read or modify the victim's gists; the CVSS 4.0 base score of 9.1 reflects high confidentiality and integrity impact with no privileges or user interaction required. Exploitation requires the attacker to already hold a privileged on-path network position (AC:H/AT:P in both the CVSS 4.0 vector and the independent CVSS 3.1 assessment AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry. A vendor fix is available in version 6.1.0.
Applications built on the gopay Go payment SDK before v1.5.119 accept any TLS certificate on outbound calls to payment provider APIs, because defaultClient() in pkg/xhttp/client.go hard-codes tls.Config{InsecureSkipVerify:true}. An unauthenticated attacker who already occupies an on-path/man-in-the-middle position between the application and the provider can therefore impersonate the payment API, read merchant credentials, signatures and transaction data, and tamper with payment, refund and order-query responses. The vendor has released a fix in v1.5.119 and there is no indication of confirmed active exploitation or publicly available exploit code at time of analysis; the headline CVSS 4.0 base score of 9.1 (Critical) reflects high confidentiality and integrity impact but is tempered by AC:H and AT:P, meaning exploitation requires prior network positioning rather than trivial remote access.
Authenticated WordPress users holding Author-level access or above can abuse the schema field default-value resolution feature in the Five Star Business Profile and Schema plugin (versions prior to 2.4.0, including 2.3.20 through 2.3.x) to pull sensitive server-side data into publicly rendered schema output, including other users' password hashes and arbitrary wp_options values, which unauthenticated visitors can then read. Publicly available exploit code exists, but CISA KEV does not list this issue and EPSS is only 0.14% (3rd percentile), so real-world exploitation pressure is low. This is a moderate, not high-urgency, issue: exploitation requires an existing Author or higher account, so sites that never grant that role to untrusted users are not practically exposed, though the vector is network-reachable (CVSS 4.9; CWE-200).
ZITADEL 4.x before 4.17.1 fails to check an organization's inactive state during Login V2 authentication, allowing users of a deactivated organization to continue signing in, create sessions, and obtain or refresh tokens if they already possess valid credentials, an existing session, or a refresh token. This authenticated access-control bypass primarily impacts offboarding and deprovisioning workflows, as it does not allow an arbitrary external attacker to gain access without prior valid credentials. No public exploit has been identified at time of analysis, and the flaw does not affect active organizations or bypass per-user deactivation.
Unauthenticated remote attackers who know a valid user's login name can enroll attacker-controlled multi-factor authentication factors - including TOTP, OTP-SMS, OTP-Email, and U2F - and overwrite the victim's verified phone number in ZITADEL deployments that expose the legacy hosted Login V1 UI. Affected versions are 3.x before 3.4.15 and 4.x before 4.17.1. The flaw resides in second-factor enrollment and initialization handlers that act on an identify-only session before any primary factor is verified, and it also lets attackers enumerate valid usernames through discrepant error responses. No public exploit code has been identified at time of analysis, but this is a genuine high-priority risk given the low prerequisite (only a login name) and high integrity impact (CVSS 8.8; assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:L/I:H/A:N).
Regular expression denial of service in mammoth.js 1.3.0 through 1.12.2 lets unauthenticated remote attackers stall the Node.js event loop by feeding a crafted .docx whose embedded style map contains an unterminated single-quoted string built from repeated backslash escape sequences. The flaw lives in the style-map tokeniser and triggers catastrophic regex backtracking, so any service that converts untrusted documents to HTML becomes trivially exhaustible, though exploitation is only realistic when the style map is drawn from attacker-supplied document content rather than static developer configuration. A vendor patch is available in 1.12.3; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Account takeover in ZITADEL affects deployments using the hosted Login V1 or V2 UI on versions 3.x before 3.4.14 and 4.x before 4.16.2. Unauthenticated attackers who know a valid login name can enroll an attacker-controlled passkey or other authenticator during an identify-only session, before any primary factor is verified, and then log in as the victim, bypassing passwords and MFA. No public exploit code has been identified at time of analysis, but the vulnerability is rated high risk due to its unauthenticated nature and low complexity.
