Remote code execution in the AWP Classifieds WordPress plugin before 4.4.9 allows an authenticated user holding the plugin's management capability to import a crafted ZIP archive whose contents are extracted without file-type validation, planting arbitrary PHP into a publicly accessible, network-shared directory. Because the extraction target is web-reachable, the uploaded PHP can be requested and executed, yielding code execution under the web server account. Exploitation is gated by the required management capability (CVSS PR:L), and a vendor patch is available in 4.4.9; publicly available exploit code exists and EPSS is low at 0.19% (8th percentile), with no CISA KEV listing indicating confirmed active exploitation. CWE-434 (unrestricted upload of a file with a dangerous type) is the root cause class.
Account takeover in the FooSales WordPress plugin before 1.43.3 allows any authenticated user to have the plugin act as an arbitrary other account, including an administrator, exposing that user's account details and enabling full account takeover. The vulnerability is a broken-access-control flaw (CWE-269) in which the plugin never verifies that the caller is entitled to act as the user named in a request; it is remote (AV:N), low-privilege (PR:L), and requires no victim interaction (UI:N), yielding a CVSS score of 8.8. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation and EPSS estimates only a 0.13% (2nd percentile) probability of exploitation. Any site running FooSales prior to 1.43.3 that permits untrusted users to hold accounts - for example, sites with open self-registration - is at meaningful risk.
Authorization bypass in MOVO through 0.2.3 lets any authenticated user read other users' stored private documents and overwrite their presentation blueprints through the chat-api document endpoints, because the server accepts an attacker-supplied object path without verifying that the object belongs to the requester. Exploitation requires a valid MOVO account and advance knowledge or enumeration of the victim's object path, so the attack is bounded by path secrecy rather than being fully attacker-controlled, and no victim interaction is needed. Publicly available exploit code exists, and both the CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) and the independent assessment (CVSS:3.1/AV:N/AC:H/PR:L/UI:N, C/I impact) agree the impact is a high-confidentiality, lower-integrity exposure confined to the vulnerable application rather than a platform-wide compromise; signals are moderately consistent and point to a real but bounded risk.
Insecure deserialization in the service console interface of openPDC and openHistorian lets an attacker submit a crafted serialized object graph to a function that deserializes client-supplied data, potentially achieving remote code execution under the privileges of the affected service account. Grid Protection Alliance's openPDC, its Docker image, and openHistorian are all affected, with CPE data indicating no version restriction (all releases). Whether the flaw is remotely exploitable without credentials depends entirely on configuration: deployments without Windows Authentication are reachable by an unauthenticated network attacker (the CVSS 4.0 vector carries PR:N), while deployments with Windows Authentication require the attacker to already hold valid authenticated access. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, but the assessed CVSS:3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact) and the absence of user interaction make this a genuine high-priority issue for exposed, unauthenticated console interfaces in OT environments.
Buffer overflow in the optional lwIP SMTP client application module lets an unauthenticated remote attacker corrupt memory by supplying oversized input that the client fails to length-check, yielding high confidentiality, integrity, and availability impact on embedded and OT devices that use the module. The vendor-supplied CVSS 4.0 score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N), while our independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N because successful exploitation requires the optional apps/smtp module to be compiled into the build and actively used, and generally requires the attacker to control the SMTP server the device talks to (or to be positioned to MITM that session) or to control the email field data (recipient, subject, body) handed to the client. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the affected version is a wildcard in the CPE, so the precise vulnerable lwIP releases remain unconfirmed; the issue is tracked through the ICS-CERT advisory ICSA-26-279-02 and its CSAF machine-readable counterpart.
Remote unauthenticated attackers can gain full administrative control of openPDC deployments provisioned from the official published Docker image, because that image embeds a fixed administrative credential that is not forced to change on first use. Exploitation requires only network reachability to the management interface and retention of the default credential; source-built or manually provisioned instances that set their own credentials are not affected. No public exploit code has been identified at time of analysis, though the vulnerable condition is inherent to the image and the CVSS 4.0 base score is 9.3, highlighting the severity for exposed deployments.
