Server-side request forgery in O2OA up to and including 10.0.1-ce lets an authenticated, low-privileged user force the application server to issue outbound HTTP requests to attacker-chosen destinations by supplying a crafted fileUrl argument to the ActionUploadExcelWithUrl handler in the General Module. Publicly available exploit code exists and the flaw is remotely reachable, but impact is limited to low confidentiality exposure (CVSS 3.1 base of 2.1, PR:L, C:L with no integrity or availability effect), so this is a low-priority issue despite the SSRF classification. The vendor was notified through a GitHub issue report and has not responded, so no patched release is identified at time of analysis.
Authorization bypass in the kishor-23 Food Waste Management System (a PHP web application) allows an authenticated low-privilege user to send a crafted remote request to admin/admin.php and manipulate the 'Name' argument processed by the Role Attribute Handler, thereby obtaining elevated role attributes and reaching administrative functionality across multiple endpoints. Upstream has not responded to the early issue report, the project does not use versioning, and publicly available exploit code exists (CVSS 4.0 E:P proof-of-concept), though the issue is not listed in CISA KEV and no active exploitation is confirmed. Consistent with our independent assessment, impact is limited to low confidentiality, integrity and availability loss, so this is a low-priority but still remediable flaw that requires only a standard authenticated account and no user interaction.
Arbitrary shell command execution in the Chainguard Academy (edu) integrate-platform-docs composite GitHub Action requires control of the project_id or storage_bucket inputs and occurs because those values were substituted directly into Bash gcloud storage cp commands. The practical exposure is narrow: the only in-repository caller passed repository secrets and ran on trusted triggers, so untrusted input was not known to reach the vulnerable steps, and abuse requires write or maintainer control over the CI configuration rather than a remote unauthenticated path. A vendor fix is available via commit fb0efb2537d326ab18c07d620875b8ed2a4b39f3, no public exploit was identified, and the independent assessment rates this as a low-priority issue (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N).
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to inject arbitrary SQL through the txtname parameter on the admin-only Symptom Creation page (/Admin/add_symptom.php), corrupting or disclosing the underlying MySQL database. The flaw stems from improper use of mysqli_real_escape_string during query construction (CWE-89), and because the vulnerable endpoint sits behind the admin login (CVSS PR:H), an attacker must first hold administrator credentials; the assessed impact is limited confidentiality, integrity, and availability loss (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists and has been published, elevating practical risk for any deployment where admin credentials are weak, shared, or exposed, but this is not an unauthenticated or pre-auth remote compromise and should be treated as a comparatively low-priority finding.
SQL injection in the admin Drug Creation routine of SourceCodester Drug Recommendation System 1.0 lets an attacker with an existing administrator session read and tamper with the application's database by submitting crafted values through the txtname, cmdtype, txtusage, txtsideeffect, or cmdcontraindication parameters of /Admin/add_drug.php. The hard prerequisite is prior admin-level access (CVSS PR:H / the assessed CVSS:3.1 vector PR:H), so this is not exploitable by an anonymous remote user against a default installation, and impact is bounded to partial confidentiality, integrity and availability of the application database. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P), although there is no indication of confirmed active exploitation (not in CISA KEV), and the issue should be treated as low-to-moderate priority relative to the SQL injection classification.
SQL injection in SourceCodester Drug Recommendation System 1.0 allows an authenticated administrator to manipulate the ID parameter of /Admin/edit_class.php and execute arbitrary SQL against the underlying database. The vulnerability is network-reachable with low complexity but requires high privileges (PR:H), limiting practical exploitation to malicious insiders or attackers who have already compromised an admin account; a publicly available exploit code exists, though no active exploitation has been confirmed. Given the niche product and the high-privilege precondition, this is a low-to-moderate priority issue that is unlikely to warrant emergency patching in most environments.
