PHP object injection in the ThemeREX Gutentype WordPress theme (all versions through 2.1.12) allows remote, unauthenticated attackers to inject arbitrary PHP objects through unsafe deserialization of untrusted data, with the potential for full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates attack complexity as High because practical exploitation depends on the presence of a suitable POP gadget chain in the theme, WordPress core, or an installed plugin - without one, real-world impact is likely lower than the base score implies. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing); exploitation is bounded to sites running the Gutentype theme, unpatched, at version 2.1.12 or earlier.
PHP object injection in the ThemeREX Travesia WordPress theme (versions up to and including 1.1.16) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to arbitrary code execution or other severe impacts if a usable POP gadget chain exists in the theme or other installed components. The vulnerability has a CVSS score of 9.8 and requires no authentication or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and no vendor patch has been confirmed as available.
PHP object injection in the Axiomthemes Veto WordPress theme (all versions through 1.6.0) lets remote attackers hand untrusted serialized data to PHP's unserialize(), which can instantiate arbitrary classes if a usable gadget chain is reachable. The attack is network-reachable against a default theme install and, per the assessed vector (PR:N/UI:N), requires neither authentication nor user interaction, though the assessed attack complexity is High (AC:H) because exploitation depends on a POP chain being present in the theme, an installed plugin, or WordPress core. Practical impact is therefore conditional: the 9.8-style severity reflects worst-case object injection outcomes rather than a guaranteed code-execution path, and no public exploit has been identified at time of analysis. Note the affected product is a niche commercial theme, and no fixed version is stated in the available data.
Unauthenticated PHP object injection in the ThemeREX Jacqueline WordPress theme (versions 2.22 and earlier) can let remote attackers achieve full confidentiality, integrity, and availability impact (CVSS 9.8) if a usable POP gadget chain is reachable in the theme or other installed WordPress components. Exploitation requires no authentication or user interaction against a site with the theme active, but the practical impact depends on the presence of a viable gadget chain. No public exploit has been identified at time of analysis, and no vendor-released patch was found in the provided data.
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.
Unauthenticated PHP object injection in the Kicker WordPress theme (AxiomThemes), affecting versions 2.2.1 and earlier, lets any remote attacker reach an unsafe PHP deserialization sink without credentials or user interaction - the only prerequisite is that the theme is active on a network-reachable WordPress site. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, high C/I/A), the practical severity hinges on CWE-502's classic caveat: achieving code execution, file deletion, or data exfiltration requires a usable POP gadget chain in the theme, an installed plugin, or WordPress core, so impact may be materially lower on sites without a suitable chain. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; Patchstack published the advisory and no vendor-released patch has been confirmed in the provided data.
Unauthenticated PHP object injection in the AxiomThemes 'Original' WordPress theme (all versions up to and including 1.9.0) lets a remote attacker reach a code path that passes attacker-controlled input into PHP's unserialize(), exposing affected sites to high impact across confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the root cause is CWE-502, the practical ceiling of exploitation depends on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin - without one, outcomes may be limited to lower-impact effects rather than full code execution. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and no EPSS score was supplied with the source data, so this should be treated as a severe latent exposure rather than a confirmed campaign.
Unauthenticated PHP object injection in the FC United WordPress theme (Axiom Themes, versions up to and including 1.1.1) allows remote attackers to pass crafted serialized input that the theme unserializes without validation, potentially leading to code execution, file manipulation, or database compromise depending on the gadget chains available on the host site. The 9.8 CVSS score reflects a fully remote, unauthenticated attack path with no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but there is no public exploit identified at time of analysis and no CISA KEV listing; all severity signals are theoretical rather than empirical. Real-world impact is further bounded by CWE-502's dependency on a reachable POP gadget chain in the theme, WordPress core, or an installed plugin, and by the theme's limited deployment footprint.
Unauthenticated PHP object injection in the ThemeREX ShiftCV WordPress theme, affecting versions up to and including 3.0.14, lets remote attackers feed crafted serialized input into an unsafe deserialization sink, which can escalate to remote code execution when a usable POP gadget chain is reachable in the theme, WordPress core, or an installed plugin. The flaw carries a 9.8 Critical rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required and successful exploitation can fully compromise confidentiality, integrity and availability. There is no public exploit identified at time of analysis and no CISA KEV confirmation, so the practical limiting factor is the availability of a reachable gadget chain rather than the injection primitive itself; no EPSS score was supplied in the available intelligence.