Plaintext credential storage in Red Lion Controls' 700 Series industrial devices exposes usernames, passwords, and unchanged factory-default credentials to anyone who can obtain the device configuration file, and at least one retrieval path - an SNMP-initiated TFTP export - is described as requiring no authentication. Administrators can also read the configuration through the CLI or export it via TFTP from the web interface, but those routes presume existing privileged access; the unauthenticated SNMP path is the exception that drives the risk rating. CISA ICS advisory ICSA-26-281-01 documents the issue, and our assessment scores it as a confidentiality-only, remotely reachable information-disclosure flaw (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5 High) rather than the 9.3 the CNA vector implies; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Red Lion Controls 700 Series devices expose SNMP functions that can be used to perform administrative operations - retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades - while the vendor's description states these actions require no authentication at all (CWE-306, missing authentication for a critical function). The issue is rated 9.3 in the published CVSS v4.0 score, and the independent assessment scores it as critical (CVSS 3.1 base AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full compromise of confidentiality and integrity and a scope change from the network service to the device itself; availability is not scored as impacted. No CISA KEV listing or public proof-of-concept is present in the supplied intelligence, so the current status is no public exploit identified at time of analysis. One caveat worth resolving early: the published v4.0 vector carries PR:L (some privilege/credential), which contradicts the description's 'without any authentication' - confirm the exact SNMP access requirement against the vendor advisory before de-prioritizing, because if the description is correct the real-world severity is closer to the independent PR:N assessment.
Weak, reversible encryption of usernames and passwords stored in the configuration file of Red Lion Controls 700 Series devices lets an attacker who holds the documented default credentials read the configuration and recover additional system credentials for reuse elsewhere on the device or network. The affected product line is captured by CPE cpe:2.3:a:red_lion_controls:700_series:*:*:*:*:*:*:*:*, meaning the vendor tracks the issue at the product-line level rather than against a specific firmware build, and the flaw is classified as CWE-257 (storage of passwords in a recoverable format). Our independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - network reachable but requiring the attacker to already possess valid credentials (PR:L), with confidentiality-only impact - which is substantially lower than the CVSS 4.0 base score of 9.3 reported in the source data; there is no CISA KEV listing and no public exploit code identified at time of analysis, and EPSS data was not provided. Real-world risk therefore concentrates on deployments that retain default credentials and expose the management interface to untrusted networks, and on whether the recovered credentials are reused in a way that grants further access.
Path traversal in plugNmeet Server through 2.5.2 allows any authenticated meeting participant to read arbitrary files from the host by supplying crafted ../ sequences in the filePath value passed to the whiteboard document-conversion endpoint; the resulting page images are then retrievable without authentication via /download/uploadedFile/. The assessed impact is confidentiality-only (high file read, no write or availability effect) against the server process's readable files, and publicly available exploit code exists - though there is no CISA KEV listing, so this is best treated as a moderate-priority information-disclosure issue rather than a critical emergency. Risk is highest where the plugNmeet process can read secrets, configuration files, or credentials on the same host.
SQL injection in the Code Snippets WordPress plugin before version 3.10.0 allows a site Administrator - on a WordPress Multisite network that means a subsite Administrator, not a network Super Admin - to run UNION-based queries against shared network tables via the plugin's snippet-migration import endpoints, exposing network-wide data such as other users' password hashes. The flaw requires an authenticated account with site-administration capabilities (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.8), so there is no anonymous exploitation path; publicly available exploit code exists and the WPScan advisory documents the vector, but EPSS is low (0.16%, 4th percentile) and CISA SSVC records no observed exploitation. Real-world impact is concentrated in multi-tenant Multisite networks where subsite admins are untrusted, since on a single-site install the acting administrator already has legitimate database access.
SQL injection in Testimonials by BestWebSoft WordPress plugin through 1.0.8 lets unauthenticated remote attackers append SQL to a database query and read data from the underlying WordPress database. Publicly available exploit code exists (reported by WPScan), with no CISA KEV confirmation of active exploitation. The independent assessment rates this as a moderate-priority, network-reachable, low-complexity issue with no authentication or user interaction and confidentiality-only impact; the supplied CVSS vector's AC:H and S:C are not supported by the description and should be treated cautiously.
