SQL injection in mooSocial versions up to 3.2.4 allows remote, unauthenticated attackers to manipulate the 'rating' parameter on the /stores/all-products endpoint, potentially leading to unauthorized data access or modification. This moderate-risk vulnerability has a publicly available exploit, but there is no confirmation of active exploitation in the wild. The vendor was contacted but did not respond, and no official patch is available, making mitigation challenging for exposed instances.
Authentication token forgery in topoteretes cognee through 1.5.4 lets a remote attacker who can reach the API mint valid JWTs without any account, because the application signs tokens with the publicly known literal "super_secret" whenever the FASTAPI_USERS_JWT_SECRET environment variable is left unset. Because that fallback is the shipped default behavior, unconfigured or default deployments are exposed, and the same pattern affects the password-reset and email-verification token secrets; successful forgery yields full compromise of confidentiality, integrity, and availability of the cognee instance. Upgrading to 1.6.0 removes the shared fallback entirely and replaces it with a per-process random secret; no public exploit code was identified at time of analysis, and CISA KEV does not list this issue.
Cross-organization information disclosure in ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 allows an authenticated user who holds an organization-scoped user.read permission to retrieve the authentication method types registered by users in other organizations by calling GET /v2/users/{userId}/authentication_methods. The User Service API validates user.read against the caller's own organization rather than the organization that owns the target user (CWE-863 incorrect authorization), so tenant isolation is broken on multi-organization deployments. Exploitation requires a valid account with org-scoped user.read (PR:L per the assessed vector) and knowledge or enumeration of foreign-org user IDs; impact is limited to method-type disclosure with no credential, token, or account modification exposure, and no public exploit code was identified at time of analysis. CVSS 4.0 base 5.3 and our independent assessment of 5.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) agree that this is a medium-severity confidentiality issue.
Cross-account secret replication in devopspolis secrets-replicator up to and including 0.4.0 silently drops the configured External ID, so the confused-deputy safeguard that operators believe protects the destination role is never actually enforced. An attacker who already holds or can influence an AWS principal that is permitted to assume the destination role (CVSS PR:L, requiring some standing in the trust relationship) can therefore assume it without supplying the External ID, resulting in incorrect permission assignment and limited confidentiality and integrity impact (CVSS 5.3, CWE-732). The flaw affects only deployments that use cross-account AssumeRole replication and rely on external_id for isolation; single-account deployments and configurations that never used an External ID are not impacted. Patches ship in v0.5.0 (commit b42239405fbf4fae3c3f0048fc0b4225112edceb) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Privilege escalation in ezBookkeeping 1.2.0 through 2.0.0 lets an attacker who already holds a short-lived and/or IP-restricted API token exchange it for a full 30-day normal session token by calling POST /api/v1/tokens/refresh.json, because TokenRefreshHandler never verifies the token type before minting a replacement. The resulting session token outlives the original API token's expiry and its IP allowlist, though impact stays within the compromised account's own scope (low confidentiality and integrity impact). Rated CVSS 5.3 (CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N), it requires a prior valid API token (authenticated) and is fully remediated in v2.0.1; no public exploit code or confirmed active exploitation was identified at time of analysis.
Laradock through 20.4 fetches code during its workspace Dockerfile build without verifying integrity, allowing a network-positioned attacker to substitute or intercept that download and influence the build with limited confidentiality, integrity, and availability impact. Exploitation requires a user to actively start the build (UI:P) and is rated high complexity, and while publicly available exploit code exists, no active exploitation has been confirmed (not in CISA KEV). The issue is low priority given the network-positioning prerequisite, build-time-only window, and limited impact.
Out-of-bounds read in NASA cFS through 7.0.1 can be triggered by a remote attacker who already holds high privileges and can supply a crafted input file name to the CFE_FS_ParseInputFileNameEx parser, producing only a low availability impact with no confidentiality or integrity loss. The flaw is in the cfe file-system module (cfe/modules/fs/fsw/src/cfe_fs_api.c), and the only identified fix is an upstream pull request that awaits acceptance, so no vendor-blessed patched release is confirmed. No public exploit identified at time of analysis.
Stored cross-site scripting in YesWiki's Bazar 'valeur' action (all versions before 4.6.7) allows an authenticated page editor to point the action's 'url' argument at an attacker-controlled HTTP(S) server whose returned BAZ_fiche_titre markup - for example an <img> tag carrying an onerror handler - is rendered without escaping, so the injected script executes in the browser of every visitor who views the affected page. The impact is constrained by its prerequisites: the attacker needs an existing editor-level account (PR:L) and must induce victim page views (UI:R), yielding low confidentiality and integrity impact with changed scope, consistent with the medium CVSS 4.0 base score of 5.1 and the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. This is a genuine but moderate-priority CWE-79 issue; no public exploit identified at time of analysis, and the vendor has released a patch in YesWiki 4.6.7.
Sensitive information embedded in outbound responses from the Mindio Magic MCP WordPress plugin (versions through 0.5.6) can be retrieved by a remote, authenticated attacker holding only low-level privileges on the affected site (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The flaw is a CWE-201 'Insertion of Sensitive Information Into Sent Data' condition, meaning the plugin places data into responses it transmits rather than leaking it through a separate storage or traversal bug. Impact is limited to confidentiality (information disclosure) with no integrity or availability effect, and there is no public exploit identified at time of analysis and no CISA KEV listing, so real-world urgency is low-to-moderate. The CVSS base score of 4.3 reflects that an attacker must already possess a valid WordPress account on the target site before the disclosure is reachable.
Zitadel deployments before 4.16.2 expose a server-side request forgery (SSRF) path in the organization custom-domain HTTP verification flow, where the challenge fetch uses Go's default http.Get rather than Zitadel's SSRF-protected HTTP client. An authenticated principal holding privileges to create or manage an organization and register a custom domain can point DNS/HTTP for that domain at loopback, RFC1918/internal, or link-local cloud metadata addresses (e.g., 169.254.169.254), causing the Zitadel server to issue requests to those targets and enabling port scanning and internal network mapping. Impact is limited to server-side reconnaissance - there is no data modification, and confidentiality exposure depends on what internal or metadata services are actually reachable from the instance - and no public exploit code has been identified at time of analysis; EPSS and KEV signals are absent, and the scored severity is low (CVSS v4.0 base 2.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
Man-in-the-middle interception of the cron.php web-worker restart request in Cockpit CMS 2.12.0 through 2.14.0 allows an on-path attacker to steal the worker/web/token value and then start the web worker themselves. The restart request is sent to the configured site_url with TLS peer verification disabled, so any certificate presented on that outbound path is accepted; the attacker must already hold an adjacent/on-path position and must catch a restart in flight, which is why the issue is rated low severity (CVSS 2.3, our assessed CVSS:3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor fix is available in 2.14.1.
SQL injection in the Admin Medal Moderation module of Comsenz Discuz! X5.0 affects builds X5.0-20260801, X5.0-20260820 and X5.0-20260910, where the modmedalsubmit() handler in upload/source/app/admin/child/medals/mod.php passes the user-supplied 'delete' argument into a SQL query without proper sanitization. Exploitation requires an authenticated administrator session on the admin panel (CVSS PR:H) and the attack is deliverable remotely, so the practical risk is moderate rather than top-priority despite network reachability. Publicly available exploit code exists (CVSS 4.0 E:P), but there is no evidence of confirmed active exploitation and the issue is not in CISA KEV; the vendor was contacted about the disclosure and did not respond, and no vendor-released patch has been identified at time of analysis.