Unauthenticated PHP object injection in the WordPress theme Windsor (ThemeREX) through version 2.10 lets remote attackers feed crafted serialized data into an unserialize() call reachable without authentication or user interaction, scoring a maximum base 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Reported by Patchstack and tracked as CWE-502, the flaw's realized impact depends on whether a usable PHP gadget chain exists across the theme, WordPress core, and installed plugins - in an unpatched site with a suitable gadget, this can escalate to code execution, arbitrary file or data manipulation, whereas without one the injection may be largely inert. At time of analysis there is no public exploit code identified and no CISA KEV listing, so exploitation is not confirmed in the wild; no vendor-released fix version appears in the available advisory data. Given the unauthenticated, network-reachable profile and the prevalence of gadget-rich plugin stacks, this should be treated as high priority for any site running the theme.
Unauthenticated PHP object injection in the ThemeRex Education Center WordPress theme (versions up to and including 3.6.12) lets remote attackers feed serialized data into an unserialize() sink with no authentication and no user interaction, scored CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Actual damage depends on whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins, because that determines whether object injection escalates to code execution or full confidentiality, integrity, and availability loss. No public exploit code and no CISA KEV listing were identified at time of analysis, and real-world exposure is constrained by the narrow installed base of this specific commercial theme.
Unauthenticated PHP object injection in the Ancorathemes Drone Media WordPress theme, affecting all versions through 2.2.0, lets a remote attacker supply a crafted serialized PHP object to a theme-reachable sink without authentication, no user interaction, and low attack complexity, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N base vector scored 9.8. Because successful exploitation depends on a usable property-oriented programming (POP) gadget chain being present in the theme, WordPress core, or an installed plugin, the maximum C:H/I:H/A:H impact - typically code execution, file manipulation, or full site takeover - is only realized when such a chain exists; otherwise the realized impact may be lower. At time of analysis there was no public exploit code identified and no evidence of confirmed active exploitation (not listed in CISA KEV), though the combination of an unauthenticated, network-reachable, low-complexity injection sink makes this a high-priority target for attackers once a chain is publicized. Reported by Patchstack against the CPE cpe:2.3:a:ancorathemes:drone_media.
Unauthenticated PHP object injection in the ThemeRex 'Asia Garden' WordPress theme (versions 1.3.1 and earlier) allows remote attackers to pass crafted serialized data into PHP's unserialize() and instantiate arbitrary objects on the target site. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical), exploitation requires no authentication or user interaction against an affected installation and could yield full confidentiality, integrity, and availability impact - typically arbitrary code execution, file manipulation, or SQL injection when a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS score was supplied. Practical exploitability hinges on the presence of a viable gadget chain, without which impact may drop to denial of service or be difficult to weaponize, and the exact vulnerable parameter/endpoint is not detailed in the available data.
Unauthenticated PHP object injection in the WordPress theme N7 | Golf Club Sports & Events (versions 2.21 and earlier, vendor ThemeREX) lets a remote attacker supply a crafted serialized PHP object to a theme endpoint without any authentication or user interaction, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Because no public exploit code and no CISA KEV entry were identified at time of analysis, real-world impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin; where such a chain is reachable, the deserialization flaw can escalate to full remote code execution. Exposure is limited to sites that have this specific niche golf/sports theme installed and active, but for those sites the worst-case profile is complete compromise by an unauthenticated attacker.
Unauthenticated PHP object injection in the ThemeRex Invetex WordPress theme affects versions 2.18 and earlier, allowing remote attackers to supply crafted serialized input to a theme endpoint that performs unsafe deserialization. Successful exploitation can lead to full compromise of the confidentiality, integrity, and availability of the affected site, but the practical ceiling depends on whether a usable PHP POP gadget chain exists in the theme, an active plugin, or WordPress core. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS score should be weighed against the assessed AC:H rather than the reported AC:L.
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.