Unauthenticated access to the openPDC internal data publisher lets any host that can reach the service connect and subscribe without credentials, tokens, or user interaction, retrieving the complete device and measurement topology - the full model of phasor measurement units, devices, and signal names that describes a synchrophasor deployment. The affected software set, per vendor CPE entries, covers openPDC, the openPDC Docker image, and openHistorian, with CISA ICS advisory ICSA-26-281-02 documenting the missing-authentication weakness (CWE-306); the assessed vector requires no authentication (PR:N) and yields a high-confidentiality, read-only exposure with no integrity or availability impact, so an attacker cannot alter or disrupt operations through this flaw alone. No public exploit identified at time of analysis, and realistic risk is dominated by network exposure: properly segmented OT/ICS networks sharply limit reachability, while flat networks or inadvertently internet-exposed publisher endpoints are fully exploitable.
Remote attackers holding low-privilege credentials can crash and reboot Red Lion Controls 700 Series switches by requesting a specific URL on the device's embedded management web server, and because the trigger is a single HTTP request the cycle can be looped with a tool such as curl to hold the switch in continuous reboot (persistent denial of service). The vulnerability is a reachable-assertion flaw (CWE-617) in the web server and is remotely exploitable without user interaction, but requires network reachability to the management interface and, per the assessed CVSS vector (PR:L), a valid low-privilege session; no public exploit code has been identified at time of analysis and no CISA KEV listing is associated with this CVE. Availability impact is high while confidentiality impact is nil, so the practical risk is loss of network switching, management access, and OT/ICS process connectivity rather than data theft.
Unauthenticated attackers can permanently delete product variations and read their details on WooCommerce stores running the SKU Error Fixer for WooCommerce plugin through version 1.0, because two of the plugin's AJAX actions lack both capability and nonce checks. Publicly available exploit code exists, and the deletions leave no recoverable copy behind, although the impact is scoped to variations the plugin itself classifies as obsolete rather than arbitrary products or site data. EPSS is low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV), so this rates as genuine but low-priority.
Unauthenticated attackers can manipulate arbitrary WooCommerce-style orders handled by the Livees Checkout WordPress plugin through version 7.0.2, because the order confirmation page processes request parameters without any capability, nonce, or order-key validation. This lets remote attackers change order statuses, inject arbitrary data and notes into orders, and recover order keys, degrading data integrity and leaking order information. Publicly available exploit code exists and WPScan has published the vulnerability, but there is no confirmed active exploitation (CISA KEV) at time of analysis; the assessed CVSS is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with impact bounded by the need to know or enumerate valid order identifiers and no code execution or availability loss.
Firmware and bootloader updates on Red Lion Controls' N-Tron 700 Series industrial Ethernet switches can be pushed or pulled without authentication or image integrity checks, so an attacker running the standard N-Tron management software can scan an OT network over SNMP and TFTP and load arbitrary firmware, taking control of the device image (CWE-494). The published CVSS 4.0 score is 8.4, while the assessed CVSS 3.1 vector (network, scope-changed, High integrity and availability impact) is more severe; the two vectors also disagree on prerequisites, with the published vector encoding PR:L (some privilege) versus PR:N in our assessment, a conflict to confirm with the vendor. Firmware updates are unauthenticated on the update path per the reported description, but there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; exploitation still requires routable access to the switch management plane, typically from inside a segmented, non-internet-facing OT/ICS network.
Unrestricted file upload in the PX-lab Zombify WordPress plugin (versions up to and including 1.7.7) lets remote attackers push a dangerous file type, such as a PHP web shell, into a web-accessible location and execute it on the server. The supplied CVSS vector rates this 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting full compromise of confidentiality, integrity and availability with scope change, and the vector indicates unauthenticated exploitation with no user interaction, though the Patchstack-sourced advisory does not itself document the precise access level required and defenders should verify whether any privilege is needed in their configuration. No CISA KEV listing and no public exploit code were identified at time of analysis, so real-world impact is currently gated by whether this niche plugin is deployed and its upload path is reachable; where it is, this is a genuine high-priority issue rather than a high-score-but-low-risk case.
