Blind SQL injection in the WP Post Author WordPress plugin through version 4.0.0 allows an authenticated high-privilege (administrator-level) attacker to read sensitive data from the underlying WordPress database, with assessed high confidentiality impact, limited integrity impact, and no availability impact. Exploitation requires a high-privilege account (CVSS PR:H) and no victim user interaction, so direct external exploitation against a default install is limited, though risk increases in multi-author or delegated-admin environments or if an admin account is already compromised. Multiple signals point to a moderate, not critical, real-world priority; no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation.
Blind SQL injection in the Slider by 10Web WordPress plugin through version 1.2.63 allows an authenticated high-privilege user (CVSS PR:H, typically administrator-level) with network access to the vulnerable request handler to inferentially extract database contents, with confidentiality-only impact per the independent assessment. The input CVSS 3.1 vector describes a network-reachable, low-complexity flaw, but the high-privilege requirement is a critical mitigating factor because anonymous or unprivileged users cannot reach the vulnerable code path. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS data was provided; patch availability is not confirmed from the supplied data.
Blind SQL injection in the Gopiplus 'Post title marquee scroll' WordPress plugin (all versions through 9.9) allows an authenticated user with administrator-level privileges to inject arbitrary SQL into backend database queries and infer data through boolean- or time-based responses. The highest realistic impact is full disclosure of data stored in the WordPress database (CVSS:C:H), with the attacker population sharply constrained by the PR:H prerequisite - anonymous visitors and ordinary subscribers cannot reach the vulnerable functionality. As of analysis there is no CISA KEV listing and no public exploit code identified, and because the injection is blind, successful exploitation requires iterative inference rather than direct retrieval of results; the vendor has not published a fixed version, so the plugin should be removed or disabled until an update appears.
Blind SQL injection in the WordPress/WooCommerce plugin Pix por Piggly (para WooCommerce) through version 2.1.2 allows an authenticated user holding high privileges on the site - such as a WordPress administrator or a WooCommerce shop manager - to inject arbitrary SQL into backend queries and extract database contents through inference-based techniques. The flaw is CWE-89 (improper neutralization of special elements in an SQL command), reported by Patchstack, and carries a disclosed CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N, with the reporter's vector claiming scope change, high confidentiality impact, no integrity impact and low availability impact); our own assessed vector narrows this to S:U/C:H/I:N/A:N, keeping the practical severity essentially the same. The high-privilege prerequisite (PR:H) is the decisive constraint: anonymous visitors and ordinary subscribers cannot reach the vulnerable path, so risk is concentrated in sites where lower-trust staff accounts exist, where shop-manager credentials are shared, or where a privileged account has already been compromised. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Blind SQL injection in the Sarah Giles 'Dynamic User Directory' WordPress plugin, affecting all versions up to and including 2.4, lets an attacker with an existing high-privilege account on the target WordPress site inject arbitrary SQL into a plugin query and exfiltrate database contents by observing boolean or timing differences in responses, since the query results are not returned directly. The flaw is remotely reachable with low attack complexity and no user interaction, but the CVSS:3.1/AV:N/AC:L/PR:H/UI:N vector means it is only exploitable by an authenticated, high-privilege user - a significant limiting factor that narrows the realistic attacker set to trusted administrators or attackers who have already compromised a privileged account. Our independent assessment scores the issue 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N), lower than the 7.6 reported by the finder, because scope is unchanged and integrity and availability impact are limited; there is no CISA KEV listing and no public exploit identified at time of analysis, although a Patchstack advisory documents the issue.
Blind SQL injection in the WordPress plugin affiliate-toolkit (a.k.a. affiliate-toolkit-starter) through version 3.9.1 lets an attacker with an authenticated, high-privilege (administrator-level) account inject arbitrary SQL into plugin queries and exfiltrate database contents through inference-based techniques. The attack is remote, low complexity, and requires no victim interaction once that privileged session exists, but the administrator-level prerequisite (PR:H) sharply limits the realistic attacker pool, and because the injection is blind, exploitation is slower and noisier than a direct-output SQLi. Per our independent assessment this is a moderate-priority issue rather than an emergency; no public exploit identified at time of analysis, and no CISA KEV listing applies.