Unauthenticated PHP Object Injection in the ThemeREX Group Camelia WordPress theme (versions through 1.2.15) lets a remote attacker supply crafted serialized input that the theme passes to PHP's unserialize(), enabling injection of arbitrary PHP objects into the application's execution flow. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no authentication and no user interaction are required, and the potential impact spans full loss of confidentiality, integrity, and availability - typically realized as remote code execution, arbitrary file manipulation, or SQL injection when a usable POP gadget chain is reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); practical exploitability is gated by the availability of a viable gadget chain across the theme, WordPress core, or co-installed plugins.
Unauthenticated PHP object injection in the ThemeREX Convex WordPress theme (versions through 1.16.0) allows remote attackers to pass crafted serialized data to an unserialize() call, potentially leading to remote code execution, file manipulation, or SQL injection if a suitable POP gadget chain is present. The vulnerability is network-reachable with no authentication or user interaction required, but successful exploitation is dependent on the target environment loading a reachable gadget chain in the theme, an active plugin, or WordPress core; independent analysis therefore rates complexity as high (AC:H) despite the original Patchstack CVSS score of 9.8 (AC:L). No public exploit code or confirmed active exploitation has been identified at time of analysis.
PHP object injection in the ThemeREX Group Dwell WordPress theme (versions up to and including 1.16.0) allows unauthenticated remote attackers to send crafted serialized data to an unserialize() sink, which can lead to file deletion, SQL injection, or remote code execution if a usable POP gadget chain exists in the site's installed theme, plugins, or WordPress core. The published CVSS score is 9.8, but independent assessment rates attack complexity as high because real-world impact depends entirely on gadget-chain availability in the specific deployment; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a WordPress theme vulnerability reported by Patchstack and tracked as EUVD-2026-96188.
Unauthenticated PHP object injection in the ThemeREX Let's Play (playhockey) WordPress theme, versions through 1.1.15, allows remote attackers to pass crafted serialized data to an unserialize() call inside the theme, which can trigger object injection and may escalate to code execution, data theft, or full site compromise when a usable POP gadget chain is reachable. No vendor-released fixed version was identified and no public exploit code was identified at time of analysis. Exploitation is assessed as requiring a viable property-oriented programming gadget chain in the theme, installed plugins, or WordPress core, so the practical attack complexity is raised to High even though the attack surface remains network-reachable and unauthenticated.
PHP object injection in the Partiso WordPress theme (ThemeREX Group) through version 1.1.13 allows unauthenticated remote attackers to pass attacker-controlled serialized data into unserialize(), which per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector requires no credentials and no user interaction on a default installation. The 9.8 severity reflects the theoretical worst case of high confidentiality, integrity and availability impact, but actual exploitation depends on the presence of a usable POP gadget chain in the theme, a co-installed plugin, or WordPress core - without such a chain the practical impact is materially lower. No vendor-released patch version is stated in the available data, and no public exploit code was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.
Unauthenticated PHP object injection in the ThemeREX Group Rosalinda WordPress theme, affecting all versions through 1.2.4, lets remote attackers reach an unserialize() sink and inject arbitrary PHP objects. The reported CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), though independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because meaningful exploitation additionally requires a usable POP gadget chain in the theme, WordPress core, or an installed plugin; the deserialization primitive alone is inert without one. The CVSS vector confirms no authentication or user interaction is needed to reach the sink, and while the advisory does not name the specific endpoint or parameter, no public exploit code has been identified at time of analysis.
PHP object injection in the ThemeREX Group Smart Casa WordPress theme, affecting all versions up to and including 1.0.12, lets remote attackers supply crafted serialized input to an unserialize() call without authentication (CVSS PR:N/UI:N), with the vendor/Patchstack score reaching 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Meaningful impact - remote code execution, arbitrary file write, or SQL injection - depends on a usable POP gadget chain being reachable in the theme, WordPress core, or an installed plugin, which is why our independent assessment rates the vector at AC:H despite the 9.8 base score; sites running only the theme, or with a reduced plugin set, may be far less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but Patchstack's database entry (https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve) makes the flaw publicly documented and easily locatable by attackers.