Authenticated low-privilege tenant users of iFlytek Astron Agent prior to 1.1.2 can run arbitrary Python as root inside the core-workflow container by submitting a workflow Code node, because the shipped default configuration routes dynamic code execution to an unsandboxed LocalExecutor that exposes the full set of Python builtins. From that foothold the attacker can read shared service and database credentials and use them to bypass application-level tenant checks, read or modify other tenants' data, and disrupt shared services (CVSS 9.9, scope-changed, CWE-95). Exploitation requires a valid tenant account plus the ability to create or run a workflow containing a Code node; no public exploit identified at time of analysis, and the vendor-released patch is version 1.1.2.
SQL injection in JetBrains Exposed before 1.5.1 enables unauthenticated remote attackers to execute arbitrary SQL against downstream applications that pass attacker-controllable, unescaped string arguments into several affected SQL functions. The library itself is not directly exploitable; exploitation requires a hosting application to route untrusted input into the vulnerable function calls, so applications that only pass literals or use parameterized/escaped paths are unaffected. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a worst-case nominal impact of full confidentiality, integrity, and availability loss; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Remote code execution in iStoreOS (istoreos-24.10.7 and earlier) lets an attacker who can reach the web management interface supply a crafted task_id value that tasks-lib.lua processes without sanitization and evaluates as Lua code, resulting in arbitrary command execution with the privileges of the management service. The vendor-published CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N), but the primary disclosure is titled 'authorized-rce' and our independent assessment scores the vector at PR:L, meaning a valid authenticated session on the management UI is the realistic prerequisite - a significant limiting factor because iStoreOS router/NAS admin interfaces are typically not exposed to the internet. No CISA KEV entry and no confirmed public exploit code were identified at time of analysis, and EPSS is low at 0.27% (18th percentile), so exploitation is currently opportunistic rather than rampant.
Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attackers to mount sustained credential-guessing attacks against the login interface, potentially leading to privilege elevation, bypass of protection mechanisms, and unauthorized access to a management platform that brokers connectivity into managed Dell infrastructure. All SCG Policy Manager builds prior to the fixed release are affected (the Dell advisory cites 5.34.00.16, while ENISA EUVD data cites 5.36.00.16 - the discrepancy should be verified against the vendor advisory before patching decisions). The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and CWE-307, but exploitability is gated by credential strength and attempt volume: CISA's SSVC assessment rates it as not automatable and records no observed exploitation, EPSS is only 0.26% (16th percentile), and no public exploit code has been identified at time of analysis.
Remote code execution in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router firmware v1.3.241114.024540 and earlier is caused by OS command injection in the www/cgi-bin/upgrade handler, allowing a network attacker to run arbitrary commands through the router's HTTP management interface. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, so unauthenticated exploitation is possible when that endpoint is reachable. No CISA KEV confirmation was provided and no public exploit identified at time of analysis; EPSS is 0.24% (14th percentile), indicating low predicted exploitation activity despite the critical severity score.
Cryptographic signature spoofing in the Sipay Virtual POS Module for PrestaShop (versions 26.8.1 up to but not including 26.9.1) allows unauthenticated remote attackers to forge or bypass the module's signature verification of payment data, letting them inject fabricated signed payment/JWT payloads that the store treats as legitimate gateway traffic and thereby tamper with payment and order state. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is network-reachable with no authentication and no user interaction, and the integrity impact is the dominant concern; the exposure is limited to merchants who have the Turkish Sipay payment-gateway module installed and active at an affected version, not default PrestaShop installations. No public exploit identified at time of analysis, and no CISA KEV listing is associated with this issue.
Signature spoofing in the Sipay Electronic Money and Payment Services OpenCart Virtual POS Module (versions 26.8.2 up to but not including 26.9.1) lets unauthenticated remote attackers bypass cryptographic signature verification and submit forged or tampered payment tokens, most plausibly spoofed JWTs in the payment callback/token-verification flow, which can expose payment data and permit unauthorized manipulation of transaction processing. The flaw is network-reachable with no authentication or user interaction required (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N, CWE-347), and an independent assessment narrows the impact to high confidentiality and integrity loss without an availability component, giving a 9.1-equivalent severity rather than the originally cited 9.8. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, but exploitation requires only that a store runs the vulnerable module version with its callback endpoint reachable. Reported by TR-CERT; a vendor fix is available in 26.9.1.