Unbounded WebSocket permessage-deflate decompression in the AsyncHttpClient (AHC) Java library versions 2.2.0 through 3.0.13 allows a malicious or compromised WebSocket peer to exhaust the JVM heap of the connecting application by sending a small compressed message that inflates into a very large Netty buffer. The flaw is remote, requires no authentication or user interaction from the peer side (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but it only triggers when the client application itself opens an outbound WebSocket connection with permessage-deflate compression negotiated - meaning the victim must connect to an attacker-controlled endpoint or be exposed to a man-in-the-middle. Impact is availability-only: no confidentiality or integrity loss, and no public exploit code has been identified at time of analysis. The issue is fixed in version 3.0.14.
Deserialization of untrusted cache data in IBM Langflow OSS 1.0.0 through 1.12.2 can execute attacker-controlled code with the privileges of the Langflow service process, but only for an attacker who has already obtained two things: the Langflow server secret and write access to the backing Redis instance used as the application cache. Because both prerequisites are effectively gated - the server secret is a trusted signing/trust value and Redis is normally bound to localhost or a private, authenticated network - this is not exploitable by an anonymous remote attacker against a default deployment, which is why the practical risk is lower than the 7.5 base score suggests. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
ImageMagick builds prior to 7.1.2-31 and 6.9.13-56 contain an invalid memory free in the MVG (Magick Vector Graphics) decoder that aborts or crashes the process when a crafted image is parsed. Attackers reach it by supplying an image carrying malicious MVG drawing primitives to any application that renders, converts, or thumbnails untrusted images; the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 with availability-only impact and no confidentiality or integrity loss. No public exploit identified at time of analysis, CISA SSVC records Exploitation 'none' and Automatable 'no', and EPSS sits at 0.40% (32nd percentile), so the flaw is primarily a realistic denial-of-service risk for image-processing pipelines rather than an imminent attack vector.
A crafted PSD file can drive the ImageMagick PSD decoder into an infinite loop, consuming CPU indefinitely and denying service to any application that processes untrusted images. The flaw is an unvalidated image-resource-block offset in ParseImageResourceBlocks (CWE-196 integer conversion, escalating to CWE-835 infinite loop) that only manifests on 32-bit builds: ImageMagick 7.x before 7.1.2-32 and 6.x before 6.9.13-57, while 64-bit builds are not affected. Exploitation requires no authentication or user interaction wherever PSD parsing is exposed (upload, conversion, or thumbnail pipelines), but SSVC records Exploitation: none and Automatable: no, no public exploit is identified at time of analysis, and EPSS is modest at 0.40% (32nd percentile); availability-only impact drives the 7.5 CVSS score.
Denial of service in ImageMagick's bzip2 decompression path lets a crafted bzip2-compressed image stream drive the reader into an infinite loop, consuming CPU indefinitely on the affected process. Versions prior to 7.1.2-32 in the 7.x line (from 7.0.0) and prior to 6.9.13-57 in the 6.x line are affected; the flaw is reachable by remote, unauthenticated attackers who can get an image decoded (upload, conversion, or thumbnail service) with no user interaction beyond supplying the file, and there is no confidentiality, integrity, or code-execution impact. No public exploit code has been identified at time of analysis and CISA SSVC records no known exploitation; EPSS is 0.40% (32nd percentile), so the practical risk is concentrated in deployments that decode untrusted images without per-request CPU or wall-clock limits.
CPU and time exhaustion in ImageMagick can be triggered by a crafted MVG image because the MVG decoder in versions prior to 7.1.2-31 (7.x) and 6.9.13-56 (6.x) lacks a limit on macro expansion during drawing. The result is an availability-only denial of service (CWE-400) with no confidentiality or integrity impact; the assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. No public exploit was identified at time of analysis, SSVC exploitation is none, and EPSS is 0.38% (30th percentile); vendor fixes are available in 7.1.2-31 and 6.9.13-56.