ThemeREX Smash WordPress theme through version 1.12.0 contains a PHP object injection vulnerability (CWE-502) that is triggered when untrusted data is deserialized. The published CVSS 3.1 vector scores 9.8 Critical (AV:N/AC:L/PR:N/UI:N), indicating remote, unauthenticated, low-complexity exploitation, but the independent assessment raises attack complexity to High because a usable POP gadget chain must exist in loaded WordPress core, theme, or plugin code, and the advisory does not name the vulnerable parameter, endpoint, or sink. No public exploit identified at time of analysis; limiting factors include the theme's install base, the need for a reachable gadget chain, and the possibility that the vulnerable input is only accessible to authenticated users.
PHP object injection in the ThemeREX Tantra WordPress theme (versions through 2.9.0) allows unauthenticated remote attackers to trigger unserialize() on malicious input, potentially leading to arbitrary code execution, data theft, or site takeover if a usable POP gadget chain is present. The flaw is rated CVSS 9.8 (CWE-502) and requires no privileges or user interaction, though practical impact depends on the availability of a gadget chain in the theme, an installed plugin, or WordPress core. No public exploit code has been identified at the time of analysis.
Code injection in openapi-typescript-codegen through 0.31.0 allows attackers who control or influence an OpenAPI document to inject arbitrary JavaScript into generated TypeScript clients, which then executes when the client is imported or its service methods are called. Exploitation requires the victim to generate a client from an attacker-controlled spec (user interaction), and no public exploit code has been identified at time of analysis. The vendor/VulnCheck CVSS 4.0 base score is 9.3, though the independent assessment notes a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflecting the required user interaction; it is not listed in CISA KEV.
SQL injection in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin (versions 1.5.3 and earlier) lets an attacker inject arbitrary SQL through an unsanitized request parameter and read sensitive data from the site's underlying WordPress/WooCommerce database. The vendor-published CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) and the CWE is CWE-89; however, our independent assessment rates the same vector at PR:L because the vulnerability is titled a 'Subscriber' SQL injection, indicating that a logged-in low-privilege account (subscriber role) is the practical prerequisite - a requirement easily satisfied on sites with open user registration. Per the assessed vector this is an authenticated (PR:L), remotely reachable, network-based injection with no user interaction, high confidentiality impact, low availability impact, and no public exploit code identified at time of analysis; the CVSS privilege-level discrepancy between vendor (PR:N) and our assessment (PR:L) should be confirmed with the vendor.
Unauthenticated SQL injection in StyleMix's uListing WordPress plugin, affecting versions up to and including 2.2.0, allows remote attackers to inject arbitrary SQL into the site's backend database queries via an insufficiently sanitized plugin input. The assessed vector (AV:N/AC:L/PR:N/UI:N) means any network-reachable WordPress installation with the plugin active is exposed without credentials or user interaction, with confidentiality impact rated high and limited integrity impact; availability is unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact vulnerable parameter, request endpoint, and any required non-default configuration remain unconfirmed by the available Patchstack advisory, so the practical attack surface should be verified against the plugin source or vendor documentation.
Authenticated users of JeecgBoot through 3.9.5 can permanently delete data dictionaries and all of their items by sending DELETE requests to /sys/dict/deletePhysic/{id}, because the deletePhysic handler in SysDictController omits an authorization check (CWE-862); the hard delete bypasses the recycle bin and is irreversible. Any valid low-privilege account suffices - no administrator role, user interaction, or non-default configuration is required, only network access to the application and knowledge or enumeration of a target dictionary {id}. Publicly available exploit code exists, but there is no indication of confirmed active exploitation, and the impact is confined to integrity and availability of dictionary data (no confidentiality exposure or code execution), making this a moderate-severity insider or compromised-account threat.
Authenticated users on JeecgBoot through 3.9.5 can delete arbitrary sys_category dictionary nodes through the SysCategoryController delete handler, which performs no permission check, allowing low-privileged accounts to remove entire category subtrees and break dependent forms and dictionary-backed fields. The node identifiers needed for the attack are freely exposed by the unguarded rootList and childList endpoints, so no special configuration or elevated role is required - only a valid login, meaning the practical barrier is simply obtaining any account (publicly available exploit code exists, per a linked GitHub PoC). The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - a medium-severity, authorization-only flaw whose impact is bounded to integrity and availability of dictionary data, with no confidentiality exposure and no code execution; the reported CVSS 5.3 is consistent with that view.
