Stored cross-site scripting in the Simple Shopping Cart WordPress plugin (versions before 5.2.6) allows an authenticated administrator to save malicious markup into plugin settings fields that are output without escaping on the plugin's admin settings page, where the script executes in the browser of an administrator who subsequently loads that page. The issue is most meaningful on WordPress multisite installations, where site administrators do not hold the unfiltered_html capability and would otherwise have their script-bearing input stripped, whereas on single-site installs where administrators already possess unfiltered_html the practical gain is negligible. Publicly available exploit code exists, but EPSS is only 0.15% (4th percentile) and there is no confirmed active exploitation; the vendor-released fix is version 5.2.6.
Weak MD5-based password hashing in YzmCMS through 7.6 - specifically the Password function in /common/function/system.func.php - lets an attacker who already holds stored password hashes recover plaintext credentials far more cheaply than a proper password-storage scheme would allow, because no salt and no computationally expensive key-derivation step are applied. The weakness is not a directly reachable network code path: it only accelerates offline cracking after hashes have been exfiltrated via database access, a leaked/exposed backup, or a separate injection flaw, so the impact is confined to credential confidentiality with no integrity or availability effect. Publicly available exploit code exists (no CISA KEV listing), and although the CVSS 4.0 base score is 6.3, the high attack complexity and confidentiality-only impact converge on low real-world priority; no vendor-released patch is expected before the planned March 2027 release.
Arbitrary file read via path traversal in RainyGao DocSys through version 2.02.85 lets an authenticated, low-privileged remote attacker read files outside the intended document directory by supplying crafted path/fileName values to the /Doc/doGetTmpFile.do endpoint handled by DocController.doGetTmp; publicly available exploit code exists and the vendor has not responded to the issue report. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms the confidentiality-only, read-only impact and the requirement for a valid low-privileged session, so this is a LOW-to-MODERATE risk rather than an urgent priority, with no confirmed active exploitation (CISA KEV is not applicable) and deployment of DocSys being niche.
Authorization bypass (IDOR) in Omega Solution's CoinEx Crypto 2025 allows an authenticated low-privilege user to read other customers' currency records by tampering with the 'ID' argument on the Customer Information API endpoint /customer-currency/. Exploitation is remote, requires a valid low-privilege account, and yields limited confidentiality impact only - no data modification or service disruption (CVSS 3.1 5.3/5.3, PR:L, C:L). Publicly available exploit code exists (a VulDB PoC referenced on GitHub), but there is no confirmation of active exploitation in the wild, and realistic exposure is minimal because the product appears retired with no functioning vendor site and an unresponsive vendor.
An authenticated low-privilege user of Omega Solution's CoinEx Crypto 2025 web application can bypass authorization on the /customer/ Customer Profile API by manipulating the ID argument, allowing one customer's account to access or modify another customer's profile record - a classic IDOR (CWE-639). The attack is remote, requires no user interaction and minimal complexity, though it does require a valid low-privilege account first; impact is limited to low confidentiality, integrity and availability per the assessed CVSS:3.1 vector (5.3 Medium). Publicly available exploit code exists (a GitHub PoC issue), but there is no indication of confirmed active exploitation, and because the vendor's website no longer exists and the vendor did not respond to disclosure, this appears to be a retired product with few, if any, live deployments and no vendor-released patch.
Authenticated information disclosure in Omega Solution CoinEx Crypto 2025 allows a low-privilege user to retrieve support-ticket data by manipulating the status, page, or count parameters in the /ticket/customer API endpoint. The affected product appears retired, its vendor site is no longer available, and the vendor did not respond to disclosure attempts, so no vendor-released patch is identified. Publicly available exploit code exists, but exploitation requires valid credentials and only exposes read-only ticket information, keeping real-world risk low to moderate; no confirmed active exploitation (CISA KEV) is reported.
