Information disclosure in the Dokan multivendor marketplace plugin for WordPress (versions before 5.2.0) lets any authenticated vendor read the commission rate and fixed fee that the marketplace administrator configured for other vendors, simply by requesting a commission calculation for someone else's vendor identifier. The root cause is a missing ownership check (CWE-200 information exposure) on the commission-calculation feature, which is reachable by a logged-in vendor account - a low barrier on marketplaces that allow self-service vendor registration. Publicly available exploit code exists per the WPScan advisory, no CISA KEV listing has been recorded, and impact is confined to disclosure of pricing configuration: there is no data modification, privilege escalation, or service disruption. The vendor has released a fix in version 5.2.0, and the independent assessment confirms this as a genuinely low-severity issue with a consistent risk picture.
Authenticated information disclosure in the Envira Gallery WordPress plugin affects all versions before 1.16.2, allowing any user who can create or edit a gallery - Author role and above by default - to retrieve the title and excerpt of other users' private, draft, pending, and trashed posts that WordPress would normally withhold. The flaw is a missing authorization check (CWE-200) on the image identifier supplied when adding media to a gallery, and it is rated low severity (vendor CVSS 2.7, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N; our independent assessment lowers the privilege requirement to PR:L since Author is the default capability for gallery editing). Publicly available exploit code exists, but there is no indication of confirmed active exploitation, and a vendor fix is available in version 1.16.2.
Authenticated users with the lowest-tier Trainer role in the Squadeno WordPress plugin before 1.12.0 can modify metadata of sports they are assigned to-section, age group, author, password, comment settings, and date-by exploiting a save path that does not re-apply the plugin's authorization restrictions. This is an incorrect authorization flaw (CWE-863) with a low CVSS base score of 2.7, and publicly available exploit code exists, though no active exploitation has been confirmed. Upgrading to version 1.12.0 resolves the issue.
Envira Gallery, a WordPress gallery plugin, fails to verify that a user is authorized to read a gallery before rendering it in versions before 1.16.2, letting an authenticated attacker with author-level publishing privileges embed another user's gallery and expose its non-public metadata to unauthenticated visitors. Publicly available exploit code exists, and the vendor has released a fix in 1.16.2. The measured risk is low (CVSS 2.7), because exploitation requires an author-level account on a multi-author site and disclosure is limited to gallery metadata rather than full account or site compromise.
Envira Gallery before 1.16.2 contains a missing authorization flaw in its gallery-conversion feature, allowing an authenticated WordPress user with contributor-level access to create and publish gallery posts that the plugin's settings would otherwise withhold from them. Publicly available exploit code exists, but impact is limited to gallery content integrity; there is no code execution, data disclosure, or site takeover, and upgrading to 1.16.2 remediates the issue.
Denial of service in zhayujie CowAgent through version 2.2.0 allows an authenticated, low-privileged user to disrupt the availability of the Markdown Rendering component by submitting crafted Markdown content to the Markdown.tsx code path. The CVSS 4.0 score is only 2.1 (our independent CVSS 3.1 assessment is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), reflecting a low-impact, availability-only issue with no confidentiality or integrity loss. Publicly available exploit code exists (a proof-of-concept report is published in a GitHub repository), and the vendor was contacted early but did not respond, so no official patch or advisory is available; the flaw is not listed in CISA KEV and no active exploitation is confirmed.
Denial of service in zhayujie CowAgent through 2.2.0 lets a low-privilege authenticated remote attacker exhaust process resources by supplying attacker-influenced streaming tool-call arguments that are passed unbounded to json.loads inside the agent's Streaming Tool-Call Argument Handler. The issue is rated CVSS 2.1 / CVSS:4.0 (AV:N/AC:L/PR:L/UI:N/VA:L, E:P), so impact is confined to limited availability with no confidentiality or integrity effect, and the affected project is a niche open-source LLM agent framework with limited deployment. Publicly available exploit code exists (a proof-of-concept report is published on GitHub), but there is no confirmed active exploitation (CISA KEV); the vendor was contacted and did not respond, so no patched release has been confirmed.
Denial of service in zhayujie CowAgent (up to and including 2.1.7) allows an authenticated remote user with low privileges to tie up server resources through the Web Console by manipulating the session_id argument processed in channel/web/web_channel.py. The flaw is an improper resource shutdown/release condition (CWE-404) that degrades availability only - there is no data exposure or integrity impact, and reachability requires network access to the Web Console plus a valid low-privileged session. Publicly available exploit code exists (an exploit report is linked from the CVE references) and the vendor was notified early, but there is no confirmed active exploitation (not in CISA KEV); version 2.1.7 commit dec28324 only partly mitigates the issue via a 512MB request-body cap.