Insufficiently protected credentials in Rocket Software Rocket Remote Desktop 18.0.8583.1 can expose account secrets to an attacker who can reach the credential material, potentially compromising downstream systems that use those credentials. The CVE feeds rate the issue as 9.8 with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but our independent assessment is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N: local, authenticated, and confidentiality-only, because realistic impact depends on local access to a stored credential blob or a man-in-the-middle position on session traffic, and the exact exposed feature is not specified in the one-line description. EPSS is 0.14 percent at the 3rd percentile, and no public exploit identified at time of analysis or CISA KEV entry was provided.
Authenticated administrators of Nginx UI releases 2.3.8 through 2.4.x can achieve remote code execution on the host by abusing the backup restore endpoint to overwrite live configuration with attacker-controlled nginx command settings. The attacker submits attacker-controlled portable backup key material along with a matching manifest to POST /api/restore; because the restore flow trusts the supplied key and treats the backup as 'portable', it decrypts the attacker's payload and replaces the live app.ini, including the protected TestConfigCmd value, after which a call to POST /api/nginx/test executes the restored command inside the Nginx UI runtime. The issue is rated CVSS 9.4 (CVSS 4.0) and CVSS 3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, is fixed in version 2.5.0, and at time of analysis there is no public exploit identified and no confirmed active exploitation (not listed in CISA KEV); the practical barrier is the high-privilege authenticated session required, so exposure is limited to instances where an admin account or session can be obtained by an untrusted party.
FalkorDB instances that explicitly enable the optional Bolt wire-protocol endpoint can be crashed, and possibly have arbitrary code executed, by an unauthenticated remote attacker who sends a single crafted Bolt RESET message with an attacker-chosen 16-bit chunk size. The vulnerability is a heap-based out-of-bounds write (CWE-787) in BoltReadHandler in src/bolt/bolt_api.c present before version 4.20.0; the size check is performed only with ASSERT(), which is compiled out of release builds, so production binaries provide no runtime guard. Exploitation requires the Bolt port (BOLT_PORT) to be enabled and network-reachable - it is disabled by default and is the decisive precondition that sharply limits the exposed population; with no CISA KEV entry and no public exploit code identified at time of analysis, reliable denial of service is the confirmed impact while remote code execution remains a theoretical possibility that has not been demonstrated.
Remote attackers who can issue Redis replication commands to a FalkorDB instance before 4.18.1 can trigger a double-free/use-after-free in the RDB graph decoder, causing a denial of service (redis-server crash) or potentially arbitrary code execution in the redis-server process. The root cause is a buffer-size validation in RdbLoadDeletedNodes/RdbLoadDeletedEdges that relies on ASSERT(), which is compiled out in release builds, so a deleted-nodes buffer whose byte length is not a multiple of sizeof(NodeID) passes unchecked, is freed, then read and freed again. Exploitation is unauthenticated (CVSS PR:N) on instances without a password or otherwise reachable by an untrusted replication source; no public exploit code has been identified at time of analysis, and reliable code execution depends on heap layout.
Unauthenticated remote access to x64dbg-MCP Server prior to version 1.1 lets any network client that can reach the plugin's HTTP/SSE listener execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. The listener binds to 0.0.0.0 by default and, before the fix, Bearer token authentication was optional and disabled by default, so a default installation with a running x64dbg GUI is fully controllable without credentials (CWE-306), matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; no EPSS score was supplied, so exploitation likelihood rests on exposure of ports 9094 (x64) or 9095 (x32).
Unauthenticated path traversal in the Contao CMS ImagesController lets remote attackers read files from the project directory by supplying encoded parent-directory segments in the image route's {path} parameter. Affected versions are Contao 5.0.0 through 5.3.49 and 5.7.11 (fixed in 5.3.50 and 5.7.12), with impact constrained by the fact that a returned file must carry an extension listed in contao.image.valid_extensions and files below the upload directory were not demonstrated to be readable, making this extension-restricted disclosure plus path-existence probing rather than arbitrary file read. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), no public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates the issue as moderate rather than critical.