Denial of service in ImageMagick versions prior to 7.1.2-31 allows unauthenticated remote attackers to exhaust CPU resources by supplying an image whose embedded XMP profile contains a crafted rational value, causing the parser to perform excessive work. Impact is availability-only, with no code execution or data exposure, and exploitation requires an application to process untrusted images with XMP metadata. No public exploit was identified at time of analysis, CISA KEV does not list this issue, and EPSS is low at 0.37% (29th percentile); the vendor-released fix is version 7.1.2-31.
Denial of service in the Excelize Go library (versions 2.3.1 through 2.11.0) allows unauthenticated remote attackers to pin a CPU core by supplying a crafted agile-encrypted .xlsx workbook whose OLE encryption header declares an excessively large spinCount, which the library feeds unbounded into its password-key derivation loop. Opening such a file with decryption attempted (OpenFile with a password) makes agileDecrypt run attacker-selected iterations before any verifier validation, and the work cannot be cancelled. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the impact per malicious file is bounded to one CPU core rather than a full host outage. An upstream fix exists in PR #2389 / commit 2badfcd, but no tagged patched release is confirmed.
Denial of service in the Excelize Go spreadsheet library (github.com/xuri/excelize/v2 2.0.0-2.11.0 and github.com/xuri/excelize 1.1.0-1.4.1) lets an unauthenticated remote attacker terminate the calling process by supplying a crafted workbook. The ColumnNameToNumber function converts bijective base-26 column names into int64 without overflow detection, so an over-long name such as VGWQHXLSDVIKWV wraps to zero and is later used as a slice index by checkSheetR0 and xlsxWorksheet.checkRow, producing a negative index panic during worksheet normalization. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), meaning availability-only impact; there is no evidence of confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, though the upstream fix commit and PR are public. This is a moderate-severity denial-of-service condition rather than a high-priority emergency, and it is only reachable when an application built on the vulnerable versions parses an untrusted spreadsheet.
Denial of service in ImageMagick's RSVG delegate reachable through crafted SVG images: when ImageMagick is compiled without Cairo support, a malicious RSVG file that hits an internal resource limit causes the decoder to free image state twice and then touch freed memory, terminating the process. Affected builds are ImageMagick 7.x before 7.1.2-30 and 6.x before 6.9.13-55; the non-Cairo configuration is not the default for most mainstream distributions, and impact is limited to availability (no confidentiality or integrity effect). No public exploit code was identified at time of analysis and the issue is not in CISA KEV; EPSS is low at 0.32% (22nd percentile), and SSVC rates exploitation as none and automatable as no, so real-world priority is LOW despite the 7.5 CVSS base score.
Uncontrolled recursion in the Excelize Go library (versions 2.8.1 through 2.11.0) allows a fatal Go stack overflow that aborts the host process when mutually referencing dynamic-array formulas using _xlfn.ANCHORARRAY are evaluated, resulting in a pure availability impact (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Reachability depends entirely on the host application: it is exploitable only when an application feeds attacker-controlled spreadsheet content into CalcCellValue or another formula-evaluating API, while applications that merely read raw cell values are unaffected. No public exploit code has been identified at time of analysis, and although an upstream fix commit exists, no released patched version has been confirmed (the advisory states no fixed version is available as of its review).
Denial of service in Excelize versions 2.3.1 through 2.11.0 allows unauthenticated remote attackers to terminate the calling Go process by supplying a malformed OLE compound file with a version-valid EncryptionInfo stream to the library's Decrypt function. The decryption dispatch lacks structural and parameter validation, causing nine malformed-input classes to trigger unrecovered Go runtime panics instead of returning documented errors. Exploitation requires the host application to process attacker-supplied encrypted spreadsheets, no fixed version is available as of this review, and no public exploit code has been identified.
A bundled Cisco software-hardening release resolves multiple internally discovered resource-lifecycle flaws (CWE-664) affecting Cisco Meraki MX security appliances, MR wireless access points, MV camera firmware, and Cisco Campus Gateway Software. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), the impact is availability-only - an unauthenticated remote attacker who can reach the affected service can trigger resource mismanagement that crashes or degrades the device, with no confidentiality or integrity loss. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Cisco has not published a specific patched firmware version in the CVE metadata, so administrators should consult the linked advisory to map the hardening release to their exact hardware and firmware train.