SQL injection in the admin order-assignment handler of kishor-23's food-waste-management-system lets a remote user who holds an authenticated session on the admin interface manipulate the order_id and delivery_person_id parameters in admin/admin.php to inject arbitrary SQL, giving low-impact confidentiality, integrity, and availability effects on the backend database. Because the project follows a rolling release model and publishes no version tags, every deployment of this codebase is potentially affected, and no patched release is available - the maintainer was notified via a public GitHub issue but has not responded. Publicly available exploit code exists (linked from the upstream issue tracker), and the EPSS-style exploit-maturity flag in the vendor vector (E:P) indicates proof-of-concept maturity, but there is no confirmed active exploitation (CISA KEV) at time of analysis; realistic exposure is limited to the narrow set of installations of this hobby/student project.
Stored cross-site scripting in the Ticket Attachment Upload functionality of Omega Solution CoinEx Crypto 2025 allows an authenticated low-privilege user to inject a persistent script payload through the /user/ticket endpoint, which then executes in the browser of any user - typically a support agent or ticket viewer - who opens the affected ticket. Exploitation requires both valid authentication (CVSS PR:L) and passive victim interaction (UI:P), which limits realistic impact, but publicly available exploit code exists on GitHub (PoCVulDb issue #27) and there is no indication of active exploitation in the wild. The vendor was contacted early but never responded, and the product's website no longer exists, suggesting the product is retired or abandoned and unlikely to receive a fix.
Laradock through 20.4 fetches code during its workspace Dockerfile build without verifying integrity, allowing a network-positioned attacker to substitute or intercept that download and influence the build with limited confidentiality, integrity, and availability impact. Exploitation requires a user to actively start the build (UI:P) and is rated high complexity, and while publicly available exploit code exists, no active exploitation has been confirmed (not in CISA KEV). The issue is low priority given the network-positioning prerequisite, build-time-only window, and limited impact.
Zitadel deployments before 4.16.2 expose a server-side request forgery (SSRF) path in the organization custom-domain HTTP verification flow, where the challenge fetch uses Go's default http.Get rather than Zitadel's SSRF-protected HTTP client. An authenticated principal holding privileges to create or manage an organization and register a custom domain can point DNS/HTTP for that domain at loopback, RFC1918/internal, or link-local cloud metadata addresses (e.g., 169.254.169.254), causing the Zitadel server to issue requests to those targets and enabling port scanning and internal network mapping. Impact is limited to server-side reconnaissance - there is no data modification, and confidentiality exposure depends on what internal or metadata services are actually reachable from the instance - and no public exploit code has been identified at time of analysis; EPSS and KEV signals are absent, and the scored severity is low (CVSS v4.0 base 2.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).
Man-in-the-middle interception of the cron.php web-worker restart request in Cockpit CMS 2.12.0 through 2.14.0 allows an on-path attacker to steal the worker/web/token value and then start the web worker themselves. The restart request is sent to the configured site_url with TLS peer verification disabled, so any certificate presented on that outbound path is accepted; the attacker must already hold an adjacent/on-path position and must catch a restart in flight, which is why the issue is rated low severity (CVSS 2.3, our assessed CVSS:3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor fix is available in 2.14.1.
SQL injection in the Admin Medal Moderation module of Comsenz Discuz! X5.0 affects builds X5.0-20260801, X5.0-20260820 and X5.0-20260910, where the modmedalsubmit() handler in upload/source/app/admin/child/medals/mod.php passes the user-supplied 'delete' argument into a SQL query without proper sanitization. Exploitation requires an authenticated administrator session on the admin panel (CVSS PR:H) and the attack is deliverable remotely, so the practical risk is moderate rather than top-priority despite network reachability. Publicly available exploit code exists (CVSS 4.0 E:P), but there is no evidence of confirmed active exploitation and the issue is not in CISA KEV; the vendor was contacted about the disclosure and did not respond, and no vendor-released patch has been identified at time of analysis.