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman Desktop, Red Hat OpenShift/CRC tooling and related Red Hat products), lets an attacker who can reach the /services/forwarder/expose control endpoint supply an arbitrary socket path that is passed unsanitised to os.Remove, resulting in deletion of arbitrary files on the host. The defect is reachable without credentials (PR:N) but requires adjacent/guest-side network access to the forwarder API (AV:A), which is normally bound to the virtual network rather than exposed as a routed internet service; impact is limited to integrity and availability (no data disclosure). No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); an upstream fix exists in gvisor-tap-vsock PR #718. The vendor score of 9.3 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) reflects low-complexity, unauthenticated access combined with a scope change and High integrity/availability impact, and the actual risk depends heavily on whether the forwarder control API is reachable by an untrusted guest or adjacent host.
Stored cross-site scripting in the Contao CMS comments bundle lets an unauthenticated visitor submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php, so attacker-controlled script executes in the Contao backend origin when a backend user opens the Comments module. All Contao releases from 4.0.0 up to (but not including) 5.3.50 and 5.7.12 are affected, and successful exploitation requires a privileged backend user to view the Comments module (CVSS 9.3, AV:N/AC:L/PR:N/UI:R/S:C); no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Critically, moderation is not a mitigating control because unpublished/pending comments remain visible to moderators, so an unapproved malicious comment still triggers in that user's session.
Information disclosure in Contao CMS allows unauthenticated front-end visitors to read the titles, URLs, and indexed text snippets of protected pages through the ModuleSearch search module. The exposure only occurs on sites that previously enabled contao.search.index_protected (so protected pages were written into the tl_search index with per-row authorization metadata) and then disabled that setting without purging the stale index rows; the affected versions are 4.0.0 through the 5.3.x branch before 5.3.50 and 5.7.x before 5.7.12, with fixes released in 5.3.50 and 5.7.12. Exploitation is unauthenticated and requires no user interaction, but there is no public exploit identified at time of analysis, the underlying protected pages still enforce their own authorization checks, and the real-world risk is genuinely low because it depends on that specific configuration transition.
Unauthenticated email-flooding and user-enumeration in Contao CMS: a POST to any page containing the registration module reaches ModuleRegistration::compile()'s follow-up registration branch without validating FORM_SUBMIT or the preceding captcha, so resendActivationMail() invokes OptInToken::send() with no rate limit. An attacker can therefore repeatedly trigger activation emails to an address that has a pending registration and, via the observable difference in response, determine whether that pending registration exists. Affected versions run from 4.1.0 up to (but not including) 5.3.50 and 5.7.12, and exploitation requires reg_activate to be enabled plus target-side pending-registration state, which keeps this at a modest severity (CVSS 5.3, PR:N/UI:N, confidentiality-only impact); no public exploit identified at time of analysis.
Unauthenticated blind SQL injection in the WordPress plugin EduAdmin Booking (MultiNet Interactive AB) before version 6.0.0 allows remote attackers to inject SQL through the plugin's request handling and extract data from the underlying WordPress database, including booking records, customer details, and potentially user credential hashes. The supplier-rated CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L), while our reassessment is more conservative at AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, because blind SQL injection normally produces confidentiality-only impact without the claimed scope change; under either vector the flaw is network-reachable and, per the supplied vector, requires no authentication or user interaction, although the exact vulnerable parameter or endpoint is not identified in the available data. Risk is real but bounded: exploitation requires an active installation of this specific plugin, and no public exploit identified at time of analysis, with no CISA KEV listing and no public PoC in the supplied intelligence.
Unauthenticated blind SQL injection in tagDiv Opt-In Builder (td-subscription) versions through 1.7.6 allows remote attackers to extract sensitive data from the underlying WordPress database via crafted input to the plugin's subscription/opt-in functionality. The vendor-reported CVSS 3.1 score is 9.3 (S:C), but an independent assessment revises the scope to unchanged (S:U) and confirms high confidentiality impact without integrity or availability impact. No public exploit identified at time of analysis.
Authenticated users of ruoyi-ai 3.0.0 through 3.1.0 can delete workflows owned by other accounts by issuing POST /workflow/del/{uuid} with a UUID harvested from the GET /workflow/search listing, because WorkflowService.softDelete() never calls PrivilegeUtil.checkAndGetByUuid() to confirm ownership before removing the record. The bug is a classic CWE-862 missing-authorization flaw: any valid account at any privilege level (PR:L) is enough, no user interaction or non-default configuration is required, and publicly available exploit code exists, although there is no CISA KEV confirmation of active exploitation and the impact is confined to integrity and availability of workflow objects on multi-user or multi-tenant deployments. Independent assessment rates this as a moderate-severity broken-access-control issue rather than an urgent one, since a single-user instance has nothing to cross-delete and no data disclosure is possible.