Denial of service in zhayujie CowAgent 2.1.6 and earlier allows an authenticated remote attacker with a low-privilege session to trigger resource exhaustion via the read function of the /upload endpoint in the Web Console component. Publicly available exploit code exists, but there is no confirmation of active exploitation. The vendor did not respond to disclosure and no patch is confirmed; risk is low-to-moderate and should not be prioritized ahead of more impactful issues.
Path traversal in ag2ai AG2 through version 0.13.4 allows an attacker who can influence the filename argument consumed by UserProxyAgent's os.path.join call to escape the intended working directory and read or write files with the privileges of the host process. Impact is bounded rather than catastrophic: the CVSS vector specifies PR:L, so some authorized or authenticated interaction with the agent is required, and the host application must route attacker-influenced input into that filename argument, meaning the in-process library code is not directly reachable by an unauthenticated remote attacker. Publicly available exploit code exists (a public report demonstrating legacy filename handling in a Docker environment), but there is no confirmed active exploitation and no CISA KEV listing; the vendor was contacted and did not respond, and no vendor-released patch has been identified at time of analysis.
Unbounded memory allocation in the media download handler of zhayujie CowAgent through version 2.1.9 allows an authenticated participant in a connected messaging channel (the patched code covers DingTalk and Feishu media paths) to exhaust the agent's process memory by supplying oversized or unvalidated remote media, producing a denial-of-service condition with availability-only impact. Publicly available exploit code exists (a proof-of-concept report is published on GitHub), but there is no confirmation of active exploitation (not listed in CISA KEV), and the exposure is limited because the attacker must already be able to deliver a media message through the bot's channel rather than reaching it anonymously over the internet. The vendor resolved the issue by routing all channel downloads through a size-bounded helper in version 2.2.0.
Use-after-free in GPAC's filter queue (gf_fq_pop in filter_core/filter_queue.c) allows an attacker who supplies a crafted MP4/media file to crash or corrupt memory in MP4Box builds through 26.07.0. Exploitation is not confirmed in the wild (no CISA KEV entry), but publicly available exploit code exists (the PoC archive linked from the VulDB report), and per the independent assessment the realistic attack path is local/UI-driven: the victim or an automated transcoding pipeline must feed the malicious file to MP4Box, with the impact limited to Low confidentiality, integrity and availability (crash or constrained memory corruption, not confirmed code execution). Because there is no listening network service and user interaction is required, this is a low-priority issue despite the 'remote' framing used in the vendor-style CVSS 4.0 vector.
Server-side request forgery in Studio-Saelix Sencho up to 0.94.1 allows an authenticated user who can configure git sources to make the backend issue outbound HTTP/HTTPS connections to attacker-chosen internal addresses by manipulating the repo_url argument handled by outboundTarget.ts in the git-sources Browse API endpoint. Exploitation requires a valid session with git-source administration rights (CVSS 3.1 PR:L), and impact is limited to low confidentiality - internal request issuance and response exposure - with no integrity or availability effect; publicly available exploit code exists, though no confirmed in-the-wild activity has been reported. The vendor disputes the CVE characterization, arguing repository access to private LAN, VPC, VPN, CGNAT and IPv6 ULA ranges is an intentional administrative feature rather than a privilege-boundary bypass, while nonetheless shipping defense-in-depth hardening.
Use-after-free in GPAC's MP4Box media packaging tool (all builds through 26.07.0) can be triggered when the utility parses a malformed or attacker-supplied media file, corrupting memory in the affected process. The fault lives in the gf_mx_v() helper in utils/os_thread.c and is reached through the file-parsing path, not through any listening network service, so exploitation requires someone or an automated pipeline to run MP4Box on the hostile input. Publicly available exploit code exists (a PoC archive is linked from the advisory), the vendor was contacted early but did not respond, and there is no indication of active exploitation (no CISA KEV listing); impact is limited to availability of the processing process rather than confidentiality or integrity of the host.
Server-side request forgery (SSRF) in elvix-sdk versions up to 0.10.1 allows remote attackers with low-privileged authenticated access to the MCP Request Handler to manipulate the 'path' argument in src/mcp/index.ts, causing the server to make arbitrary outbound requests. Publicly available exploit code exists, though no confirmed active exploitation has been observed. The vendor was contacted but did not respond, and no patch is available, leaving mitigation to compensating controls.
Server-side request forgery in Studio-Saelix Sencho up to 0.97.1 allows an authenticated user with node-management permission to supply a crafted URL to the Add Remote Node API endpoint, where the isValidRemoteUrl function in backend/src/utils/validation.ts fails to block server-side requests. Publicly available exploit code exists, and the CVSS 4.0 base score is 2.0; the independent assessment also rates this as a low-priority issue. Per the vendor, the issue demonstrates server-side request capability but not arbitrary internal response exfiltration, so confidentiality, integrity, and availability impact are limited.