Session hijacking and theft of external IdP tokens in ZITADEL 4.x before 4.17.3 and ZITADEL 3.x through 3.4.15 stem from IdP intent tokens that are encrypted without integrity protection, so an authenticated user (CVSS PR:L) can tamper with a token issued for their own login intent and have it accepted for another user's intent. An attacker who correctly predicts a victim's in-flight intent identifier and wins a timing race while the victim is completing an external IdP login can call /v2/idp_intents or /v2/sessions to steal the victim's IdP tokens or take over the resulting session. The impact is genuine but conditional rather than a mass-exploitable issue: it requires a valid authenticated account, an actively logging-in victim, correct identifier prediction, and a narrow race window (AC:H and AT:P in the assessed vector), and no public exploit identified at time of analysis; upgrading to 4.17.3 (or the corresponding fixed 3.x release) removes the condition.
Code execution as the logged-in user results when someone running the Twine 2 desktop (Electron) application on version 2.12.0 or earlier imports a crafted story file. The importStories() routine renders untrusted markup from the imported file inside the editor window, and a script smuggled in that markup can reach the twineElectron openWithScratchFile IPC bridge to write and then open a .bat file, yielding arbitrary code execution in the user's context. No public exploit code has been identified at time of analysis, and although no authentication is required (CVSS vector PR:N), exploitation depends on the victim actively importing the attacker's file, so delivery is a social-engineering problem; the CVSS 4.0 base score is 8.5 (High) with high confidentiality, integrity, and availability impact on the local host only.
Unauthenticated information disclosure in the StylemixThemes Cost Calculator Builder WordPress plugin (all versions through 4.0.17) lets remote attackers retrieve sensitive data that the plugin embeds in the responses it sends to clients. The independent assessment rates the issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable, low complexity, unauthenticated and requiring no user interaction, with confidentiality impact limited to Low - which is lower than the 7.5 feed-reported score and should be treated as the authoritative view. No public exploit code exists and no confirmed active exploitation has been observed (no public exploit identified at time of analysis), and the available data identifies no fixed version, so the only prerequisite is that the vulnerable plugin be installed and active at 4.0.17 or earlier.
Stored cross-site scripting in the Simple Shopping Cart WordPress plugin (versions before 5.2.6) allows an authenticated administrator to save malicious markup into plugin settings fields that are output without escaping on the plugin's admin settings page, where the script executes in the browser of an administrator who subsequently loads that page. The issue is most meaningful on WordPress multisite installations, where site administrators do not hold the unfiltered_html capability and would otherwise have their script-bearing input stripped, whereas on single-site installs where administrators already possess unfiltered_html the practical gain is negligible. Publicly available exploit code exists, but EPSS is only 0.15% (4th percentile) and there is no confirmed active exploitation; the vendor-released fix is version 5.2.6.
Reflected cross-site scripting in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions from the initial release through 2.0.20, allows a remote unauthenticated attacker to run arbitrary script in a victim's browser by tricking that victim into opening a crafted URL containing a malicious payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, PR:N so no attacker authentication, UI:R so victim interaction is mandatory). Patchstack scores this 7.1; our independent assessment concurs on the reflected, interaction-dependent nature of the flaw but rates availability impact as none rather than low. There is no CISA KEV entry and no public exploit code identified at time of analysis, and no EPSS score was supplied; the practical risk is highest when the induced victim is an authenticated WordPress administrator, because the injected script then executes inside an authenticated session.
Stored cross-site scripting in the Cozmoslabs TranslatePress WordPress plugin (versions up to and including 3.3.6) lets an attacker persist malicious script through a TranslatePress input field that is not neutralized when the translated page is generated, so the payload executes in the browser of any user who later views that rendered page. Exploitation is constrained by the required victim interaction (UI:R) and by the fact that the specific injection point and the role needed to store the payload are not identified in the available data; Patchstack scores it CVSS 7.1 with PR:N, while our independent assessment uses PR:L, reflecting that persistence typically requires at least low-privileged authenticated access such as a translator or editor account. Impact is limited to Low confidentiality, integrity, and availability with a scope change, and no public exploit identified at time of analysis.