Cyrus SASL clients that use the DIGEST-MD5 authentication mechanism can be crashed by a malicious or on-path server that supplies a crafted challenge field (such as realm or nonce), because the add_to_challenge() function computes a buffer size before DIGEST-MD5 quoting and fails to account for escaping that lengthens the value, resulting in a heap-based out-of-bounds write. This is a client-side denial-of-service flaw affecting Red Hat Enterprise Linux 6 through 10, Red Hat Hardened Images, and Red Hat OpenShift Container Platform 4; the assessed CVSS vector is AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H, meaning unauthenticated remote attackers must control or intercept the server endpoint and the victim must initiate authentication. No public exploit code or confirmed active exploitation is identified at time of analysis.
Memory exhaustion and runtime panic in the Excelize Go library (versions 2.3.1 through 2.11.0) let unauthenticated remote attackers crash or drive out-of-memory conditions in any service that decrypts attacker-supplied, password-protected OLE compound (CFB) Excel workbooks. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms no privileges or user interaction are needed and that impact is confined to availability, with no code execution or data exposure. No vendor-tagged fixed release was available as of this review, though an upstream fix exists as PR #2396 / commit 5f636f9; no public exploit code was identified at time of analysis and there is no KEV listing.
Cleartext credential disclosure in AsyncHttpClient (AHC) before 3.0.12 on the 3.x line and before 2.16.1 on the 2.x line causes a client configured to use an HTTP proxy to write the origin request and its Authorization credentials onto a still-plaintext proxy connection when the proxy rejects the CONNECT with anything other than 200, because the client infers an established tunnel from the last request method rather than the CONNECT result. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 HIGH), this is an unauthenticated, confidentiality-only issue: Basic credentials can be recovered directly, while NTLM responses may be cracked or relayed. Exploitation is limited to environments where the victim application routes through an HTTP proxy and the attacker controls or can man-in-the-middle the client-to-proxy hop; no public exploit identified at time of analysis.
Missing authorization in the WPMU DEV Forminator WordPress plugin (all versions through 1.57.2) allows unauthenticated remote attackers to perform privileged actions that should require an access-control check, altering site data with a high integrity impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, exploitation requires only that a vulnerable Forminator installation be network-reachable; no credentials or victim interaction are needed, though the impact is confined to integrity with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV), making this a moderate-priority, broadly-reachable issue rather than an emergency.
Sensitive information is inserted into log files by the Apache Geode Web Management component in versions 2.0.0 through 2.0.2, so any party able to read those logs can recover the exposed confidential values (CWE-532, high confidentiality impact only). The NVD entry scores this 7.5 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, but our independent assessment applies AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - the practical constraint is obtaining access to the generated log output or a UI that surfaces it, so real-world exploitation is materially harder than the 7.5 network-vector score implies and authentication requirements are not settled by the available data. Exploitation is not confirmed actively exploited (CISA KEV does not list this CVE), no public exploit code has been identified at time of analysis, and EPSS is low at 0.17 percent (6th percentile), making this a moderate-priority information-disclosure issue rather than an urgent remote-compromise risk.
Denial of service via out-of-bounds slice access in the Nickname profile of golang.org/x/text/secure/precis (all versions before 0.41.0), where transforming crafted input into a short destination buffer triggers a Go runtime panic. The flaw is remotely reachable and unauthenticated (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, base 7.5), but impact is confined to availability (C:N/I:N/A:H) because Go's memory-safe runtime converts the invalid slice access into a panic rather than exploitable memory corruption. Applications are only exposed if they actually invoke the precis Nickname profile on attacker-controlled strings such as usernames or nicknames; projects that merely depend on x/text without hitting that code path are unaffected. No public exploit identified at time of analysis, and vendor-released patch: golang.org/x/text 0.41.0.