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to destroy the platform's sys_category dictionary data by calling DELETE /sys/category/deleteBatch, an endpoint that performs the deletion without verifying the caller holds permission for that operation. The companion rootList and childList endpoints are equally unguarded, so the same user can enumerate node ids and submit them to recursively delete whole sys_category subtrees, breaking dependent forms and dictionary fields across the instance. Publicly available exploit code exists (a Python PoC that drives the console delete route), but the issue is a moderate data-loss/denial-of-function condition rather than a critical one: an account is required, impact is limited to integrity and availability of dictionary data, and there is no confidentiality exposure or code execution.
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated low-privileged user delete department permission bindings through the DELETE /sys/sysDepartPermission/deleteBatch endpoint, silently stripping the menus and buttons a department can grant to its roles. Exploitation requires only a valid low-privileged session (CVSS vector PR:L) with no admin rights and no user interaction, because the companion list endpoint is also unguarded and exposes the row ids that must be submitted in the ids parameter. Publicly available exploit code exists, including a published Python PoC, and no confirmed active exploitation is reported in the available intelligence sources; with integrity and availability impact limited to permission records and no confidentiality loss, this is a moderate-risk authenticated authorization flaw rather than a critical one.
Authenticated low-privileged users can delete department permission bindings in JeecgBoot through 3.9.5 by calling the SysDepartPermissionController delete handler, which performs no authorization check (CWE-862). Because the corresponding list endpoint is also unguarded, an attacker can enumerate the required row ids and then issue DELETE requests that strip menu and button grants from department roles, degrading the instance's RBAC configuration. Publicly available exploit code exists, and the flaw affects default deployments, but the impact is bounded to integrity/availability of permission data - no data disclosure and no privilege escalation beyond RBAC degradation - which is why the vendor score is a moderate 5.3.
Deletion of arbitrary message records in JeecgBoot through 3.9.5 is possible by low-privileged authenticated users due to missing authorization in the SysMessageController deleteBatch handler. Attackers can obtain record IDs from an unguarded list endpoint and submit them to deleteBatch to remove pending queued messages, disrupting notification delivery. Publicly available exploit code exists, but the vulnerability is not listed in CISA KEV, and the CVSS 4.0 score is 5.3, indicating moderate severity.
Authenticated, low-privileged users of JeecgBoot through 3.9.5 can delete arbitrary audit log records because the SysLogController delete handler performs no authorization check, allowing an attacker holding any valid login to erase traces of their activity. Log identifiers are freely obtainable from the unguarded /sys/log/list endpoint, so the attack needs no elevated role, only a session. Publicly available exploit code exists (a Python PoC for the log-delete request), and the impact is limited to integrity and availability of log data with no confidentiality exposure.
Any authenticated user, including low-privileged accounts, can delete organizational positions in JeecgBoot 3.9.5 and earlier by exploiting a missing authorization check in the SysPositionController deleteBatch handler. Attackers harvest valid position IDs from an unguarded list endpoint and submit them as a comma-separated list, destroying sys_position records and orphaning user-position assignments. This is a moderate-severity data-destruction issue, reflected by the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L; publicly available exploit code exists, but no active exploitation is confirmed in CISA KEV.
Missing authorization in JeecgBoot through 3.9.5 lets any low-privileged authenticated user delete SMS message templates by issuing a DELETE request to /sys/message/sysMessageTemplate/deleteBatch with comma-separated IDs harvested from the separately unguarded template list endpoint. The result is integrity and availability loss confined to the sys_sms_template table - deletion of all template rows breaks template-driven notifications such as workflow reminders - with no confidentiality exposure, making this a genuine but moderate-severity issue rather than a top-priority emergency. Publicly available exploit code exists (a PoC script deleting routes is published on GitHub), but there is no confirmation of active exploitation (not in CISA KEV), and exploitation still requires a valid authenticated session plus network reachability to the management API.
