Remote unauthenticated OS command injection in AhsayCBS 10.3.0 through 10.3.2 lets an attacker execute arbitrary operating-system commands on the backup server by manipulating the 'random' argument of the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do. The flaw is scored 10.0 under CVSS 4.0 (and 9.8 under CVSS 3.1, AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), is confirmed actively exploited (CISA KEV), and has been assigned a public PoC reference that is not verified as working exploit code, with EPSS at 1.84% (78th percentile). Successful exploitation yields full compromise of confidentiality, integrity and availability of the backup server and, given the CVSS 4.0 scope-change metrics, likely of dependent systems; version 10.3.4 resolves the issue.
Code injection in InternLM MindSearch 0.1.0 allows unauthenticated remote attackers to execute arbitrary code through the Planner Agent component, specifically by manipulating the inputs argument processed by ExecutionAction.run in mindsearch/agent/graph.py. The issue is rated critical (CVSS 9.3 per the CVSS 4.0 vector; the independent assessment likewise has PR:N/UI:N with high confidentiality, integrity, and availability impact), and publicly available exploit code exists. The vendor was contacted but did not respond, no vendor-released patch has been identified, and risk is concentrated in internet-reachable or otherwise accessible self-hosted MindSearch 0.1.0 deployments.
Account takeover in ZITADEL affects instances running 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3: an unauthenticated remote attacker who knows a victim's login name can bind an external identity provider (IdP) identity they control to the victim's account and then sign in as that user, obtaining full control of the account and its data. The root cause is that the account-to-IdP linking flow neither verifies a primary authentication factor nor checks the caller's permission, and it is reachable through two distinct paths named in the advisory - identify-only Login V2 sessions and the User Service V2 AddIDPLink endpoint. The vendor has published a fix for the 4.x line in 4.17.3, no public exploit code was identified at time of analysis, and this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk artifact because exploitation requires only knowledge of the victim's login name and network reachability.
Blind SQL injection in the Unlimited Elements For Elementor plugin (versions up to 2.0.20) allows remote attackers to extract sensitive information from the WordPress database by inferring query results. The CVSS vector indicates unauthenticated exploitation (PR:N) with no user interaction, but the specific vulnerable endpoint and whether authentication is truly not required remain unconfirmed. No public exploit code has been identified, and the issue is not known to be actively exploited.
Stored cross-site scripting in WWBN AVideo 12.4 through 29.2.0 allows authenticated users with video-upload privileges to inject arbitrary HTML or JavaScript into video titles using doubly-encoded entities that survive the application's sanitizer. The injected payload executes when a victim views a crafted title on trending, gallery, embed, or playlist pages, enabling limited confidentiality and integrity impact (e.g., session token theft or actions as the victim) when a privileged user loads the page. Exploitation requires an authenticated uploader account and victim interaction; no public exploit identified at time of analysis, and the upstream commit c4b6ca95... provides a fix.
Stored cross-site scripting in WWBN AVideo through 29.2.0 allows an authenticated user who holds video upload permission to store a crafted trailer1 URL that is later rendered without escaping in the YouPHPFlix2 templates (BigVideo.php, BigVideoButtons.php, row_info.php) and in the channel playlist view (channelPlaylistItems.php). The injected value can break out of an onclick='flixFullScreen(...)' / avideoModalIframe(...) JavaScript string or an iframe src attribute, so any visitor who loads an affected page has attacker-controlled JavaScript executed in their browser context. Exploitation requires both a valid upload-capable account (PR:L) and victim interaction with a rendering page (UI:P), and the security impact is realized in the victim's browser rather than directly on the server; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor advisory and fix commit are already public.
Cross-organization account takeover in ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 allows an authenticated attacker who holds user-write permission in one organization to request a passkey or passwordless enrollment code for a user in a different organization on the same multi-tenant instance, then register their own authenticator and seize that account. The flaw is an improper authorization check (CWE-862): the server validates the organization named in the x-zitadel-orgid header instead of the target user's actual organization. Exploitation requires a deployment hosting at least two organizations plus a valid low-privileged user-write role, so single-organization instances and instances already on 3.4.15 or 4.17.1+ are not affected; no public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Account pre-hijacking in ZITADEL lets an unauthenticated remote attacker create a user record already bound to a victim's external identity provider subject, so that the victim's later, legitimate external login is transparently signed into the attacker-controlled account. Affected deployments are ZITADEL before 3.4.14 and 4.x before 4.16.2 that still run the legacy hosted Login V1 UI with at least one external IdP configured; exploitation also requires the attacker to know a valid IDPConfigID and the victim's ExternalUserID, which tempers the 9.3 CVSS 4.0 rating (independent assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity impact). No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, but the lack of authentication, low attack complexity, and full account-takeover outcome make this a high-priority patch target.