Reflected cross-site scripting in VeronaLabs WP Statistics through 14.16.14 lets unauthenticated remote attackers inject script that executes in a victim's browser when the victim clicks a crafted link. Exploitation requires user interaction and runs in the victim's session context, so impact is greatest when an authenticated administrator is lured into triggering the payload; there is no public exploit identified at time of analysis. The independent assessment rates confidentiality and integrity impact as low and availability impact as none, with scope change, consistent with a social-engineering-gated reflected XSS flaw rather than silent remote compromise.
Stored cross-site scripting in the Kadence Blocks WordPress plugin (Gutenberg Blocks by Kadence Blocks, versions from n/a through 3.7.11.1) allows a low-privileged content author to persist malicious script inside a Kadence/Gutenberg block, which then executes in the browser of any user who views the affected page or post - including an administrator. Patchstack rates it CVSS 7.1 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L; the independent assessment refines this to AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because reaching the vulnerable editing surface realistically requires an account with post/page authoring capability, and no public exploit code has been identified at time of analysis. Impact is bounded to script execution in the victim's browser (session theft, admin-side actions via the victim's session, defacement) rather than direct server compromise, and it depends on the plugin being installed and active.
A time-of-check/time-of-use (TOCTOU) flaw in Crossplane's crossplane-runtime package manager (pkg/xpkg/client.go) lets a malicious OCI registry defeat cosign package signature verification, causing an unsigned or tampered package to be installed in place of the verified one. Exploitation requires an unusual combination of non-default operational choices: signature verification enabled through the ImageConfig mechanism, packages installed by mutable tag reference (such as a semantic version) instead of an immutable digest, and installation from a registry the operator does not control, where the attacker can serve a signed image for the cosign verifier and a different unsigned image moments later for the fetch. Impact is limited to integrity - an unverified package is pulled and installed - with no direct confidentiality or availability effect, and no public exploit code has been identified at time of analysis. Fixes are available in crossplane-runtime v2.2.3, v2.3.3, and v2.4.0-rc.1.
Information disclosure in SiYuan before 3.8.5 allows publish-mode readers to extract backlink block IDs (refIDs) and reference counts (refCount) belonging to password-protected or publish-disabled documents by POSTing a published document ID to /api/block/getDocInfo or /api/block/getDocsInfo. The attacker only needs network reachability to the publish endpoint and knowledge of a valid published document ID - no authentication is required per the CVSS vector (PR:N) - and the exposed data is metadata about hidden referencing blocks rather than the protected documents' content. Exploitation requires the instance to actually be running in publish mode with at least one published document that is referenced by a protected or unpublished note; there is no public exploit identified at time of analysis, and a vendor fix is available in SiYuan 3.8.5.
Weak MD5-based password hashing in YzmCMS through 7.6 - specifically the Password function in /common/function/system.func.php - lets an attacker who already holds stored password hashes recover plaintext credentials far more cheaply than a proper password-storage scheme would allow, because no salt and no computationally expensive key-derivation step are applied. The weakness is not a directly reachable network code path: it only accelerates offline cracking after hashes have been exfiltrated via database access, a leaked/exposed backup, or a separate injection flaw, so the impact is confined to credential confidentiality with no integrity or availability effect. Publicly available exploit code exists (no CISA KEV listing), and although the CVSS 4.0 base score is 6.3, the high attack complexity and confidentiality-only impact converge on low real-world priority; no vendor-released patch is expected before the planned March 2027 release.
AIIR (invariant-systems-ai aiir) versions prior to 1.7.0 contain fail-open verification and policy gate flaws that allow unauthenticated remote attackers to bypass signature verification controls. When a downstream consumer relies on an affected gate-such as the require_signing policy gate, the CI verification path, the release-verification gate, or a signature-verification path-an attacker can supply an unsigned, forged-bundle, or non-conforming receipt and the gate will falsely report 'verified' or success. This results in low integrity impact (no confidentiality or availability impact) and affects only released versions below 1.7.0; no public exploit code has been identified at time of analysis, and the vulnerability is fixed in 1.7.0.