Authenticated non-admin users of ruoyi-ai 3.0.0 through 3.1.0 can enumerate other users' enabled private workflows through the GET /workflow/search endpoint, which performs no owner or is_public filtering and returns workflow UUIDs together with full node and edge definitions. The exposure is confined to the caller's own tenant and to workflows that are both enabled and private, so disabled items and cross-tenant data remain hidden, but any holder of a low-privileged account can harvest sensitive automation logic belonging to colleagues. Proof-of-concept code is publicly available (a HackMD write-up linked from the CVE record), no confirmed in-the-wild exploitation or CISA KEV listing has been reported, and the CVSS 4.0 base score is 5.3 (CVSS:3.1 equivalent AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a confidentiality-only, authorization-boundary defect rather than data tampering or service disruption.
Off-origin preview framing in TinaCMS (tinacms <= 3.13.0 and @tinacms/app <= 2.5.13) lets an unauthenticated attacker who convinces a signed-in editor to open a crafted link such as `#/~//attacker.example/p` make the admin load and trust an attacker-controlled iframe, which is then accepted as the legitimate preview over the admin↔preview postMessage channel. Because the admin executes any GraphQL operation coming from that frame using the editor's own token, the attacker gains the editor's content API read and write access, exposing or modifying protected content. Exploitation needs only one click by an authenticated editor against a default configuration; no public exploit code was identified at time of analysis, and vendor-released patches are available in tinacms 3.14.0 and @tinacms/app 2.5.14.
Unauthenticated remote attackers can read newsletter sending logs - including recipient email addresses - from any WordPress site running the SendPress Newsletters plugin through version 1.26.1.20, because the logging endpoint is gated by a single hardcoded token that is identical across every installation and therefore effectively a public secret. The issue is present in default configurations with no prerequisite beyond the plugin being installed and the endpoint being reachable, and publicly available exploit code exists (documented by WPScan), though there is no confirmation of active exploitation (not in CISA KEV). Impact is limited to confidentiality of log data - no write access, no authentication bypass to broader site functions, and no code execution - with EPSS at 0.14% (3rd percentile), consistent with a genuine but modest-severity information disclosure best triaged as low-to-moderate priority.
Unauthenticated attackers can overwrite arbitrary options in the Social Web Suite WordPress plugin through version 4.1.12 by abusing a settings-write endpoint that performs no authorization check, with the most damaging target being the shared secret that guards the plugin's own privileged endpoints. Because the CVSS vector is PR:N/UI:N, no credentials, privileges, or user interaction are required; the only precondition is that the plugin be installed and active on an internet-reachable WordPress site, and default configurations are affected. Impact is confined to integrity (C:N/I:L/A:N, base 5.3) rather than direct code execution or data disclosure, but public exploit code exists in the form of the WPScan proof-of-concept, so weaponization by opportunistic scanners is plausible. EPSS is low at 0.14% (3rd percentile), and there is no indication of confirmed active exploitation in CISA KEV; treat this as a moderate-priority stepping-stone issue rather than a catastrophic flaw.
Unauthenticated payment-status forgery in the UnitechPay WordPress plugin (through version 1.0.6.3) allows remote attackers to mark orders as paid without any payment being made and to force other orders into a failed state. The plugin's payment-notification handler consumes incoming notifications without verifying their authenticity, so a forged callback reaches the affected site with no credentials and no user interaction (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N, integrity-only impact of C:N/I:L/A:N, CWE-862). Publicly available exploit code exists, but the issue is not listed as confirmed actively exploited (CISA KEV) and EPSS is low at 0.14% (3rd percentile), so the signals are consistent and point to a moderate, not critical, priority for sites that actually run and rely on this plugin for checkout.