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to delete AI evaluator records via the AiragExtDataController deleteBatch handler. The endpoint DELETE /airag/extData/deleteBatch accepts comma-separated IDs and lacks owner or tenant checks, enabling deletion of other users' evaluator and test-tracking records. Publicly available exploit code exists, but exploitation requires a valid low-privileged session and the AiRAG module to be enabled; this is a medium-severity broken access control issue (CWE-862) with no confidentiality or code execution impact.
Authenticated users of JeecgBoot through 3.9.5 holding only low privileges can delete other users' AI evaluator and test-tracking records by sending a DELETE request to the /airag/extData/delete endpoint with an arbitrary id value, because the AiragExtDataController delete handler performs no owner or tenant ownership check (CWE-862). The flaw is remote and network-reachable and requires a valid session (CVSS PR:L), so anonymous attackers cannot exploit it, and the impact is limited to integrity and availability of AI-RAG records rather than confidentiality loss or code execution. Publicly available exploit code exists (a Python PoC is published on GitHub), but there is no CISA KEV confirmation of active exploitation; independent assessment rates this as a genuine but moderate-severity access-control issue, with the missing tenant check acting as a risk amplifier in multi-tenant deployments where cross-tenant deletion becomes possible.
Missing authorization in JeecgBoot 3.9.5 and earlier allows any authenticated low-privileged user to publish or unpublish AI applications owned by other users by sending a POST request to /airag/app/release, enabling them to harvest share tokens that expose other tenants' AI applications to anonymous chat access or to invalidate existing share links. The defect is CWE-862, and the assessed impact is limited to low integrity and low availability with no confidentiality loss, scored 5.3 (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L; vendor-supplied CVSS 4.0 vector similarly shows PR:L with VI:L/VA:L). Publicly available exploit code exists, but there is no confirmation of active exploitation (no CISA KEV listing in the provided data). Because the vector requires PR:L and UI:N, the realistic threat is an insider or an attacker holding compromised low-privileged credentials with network reachability to the airag module, not an anonymous internet attacker.
Missing authorization in JeecgBoot through version 3.9.5 allows authenticated low-privileged users to delete arbitrary word templates from the shared library via the /airag/word/deleteBatch endpoint. The flaw resides in the AigcWordTemplateController's deleteBatch handler, which fails to enforce proper access controls (CWE-862), enabling an attacker with any valid account to permanently remove templates by sending a DELETE request with comma-separated IDs. Publicly available exploit code exists, and while the impact is limited to integrity and availability of templates (no confidentiality loss), it represents a medium-severity, low-priority risk for deployments exposing the AIRAG module to semi-trusted users.
Deleting word templates in JeecgBoot through 3.9.5 is not access-controlled: the AigcWordTemplateController delete handler behind DELETE /airag/word/delete accepts an id parameter from any authenticated account and permanently removes the referenced template from the shared library, including templates owned by other users. Exploitation is remote and requires only a valid low-privileged JeecgBoot login (CVSS PR:L) with the AIRAG word-template module deployed and reachable; publicly available exploit code exists, though there is no confirmation of active exploitation in the wild. Impact is confined to integrity and availability of the template library - no data disclosure, no code execution - making this a genuine but low-tier priority where exposure depends on how freely low-privileged accounts are provisioned.
Authenticated low-privileged users of JeecgBoot through 3.9.5 can delete arbitrary shared OCR prompt records via the AiOcrController deleteById handler, which performs no authorization or ownership check. Attackers first enumerate record IDs from the unguarded GET /airag/ocr/list endpoint and then repeatedly invoke the delete action, wiping records stored in Redis. Publicly available exploit code exists (GitHub PoC), and the issue is rated moderate (assessed CVSS 3.1 5.3, PR:L) because it requires a valid account and only affects availability/integrity of OCR records, with no confidentiality or code-execution impact.
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to bypass the system:checkRule:add permission check in the SysCheckRuleController importExcel handler and bulk-create system-wide encoding validation rules from a crafted Excel workbook. Publicly available exploit code exists (a Python PoC published on GitHub), though there is no confirmed active exploitation (CISA KEV) and no EPSS score was supplied; the CVSS v4.0 base score is 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) and our independent assessment rates it as a medium-severity, lower-tier priority issue rather than an urgent emergency. Exploitation requires a valid low-privileged account (PR:L), so exposure is highest where JeecgBoot is internet-facing or where self-registration or weak account provisioning is enabled; impact is confined to the integrity of validation rules, with no direct data disclosure or service outage.