ImageMagick before 7.1.2-31 and 6.9.13-56 resolves image coders before applying its security-policy authorization check, so a crafted image can invoke a coder that a policy.xml rule with domain='coder' was meant to block and read data the policy prohibits. Real exposure is much narrower than the CVSS 7.5 network vector implies: the flaw is only meaningful where an administrator has actually configured a coder-domain policy (installations without one have no control to bypass), and the target application must still parse attacker-supplied images. With EPSS at 0.14% (3rd percentile), SSVC exploitation rated none, and no public exploit or CISA KEV activity identified at time of analysis, this is a low-urgency hardening item rather than an emergency.
Authenticated attackers holding BugTracker.NET administrator privileges can achieve server-side code execution by first reconfiguring the application so that attachments are stored in a web-accessible directory, then uploading an .aspx file that the attachment feature fails to filter by extension. Because the uploaded file lands in a location the web server serves and ASP.NET/IIS will process executable handlers there, requesting its URL runs arbitrary code under the web service account. Exploitation is heavily gated: it requires PR:H administrator access and a non-default storage configuration (reflected as AT:P in the CVSS 4.0 vector), and no public exploit code has been identified at time of analysis; the signals consistently describe this as a low real-world priority issue despite a high CVSS 4.0 base score of 7.5.
Operating system command injection in BugTracker.NET's SVN integration lets an authenticated administrator store malicious arguments in the repository configuration field, which are later concatenated into an svn.exe command line and executed when the revision-comparison feature is invoked, yielding arbitrary command execution under the application service account's privileges. Exploitation requires a high-privileged (administrator) account, the optional SVN integration to be enabled, and svn.exe to be installed and invokable by the service account (AT:P in the vendor CVSS 4.0 vector), so the realistic attack surface is narrow despite the network vector. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; the reported CVSS score is 7.5, though our independent assessment rates the practical risk lower given the layered prerequisites.
Connection-pool key scoping in AsyncHttpClient (AHC) 2.0.0 through 3.0.13 omits identity-defining fields for Kerberos, SPNEGO, NTLM, authenticated proxy and SOCKS/CONNECT login paths, so a request can be handed a pooled keep-alive socket that was already authenticated as an entirely different identity and then execute under that first identity's credentials, exposing the other identity's data or authority. Reachability is conditional: the application must use Kerberos/SPNEGO/NTLM, an authenticated proxy realm, or SOCKS/CONNECT proxy logins, and specifically the ambiguous cases where login has no configured principal, where realms are proxy realms, where distinct identities share a user name, or where proxy logins are used - clients using only HTTP Basic/Digest or a single identity/principal are not affected. Rated CVSS 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, CWE-346 Origin Validation Error); exploitation depends on timing the reuse of an already-authenticated socket across multiplexed callers, and there is no public exploit identified at time of analysis and no CISA KEV listing. Vendor-released patch: 3.0.14.
Cisco Meraki MR wireless access point software, MX security appliance firmware, MV camera firmware, and Cisco Campus Gateway Software can be crashed by an unauthenticated attacker positioned on the same Layer-2 adjacency (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H, base 7.4) due to insufficient control flow management (CWE-691) fixed in a vendor hardening release. Exploitation is confined to attackers with an existing local foothold or wireless/physical proximity; it is not reachable from a routed or internet position, and the assessed impact is availability loss only, with no confidentiality or integrity compromise. There is no public exploit identified at time of analysis and no CISA KEV listing; the flaw was discovered through Cisco's internal security review rather than through exploitation reporting.
OAuth 2.0 bearer token compromise in Express Gateway through 1.16.11 is possible when a deployment keeps the default crypto.cipherKey value 'sensitiveKey' and an attacker can read the Redis datastore. The attacker can decrypt stored tokenEncrypted values, combine them with stored token IDs, and obtain valid bearer tokens for any user, causing high confidentiality and integrity impact while availability remains unaffected. This is not remotely exploitable without preconditions: the assessed vector requires high privileges (PR:H), a present attack requirement (AT:P), and high complexity (AC:H), and no public exploit was identified at time of analysis; it is not confirmed actively exploited (CISA KEV).