Stack-based buffer overflow in FalkorDB versions before 4.18.4 allows remote attackers who can issue Redis replication commands - for example against a network-reachable instance with no password configured - to crash the graph database and possibly achieve code execution by supplying a crafted RDB stream whose entity property count is unbounded. The decoder sizes two variable-length arrays on the thread stack from that attacker-controlled count and then fills them with attacker-supplied values, so a single malformed RDB payload overflows the stack (CWE-121). No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released FalkorDB 4.18.4 moving large property sets to the heap; CVSS 4.0 rates this 9.2 with AV:N/AC:H/PR:N/UI:N, where the high attack complexity reflects the difficulty of converting the overflow into reliable arbitrary code execution rather than a denial of service.
Account takeover in PHPNuxBill through 2025.3.20 allows unauthenticated remote attackers who know a valid customer username to brute-force the six-digit otp_code in the customer password-reset flow at system/controllers/forgot.php; because the pre-patch code has no attempt limit or lockout, an attacker can guess the OTP within its roughly 600-second validity window and then read the newly set password from the HTTP response. The vendor has published an upstream fix and advisory, but no public exploit identified at time of analysis, and the independent assessment rates this as a genuine high-priority issue requiring only a known username and default configuration.
Unauthenticated SQL injection in the PHPNuxBill radius.php FreeRADIUS REST endpoint allows remote attackers to read arbitrary data from the application database - including customer records and stored credentials - by injecting crafted username, macAddr, or nasid parameters into the accounting or authenticate actions, which are interpolated directly into whereRaw() queries. All versions through 2025.3.20 are affected per the vendor advisory and CPE data (cpe:2.3:a:hotspotbilling:phpnuxbill:*:*), and exploitation requires only network reachability of radius.php, with no authentication and no user interaction. The supplier-scored CVSS 4.0 vector (9.3) asserts high confidentiality, integrity, and availability impact, whereas our independent assessment scopes the realistic impact to confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, so the decisive risk factor is whether radius.php is exposed beyond the trusted RADIUS/NAS segment.
Forging payment webhook signatures in the Super Payments WordPress plugin (before 1.43.1) allows unauthenticated remote attackers to mark arbitrary WooCommerce orders as paid without payment, because the plugin ships with an empty signature-validation signing key by default. The medium-severity (CVSS 5.3) integrity flaw has business impact that exceeds its raw score; publicly available exploit code exists, though no confirmed active exploitation has been observed (not listed in CISA KEV). Affected sites are those using the vulnerable plugin with WooCommerce and exposed webhook endpoints, and the default configuration itself is the enabling condition.
Unauthenticated attackers can permanently delete shipment records belonging to arbitrary orders on WordPress sites running the Shipping for Nova Poshta plugin through version 1.19.8, and can additionally cause the store to fire the carrier's waybill-deletion request using the store's own stored Nova Poshta API credentials. The vulnerable AJAX action is registered for unauthenticated users and performs no authorization, nonce, or ownership validation, so no login, user interaction, or non-default configuration is required - the only friction is that the attacker must supply a target order identifier, which may require enumeration. Publicly available exploit code exists (reported via WPScan); there is no confirmation of active exploitation (not in CISA KEV), and the practical exposure is bounded to stores that have this specific plugin installed and active.
Unauthenticated blind SQL injection in the Shinetheme Traveler WordPress theme (all versions from initial release through 3.2.9) lets a network-based attacker inject arbitrary SQL into a vulnerable query and infer database contents through boolean- or time-based responses, yielding high confidentiality impact with no integrity or availability loss of note. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a low-complexity, no-authentication, no-user-interaction attack with a scope change, indicating the vulnerable component can affect resources beyond its own security boundary - such as the underlying WordPress database. At time of analysis there is no CISA KEV entry and no public exploit code identified at time of analysis, and the unauthenticated classification is Patchstack-reported and unverified: if the real prerequisite turns out to be subscriber- or author-level access, authentication would become the primary limiting factor.
Blind SQL injection in the wpdreams Ajax Search Pro WordPress plugin, affecting all versions through 4.29.1, lets unauthenticated remote attackers inject crafted input into the plugin's public-facing search/AJAX query path and infer database contents one bit at a time. Because the vector is PR:N/UI:N, no credentials or victim interaction are needed, making any internet-exposed WordPress site running the vulnerable plugin a candidate target. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); exploitation demands many iterative automated requests rather than a single direct query, but a successful attack can yield sensitive data such as user password hashes, secret keys, and PII.