Remote account takeover in ZITADEL versions before 4.17.1 allows unauthenticated attackers to compromise MFA-protected accounts, including administrator accounts, by reading OTP codes from server-action responses when the 'returnCode' OTP delivery type is enabled and the victim has both OTP-Email and OTP-SMS enrolled. The attack requires prior knowledge of the victim's login name and a non-default deployment configuration; instances using standard out-of-band OTP delivery or users without both factors are unaffected. No public exploit code or active exploitation has been identified at time of analysis, but the complete compromise of confidentiality, integrity, and availability of targeted identities warrants immediate patching.
TLS certificate verification is disabled by default in go-micro before 6.0.0, allowing an unauthenticated on-path attacker to impersonate services and intercept or modify gRPC transport, HTTP and RabbitMQ broker, and Consul or etcd registry traffic - including authentication tokens and credentials. This is a genuine, structurally serious design defect (CWE-295, CVSS 9.1) rather than an inflated score, but successful exploitation requires both a TLS-enabled deployment that relies on the shared TLS helper and the attacker achieving a man-in-the-middle network position (reflected by AC:H and AT:P). No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor corrected the default in go-micro 6.0.0.
The alexpechkarev/google-maps Laravel package through version 12.16 ships with TLS certificate verification turned off by default: the bundled config file sets ssl_verify_peer to FALSE, which is handed straight to CURLOPT_SSL_VERIFYPEER, so any Laravel application using the package without overriding the config will accept any certificate presented by the Google Maps web-service endpoint. An attacker who occupies an on-path position between the application server and Google (hostile Wi-Fi, rogue proxy, DNS or ARP spoofing, or a compromised upstream hop) can therefore terminate a fake TLS session, read the Google Maps API key carried in the request query string, and modify geocoding or map responses returned to the application. Exploitation requires no authentication and no user interaction, but the on-path vantage point is the limiting factor; no public exploit code was identified at time of analysis, and the vulnerability is not confirmed actively exploited (not in CISA KEV).
Improper TLS certificate validation in the gist RubyGem before 6.1.0 allows an on-path attacker to intercept and alter every HTTPS request the tool makes to the GitHub API, because the http_connection helper in lib/gist.rb unconditionally sets OpenSSL::SSL::VERIFY_NONE. The affected component is the defunkt:gist gem (CPE cpe:2.3:a:defunkt:gist:*:*:*:*:*:*:*:*, all versions below 6.1.0), and a successful man-in-the-middle attacker can present any certificate to harvest OAuth access tokens and login credentials and to read or modify the victim's gists; the CVSS 4.0 base score of 9.1 reflects high confidentiality and integrity impact with no privileges or user interaction required. Exploitation requires the attacker to already hold a privileged on-path network position (AC:H/AT:P in both the CVSS 4.0 vector and the independent CVSS 3.1 assessment AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry. A vendor fix is available in version 6.1.0.
Applications built on the gopay Go payment SDK before v1.5.119 accept any TLS certificate on outbound calls to payment provider APIs, because defaultClient() in pkg/xhttp/client.go hard-codes tls.Config{InsecureSkipVerify:true}. An unauthenticated attacker who already occupies an on-path/man-in-the-middle position between the application and the provider can therefore impersonate the payment API, read merchant credentials, signatures and transaction data, and tamper with payment, refund and order-query responses. The vendor has released a fix in v1.5.119 and there is no indication of confirmed active exploitation or publicly available exploit code at time of analysis; the headline CVSS 4.0 base score of 9.1 (Critical) reflects high confidentiality and integrity impact but is tempered by AC:H and AT:P, meaning exploitation requires prior network positioning rather than trivial remote access.