Denial of service in Progress Telerik Document Processing's SpreadProcessing library (all versions prior to 2026.3.1006) allows unauthenticated remote attackers to hang an application CPU thread indefinitely by supplying a specifically corrupted XLS spreadsheet for import. The crafted file drives the XLS import routine into an infinite loop that ignores the library's configured import timeout, so the built-in timeout safeguard offers no protection and the affected worker thread becomes permanently unresponsive. Practical exposure depends on whether the host application actually accepts XLS uploads or imports from untrusted sources; no public exploit code or confirmed active exploitation has been identified at time of analysis, and impact is availability-only per our assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with the vendor publishing a base score of 7.3.
Unauthenticated server-side request forgery (SSRF) in the Cisco Finesse web-based management interface lets remote attackers send crafted HTTP requests that cause the device to make requests to associated services, potentially exposing limited sensitive information. The flaw is caused by improper input validation for specific HTTP requests and requires network reachability to the management interface but no credentials or user interaction; CVSS 3.1 score is 7.2, driven largely by scope change rather than severe direct impact. No public exploit identified at time of analysis.
Stored cross-site scripting (XSS) in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin through version 6.3.1 allows unauthenticated attackers to inject arbitrary web scripts into registration metadata that executes when a user views a page rendering a Kirki users collection with an image element bound to one of nine registration meta fields. Exploitation requires that public user registration is enabled, that a published page contains a `kirki-register` element (which exposes the necessary nonce in public markup), and that an image element is bound to a registration meta field; default installations without open registration are not affected. A vendor patch is available in version 6.3.2, and no public exploit code has been identified at the time of analysis.
Privilege escalation in HashiCorp Vault and Vault Enterprise allows an authenticated principal with delegated permissions to bypass explicit deny ACL rules by referencing a resource or policy name in non-canonical form, potentially reaching a protected resource or assigning a denied policy. Affected are Vault Community Edition before 2.1.2 and Vault Enterprise before 2.1.2, 1.21.12, 1.20.17, and 1.19.23, rated CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires an already high-privileged, delegated user (PR:H) operating in a policy model that depends on explicit deny rules, and no public exploit code or confirmed active exploitation was identified at time of analysis (no EPSS data was provided), so this is best handled as a defense-in-depth hardening fix rather than an emergency.
Stored cross-site scripting in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress affects every version up to and including 6.3.10, allowing unauthenticated attackers to inject arbitrary script through the 's' search parameter as it is handled by the plugin's comments-atom feed flow; the payload is written into a retained .tmp file and executes when a victim later loads the affected page or file. Exploitation is conditional rather than automatic: it only succeeds where the front-end web server serves that .tmp artifact without a Content-Type header and without X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser treats it as HTML and runs the script, a configuration the advisory notes is common by default on many Apache and nginx/php-fpm deployments. No public exploit code has been identified and the issue is not listed in CISA KEV; because the assessed vector requires high attack complexity and a non-sniffing or correctly-headered server blocks the attack entirely, this is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. A vendor-released fix is available in 6.3.11.
Remote code execution in SonicWall SMA1000 (Appliance Management Console) can be triggered by an authenticated administrator who uploads a crafted archive containing path traversal sequences, allowing files to be written outside the intended extraction directory and leading to code execution. The vulnerability is a classic Zip Slip (CWE-22) issue with a CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker must already hold high/administrative privileges on the AMC-a significant precondition that sharply limits the pool of realistic attackers to compromised or malicious administrators. No public exploit code or active exploitation has been identified at time of analysis (SSVC exploitation: none), so this is a conditional high-severity risk rather than a mass-exploitation emergency.
Out-of-bounds read in the OpenVPN client before 2.7.8 can be triggered when the client establishes a TLS session with a malicious or compromised server that pushes a crafted option combination touching domain_search_list, producing an unsigned integer underflow that leads to a limited memory disclosure and a high-availability-impact client crash. The defect is client-side rather than a flaw in a server accepting inbound connections, and exploitation requires the attacker to control or impersonate the endpoint the victim connects to (the assessed CVSS 3.1 vector carries PR:L for exactly this reason). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the vendor CVSS 4.0 base score is 7.1 (VC:L/VA:H) and the vendor-released fix is OpenVPN 2.7.8.