Blind SQL injection in the Tickera WordPress event ticketing plugin, affecting versions through 3.6.0.6, lets a remote attacker inject crafted input into a plugin SQL query and exfiltrate database contents one inference at a time. The vulnerability is scored by its reporter at CVSS 9.3 (network reachable, low complexity, scope-changing, high confidentiality impact), while our own assessment is more conservative - CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:N/A:N - because the specific vulnerable endpoint or parameter is not named and Patchstack-documented plugin SQLi issues frequently require a logged-in role. The supplied vector states PR:N (unauthenticated) but the alternative assessment assumes PR:L, so authentication requirements are not confirmed from the available data; no public exploit code and no confirmed active exploitation were identified at time of analysis. Because exploitation is blind and inference-based, extraction is slower than a direct-query injection, though AC:L means it remains automatable once a working payload path is found.
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated low-privileged user read scheduled-job records - class names, cron expressions, job parameters and status - by issuing GET /sys/quartzJob/queryById with a job id, data otherwise reserved for administrators. Publicly available exploit code exists (no CISA KEV entry), and the issue carries a CVSS 5.3 score with an independently assessed vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, so impact is confined to confidentiality of job metadata with no write, code-execution or denial-of-service capability. Treat this as a genuine but bounded-severity issue at low-to-moderate priority: exploitation requires a valid low-privileged account against a network-reachable instance and yields only information disclosure that may assist further attacks.
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to read object storage file records via the OssFileController queryById handler (GET /sys/oss/file/queryById), exposing original file names and direct storage URLs of other users' uploads. Publicly available exploit code exists, though the issue requires a valid authenticated account and knowledge of a target record ID, which appears enumerable. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates modest confidentiality impact, and no active exploitation (CISA KEV) is confirmed.
JeecgBoot through 3.9.5 exposes an authorization gap in the OpenApiController.queryPageList handler, letting any authenticated user - including a low-privileged one - retrieve the OpenAPI registry listing via GET /openapi/list and read virtual paths, internal origin URLs, IP whitelists, and header/parameter templates meant for administrators. Exploitation requires only a valid, non-admin JeecgBoot session (CVSS PR:L) and publicly available exploit code exists, though no active exploitation has been confirmed via CISA KEV; the CVSS 3.1 assessment scores it 5.3 as a read-only confidentiality disclosure with no integrity or availability impact, and EPSS data was not provided. The practical risk is moderate: the leak itself does not grant code execution, but it hands an attacker the internal routing and gateway configuration needed to plan follow-on attacks against otherwise hidden backend services.
Missing authorization in JeecgBoot through 3.9.5 allows any authenticated user, including a low-privileged one, to read the role codes of arbitrary accounts by supplying a chosen userId to the endpoint GET /sys/api/getRolesByUserId. The flaw is a CWE-862 absence of an ownership or permission check in the getRolesByUserId handler of SystemApiController, so a valid session - not administrative rights - is the only prerequisite. Impact is limited to information disclosure useful for reconnaissance (identifying administrator accounts and mapping role assignments), with no write or availability effect; publicly available exploit code exists, and EPSS/KEV data indicate no confirmed active exploitation at time of analysis.
Missing authorization in the JeecgBoot SystemApiController.getUserPermissionSet handler (JeecgBoot through 3.9.5) lets any authenticated low-privileged user read the full permission code set of any other account, including administrators, by passing an arbitrary userId to GET /sys/api/getUserPermissionSet. The handler never verifies that the requester is entitled to read the supplied user's permissions, so exposure is limited to confidentiality of permission codes rather than modification or account takeover. Publicly available exploit code exists (a Python PoC is published alongside the VulnCheck advisory), but there is no indication of confirmed active exploitation (CISA KEV) at time of analysis; the practical barrier is the requirement for a valid login, which restricts realistic abuse to insiders, compromised accounts, or instances permitting self-registration or guest accounts. Impact is rated low on confidentiality (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with no integrity or availability effect.