Arbitrary file read via path traversal in RainyGao DocSys through version 2.02.85 lets an authenticated, low-privileged remote attacker read files outside the intended document directory by supplying crafted path/fileName values to the /Doc/doGetTmpFile.do endpoint handled by DocController.doGetTmp; publicly available exploit code exists and the vendor has not responded to the issue report. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms the confidentiality-only, read-only impact and the requirement for a valid low-privileged session, so this is a LOW-to-MODERATE risk rather than an urgent priority, with no confirmed active exploitation (CISA KEV is not applicable) and deployment of DocSys being niche.
Authorization bypass (IDOR) in Omega Solution's CoinEx Crypto 2025 allows an authenticated low-privilege user to read other customers' currency records by tampering with the 'ID' argument on the Customer Information API endpoint /customer-currency/. Exploitation is remote, requires a valid low-privilege account, and yields limited confidentiality impact only - no data modification or service disruption (CVSS 3.1 5.3/5.3, PR:L, C:L). Publicly available exploit code exists (a VulDB PoC referenced on GitHub), but there is no confirmation of active exploitation in the wild, and realistic exposure is minimal because the product appears retired with no functioning vendor site and an unresponsive vendor.
An authenticated low-privilege user of Omega Solution's CoinEx Crypto 2025 web application can bypass authorization on the /customer/ Customer Profile API by manipulating the ID argument, allowing one customer's account to access or modify another customer's profile record - a classic IDOR (CWE-639). The attack is remote, requires no user interaction and minimal complexity, though it does require a valid low-privilege account first; impact is limited to low confidentiality, integrity and availability per the assessed CVSS:3.1 vector (5.3 Medium). Publicly available exploit code exists (a GitHub PoC issue), but there is no indication of confirmed active exploitation, and because the vendor's website no longer exists and the vendor did not respond to disclosure, this appears to be a retired product with few, if any, live deployments and no vendor-released patch.
Authenticated information disclosure in Omega Solution CoinEx Crypto 2025 allows a low-privilege user to retrieve support-ticket data by manipulating the status, page, or count parameters in the /ticket/customer API endpoint. The affected product appears retired, its vendor site is no longer available, and the vendor did not respond to disclosure attempts, so no vendor-released patch is identified. Publicly available exploit code exists, but exploitation requires valid credentials and only exposes read-only ticket information, keeping real-world risk low to moderate; no confirmed active exploitation (CISA KEV) is reported.
SQL injection in the admin order-assignment handler of kishor-23's food-waste-management-system lets a remote user who holds an authenticated session on the admin interface manipulate the order_id and delivery_person_id parameters in admin/admin.php to inject arbitrary SQL, giving low-impact confidentiality, integrity, and availability effects on the backend database. Because the project follows a rolling release model and publishes no version tags, every deployment of this codebase is potentially affected, and no patched release is available - the maintainer was notified via a public GitHub issue but has not responded. Publicly available exploit code exists (linked from the upstream issue tracker), and the EPSS-style exploit-maturity flag in the vendor vector (E:P) indicates proof-of-concept maturity, but there is no confirmed active exploitation (CISA KEV) at time of analysis; realistic exposure is limited to the narrow set of installations of this hobby/student project.
Stored cross-site scripting in the Ticket Attachment Upload functionality of Omega Solution CoinEx Crypto 2025 allows an authenticated low-privilege user to inject a persistent script payload through the /user/ticket endpoint, which then executes in the browser of any user - typically a support agent or ticket viewer - who opens the affected ticket. Exploitation requires both valid authentication (CVSS PR:L) and passive victim interaction (UI:P), which limits realistic impact, but publicly available exploit code exists on GitHub (PoCVulDb issue #27) and there is no indication of active exploitation in the wild. The vendor was contacted early but never responded, and the product's website no longer exists, suggesting the product is retired or abandoned and unlikely to receive a fix.
Path traversal in the Drogon C++ web framework's static file router (StaticFileRouter::route) lets unauthenticated remote attackers read files outside the configured document root on Windows deployments up to and including 1.9.13-1 and 10.0-beta.3. The flaw is limited to information disclosure - no integrity or availability impact - but publicly available exploit code exists and the vendor was contacted early and did not respond, so no official fix is confirmed. Our assessment rates this as a moderate, non-emergency priority: the platform must be Windows, static-file serving must be enabled and reachable, and the payoff is bounded to files readable by the server process; there is no confirmation of active exploitation (CISA KEV).