Resource exhaustion in the Excelize Go library (versions 2.1.0 through 2.11.0) lets a crafted .xlsx workbook drive excessive CPU and memory consumption - up to process OOM - when an application loads the file and later invokes a column-mutating API such as SetColWidth. The root cause is a missing bounds check in flatCols, which iterates from an attacker-controlled column minimum to an attacker-controlled maximum and performs a deep copy plus append for every declared column number instead of clamping to the spreadsheet's 16,384-column limit. Exploitation requires a victim or service to parse the malicious workbook (UI:P) and then perform a column operation on it; no authentication to the library is required (PR:N), no public exploit code has been identified at time of analysis, and no fixed release is available - although an upstream fix exists as a pull request and commit. CVSS 4.0 base score is 7.1 with availability-only impact (VC:N/VI:N/VA:H); the impact is denial of service, not confidentiality or integrity loss.
Authenticated path traversal in the web portal of Satel Iberia's SenNet Datalogger Serie 200 allows a low-privileged portal user to read arbitrary files and list directories accessible to the web server's system account, exposing configuration or confidential data. The issue is scored CVSS 7.1 with a CVSS 4.0 vector of AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, and the independent assessment rates it a moderate-severity confidentiality issue rather than a top-priority emergency. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical risk is highest where the device web interface is reachable from untrusted networks or where default, shared, or weak portal credentials are in use.
Persistent denial of service in Absolute Secure Access servers before 14.60 can be triggered by an authenticated remote attacker who sends malformed data to the client registration process, causing availability impact that outlasts the triggering request. The flaw requires network reachability and valid credentials, as reflected by PR:L in the vendor and independent vectors, so it is not an unauthenticated attack; no public exploit identified at time of analysis. The vendor rates it CVSS 7.1 High, while the independent assessment characterizes it as a genuine but moderate-priority availability issue because of the authentication prerequisite and availability-only impact.
Reflected cross-site scripting in the WordPress plugin 'Disable and Remove Google Fonts | GDPR & DSGVO friendly' through version 2.0.2 allows remote attackers to inject arbitrary script into a victim's browser session, rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The flaw is unauthenticated from the network perspective but requires a victim to follow a crafted link or otherwise trigger the malicious request (UI:R), with the scope change reflecting that the injected script executes in the context of the victim's browser against the affected site. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV data was supplied with this report; the vulnerability was disclosed by Patchstack.
Reflected cross-site scripting in the Everest Forms WordPress plugin through version 3.6.1 lets remote, unauthenticated attackers run arbitrary script in a victim's browser when that victim opens a specially crafted URL. Successful exploitation requires the victim to actively click or open the malicious link (UI:R) on a site running an affected version, and because the payload is reflected rather than stored it must be re-triggered per victim per click; the impact is confined to the browser session and the site's origin (scope changed) rather than server-side compromise. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), exploitation requires no attacker credentials, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting (CWE-79) in the Unlimited Elements For Elementor (Free Widgets, Addons, Templates) WordPress plugin, affecting all versions through 2.0.19, allows an attacker to persist malicious JavaScript that executes in the browser of any user - including administrators - who later views the affected page, widget, or template. The vendor advisory rates this 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but our independent assessment applies PR:L: realistic exploitation requires an authenticated account with content-editing capability (contributor/author or higher) to submit and store the payload, and the UI:R condition means a separate victim must load the poisoned page before the script fires - so this is not a zero-interaction, unauthenticated attack against default configurations. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied.
Account-deactivation privilege escalation in wger before 2.6 lets an authenticated user who holds only the gym_trainer role disable higher-privileged accounts - including gym_manager and general_gym_manager - within the same gym, locking those users out of the application entirely. Access control on UserDeactivateView (and the mirror-image UserActivateView) uses OR logic across gym.manage_gym, gym.manage_gyms and gym.gym_trainer, with no privilege-hierarchy check and only a same-gym membership check in dispatch(), so the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - an insider/lower-privileged-role escalation, not a remote unauthenticated attack, and one that cannot cross gym boundaries. Publicly available exploit code exists (the vendor advisory itself publishes a working PoC of the GET request), but there is no confirmed active exploitation (CISA KEV) and no EPSS score was supplied in the intelligence feed; a gym manager provisioning a trainer account, which get_permission_list() always allows, is the amplifying path by which a trainer can then turn around and disable the manager who created it.