Authenticated code injection in osCommerce 2.x through 2.3.4.1 allows an attacker who already holds administrator credentials to manipulate the 'module' argument processed by the include logic in admin/newsletters.php (Newsletter Management component), causing attacker-influenced code to be injected into the PHP execution path. Because the assessed vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L, only users with valid admin-level access to the backend can reach the vulnerable code, and the realistic impact is limited to low confidentiality, integrity and availability effects rather than full server takeover. Publicly available exploit code exists per the CVSS 4.0 E:P metric and the vendor disclosure, but there is no confirmed active exploitation (no CISA KEV listing), and the project has not responded to the issue report, so no fixed release is currently published.
SourceCodester Drug Recommendation System 1.0 does not encrypt passwords submitted through the Password Handler in Admin/add_user.php, so an authenticated administrator can cause sensitive password data to be handled without cryptographic protection. Exploitation requires a high-privilege admin session (PR:H) and yields only low confidentiality impact, and the independent assessment classifies this as a low-priority, high-noise issue rather than a genuine threat. Publicly available exploit code exists, but no confirmed active exploitation is indicated by the supplied data.
Stored cross-site scripting in the 'Microsoft Exchange mailbox' field of the Mitel MiVoice Office 400 web portal lets a high-privileged authenticated user persist JavaScript that executes when another administrator opens the affected user's properties, disrupting access to user-management functions rather than enabling broad system compromise. The issue is rated low severity (CVSS 1.9; assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), and there is no indication of confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis. Exploitation requires access to Configuration → Users → Users List over HTTPS on TCP 443 and a subsequent victim viewing the record, so it is not remotely triggerable against unauthenticated or default-facing surfaces.
Authenticated users with high privileges can inject persistent JavaScript into the MiVoice Office 400 web portal's Configuration → Domains 'Description' field, leading to stored XSS that executes in the browser of any other administrator viewing the page. This can alter page content, facilitate phishing within the trusted application context, and potentially steal session data, though the impact is confined to the browser context with no OS-level compromise or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the issue carries a low severity rating (CVSS 3.1 ~3.9; CVSS 4.0 1.9).
ApiAdmin 5.0 and earlier allow any logged-in administrator to achieve remote code execution by uploading a .php payload to POST /admin/Index/upload; the handler takes the client-supplied extension verbatim with no whitelist, blacklist, or content inspection, and move_uploaded_file() places the file into the web-served public/upload/Ymd/ directory, where it can be requested directly over HTTP. The attack path is gated by an authenticated admin session (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2), so practical exposure hinges on credential compromise, reuse, or insider access rather than an unauthenticated vector. EPSS is low at 0.35% (26th percentile) and the issue is not listed in CISA KEV; no public exploit code is identified at time of analysis, though a public proof-of-concept write-up is referenced (GitHub fangtang7/CVE) and the European vulnerability entry EUVD-2026-92468 tracks the same CVE.
Risk cannot be meaningfully assessed from the provided data: CVE-2026-94291 carries no published description, no CVSS score or vector, no CWE classification, and no named product, component, or version. The only intelligence signal in this dataset is that the record was reported through the Ubuntu security feed, which indicates that an Ubuntu-packaged component is affected, but neither a Ubuntu Security Notice nor an upstream advisory is included here, so the affected subsystem, attack surface, and prerequisites are all undefined. Exploitation status is unconfirmed - the CVE is not marked as confirmed actively exploited (CISA KEV), no publicly available exploit code exists in the supplied data, and no EPSS score was provided; authentication requirements not confirmed from available data.
A use-after-free class defect in the Linux kernel's virtio-gpu paravirtualized GPU driver is exposed through the resource-mapping cleanup path when blob-backed scanouts are torn down, potentially allowing memory corruption. Only local users running inside a virtual machine guest that exposes a virtio-gpu device and who are able to open the DRM/render node and allocate blob-backed scanout resources can reach the vulnerable code, per the assessed vector AV:L/AC:H/PR:L/UI:N with high confidentiality, integrity and availability impact - there is no remote or unauthenticated path implied. Exploitation is judged difficult because it depends on specific cleanup ordering/timing; no public exploit code has been identified at time of analysis, and the defect is not listed in CISA KEV.