Cross-tenant information disclosure in wger allows an authenticated trainer account that holds both the gym.gym_trainer and gym.add_adminusernote permissions but has no gym assignment (userprofile.gym = None) to read private admin notes, uploaded documents, gym contracts, user configuration and permission data belonging to any other unassigned (gym = None) user on the same instance. The root cause is an authorization guard that fails open: the five affected views compare gym objects with the Python operator '!=', and 'None != None' evaluates to False, so HttpResponseForbidden is never reached and the following queryset is filtered only by the attacker-supplied member_id. Rated CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, authenticated, low privilege), the bug is amplified because gym = None is the default state for newly registered users, so any instance with public registration plus delegated trainer permissions is exposed; a detailed proof-of-concept is documented in the published GitHub advisory and the permission-edit endpoint is also reachable, giving a possible privilege-escalation path, though no confirmed in-the-wild exploitation has been reported.
MISP instances configured to force TOTP enrolment (Security.otp_required) could be used indefinitely by an authenticated user who never completed second-factor setup, because the enrolment guard in AppController::__verifyUser was enforced only for standard browser requests; AJAX/XHR calls, REST API requests, .json format URLs, restSearch queries and automation actions bypassed the check since those request shapes cannot follow the redirect to the TOTP page. The affected range is MISP versions below 2.5.48, and exploitation requires a valid authenticated session for an account that has not enrolled in TOTP and whose role lacks perm_skip_otp, with identities authenticated by API key explicitly exempt (logged_by_authkey). Assessed impact is high for confidentiality and integrity (CVSS 3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with no public exploit identified at time of analysis; risk is real but conditional on the non-default otp_required hardening setting, so patched builds should be applied on a normal, prioritized schedule rather than as an emergency.
Obot versions 0.12.0 through 0.26.1 return admin- and power-user-supplied static secrets (API keys, tokens) on MCP catalog entries in plaintext to any user who has been granted that entry through Obot's access-control rules, exposing credentials for abuse against backend services. Affected users need a valid Obot account at basic privilege plus an explicit grant on the target entry, and the entry must actually carry admin-set static configuration values, so anonymous exploitation is not possible and only a subset of catalog entries is reachable in practice; the assessed severity is moderate (CVSS 7.1, confidentiality-only impact with no integrity or availability loss). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); the vendor has released a fix in Obot v0.26.2.
Denial of service in MiniUPnPd through 2.3.11: an unauthenticated attacker on the adjacent/local network can terminate the UPnP IGD daemon by sending a single multicast SSDP M-SEARCH datagram to UDP port 1900 containing an 'MX: 0' header together with a known/valid ST value, which trips a divide-by-zero (SIGFPE) inside ProcessSSDPData() and takes down UPnP IGD service. The flaw is reachable only in builds compiled with the non-default --strict option, which is the principal limiting factor; the result is a crash with no data exposure, integrity loss, or code execution. Exploitation status per available data: no public exploit identified at time of analysis, and no CISA KEV entry confirming active exploitation.
Path traversal in the BugTracker.NET file download component allows an authenticated remote attacker to read files outside the intended download directory by supplying a manipulated filename parameter, exposing any file readable by the account running the web application. Exploitation requires a valid BugTracker.NET session (any account able to reach the download handler that accepts a user-supplied filename) and no user interaction; the blast radius is bounded by the operating-system permissions of the application's service account, so a hardened, least-privilege IIS identity materially limits the disclosure. The issue is rated 7.1 (CVSS 4.0) with high confidentiality impact and no integrity or availability effect, and there is no public exploit identified at time of analysis, though the low attack complexity and widespread wildcard CPE coverage make the class of bug attractive to post-authentication attackers who already hold a low-privileged account.