An out-of-bounds memory read in the Zephyr RTOS zbus proxy agent IPC backend allows a peer domain that already controls its own firmware - typically a second core on the same SoC - to leak a small amount of adjacent memory into the receiving domain's log output. The flaw is a non-NUL-terminated channel_name[] array being printed with a plain %s conversion on the frame-rejection error path; it is only reachable when CONFIG_ZBUS_PROXY_AGENT_IPC is built and logging is at warning level or higher (the default). Impact is bounded to limited information disclosure (CVSS 3.4, AV:L/PR:H, C:L/A:L) and a possible fatal fault if the scan leaves a mapped region; there is no public exploit identified at time of analysis and no confirmed active exploitation.
Symlink-following file writes in thClaws through 0.141.0 let an attacker who can pre-plant a symbolic link under the permitted inputs/ prefix redirect a later authenticated upload to the v1 API POST /v1/inputs endpoint, causing the post_inputs handler to write or truncate files outside the workspace with daemon privileges. Exploitation requires two preconditions in sequence - the staged symlink plus a real authenticated upload targeting that path - so a single remote request cannot trigger it, and the resulting impact is confined to file integrity and availability with no confidentiality disclosure. All available signals rate this as a low-priority issue and are mutually consistent: the vendor records CVSS 2.3, our independent assessment is CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L, and no public exploit code was identified at time of analysis.
JupyterHub deployments through 6.0.1 that run in multi-user mode with the named-server feature enabled allow an authenticated low-privilege user to hijack the OAuth client identity of another user's named server by registering a hyphenated username that collides with the victim's client identifier (for example, an attacker named 'alice-prod' overwrites the client used by user 'alice' for server 'prod'). The overwrite breaks the victim's OAuth login flow and revokes their tokens when the attacker stops their own server, producing a targeted, account-level denial of service rather than a broad compromise; it requires the attacker to hold an authenticated account whose name they can control and to know the victim/target server combination in advance. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor-assigned CVSS 4.0 base score is 2.3, consistent with an independent assessment of LOW severity.
Stored cross-site scripting in open-computer-use through commit 610bac8 lets an attacker who controls content the agent observes (such as a web page or run_command output) inject script into the generated log.html, which then executes when a human operator opens the log and can exfiltrate transcript contents. Exploitation requires both attacker-controlled sandbox content and operator interaction, so this is a low-priority issue (CVSS 2.3, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) rather than a directly exploitable server-side compromise; no public exploit identified at time of analysis.
Authorization bypass in UnicomAI Wanwu through 0.6.5 allows any authenticated user to mint an AppKey bound to another user's MCP server by POSTing that victim's MCP server UUID with appType=mcpserver to /v1/appspace/app/key, after which the attacker can open MCP sessions and invoke the victim server's tools under the victim's upstream credentials. The attack is remote with no user interaction, but is gated by valid account credentials (PR:L) and prior knowledge of the target MCP server UUID, which is why the assessed vector carries AC:H and only low confidentiality and integrity impact (C:L/I:L, no availability impact). No public exploit code or confirmed active exploitation was identified at time of analysis, and the overall risk is low-priority per both the CVSS 4.0 base score of 2.3 and the independent CVSS 3.1 assessment of AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N.
Authorization bypass in Lightdash through 2.556.0 allows any authenticated organization member to delete another user's personal access token by supplying that token's UUID to the personal-access-tokens DELETE route, which performs no ownership or organization check - the deletion also succeeds across organization boundaries in multi-tenant or hosted deployments. Impact is limited to revoking the victim's token and breaking the API integrations that depend on it (a denial-of-service against integrations); there is no data disclosure, privilege escalation, or code execution. Exploitation requires an authenticated account with at least organization-member privileges and knowledge of the victim's PAT UUID, which is not practically enumerable and is the primary limiting factor; no public exploit code identified at time of analysis, though a third-party technical writeup of the flaw is referenced, and both the supplied CVSS 4.0 score (2.3) and the independently assessed CVSS 3.1 vector rate this as a low-severity issue.
Information disclosure in CloudBeaver through 25.3.5 allows an authenticated remote web session holder to read other users' exported LOB files from the shared LOB-export folder served by WebSQLResultServlet. Exploitation is practically constrained: the attacker must already have a valid session, know or guess the victim's table and column names, and enumerate second-resolution timestamps to reconstruct valid export filenames, and the impact is limited to confidentiality. No public exploit has been identified at time of analysis, and the assessed vector plus these prerequisites indicate genuinely low real-world risk, with the greatest concern in multi-tenant instances shared by untrusted users.
Shepherd (shepherd-ai) through 0.3.1 contains a DNS-rebinding bypass of the citation-checker's public_url SSRF guard, letting an attacker who controls authoritative DNS for a reference URL planted in a checked document redirect the outbound fetch to internal HTTP(S) services and capture the responses inside evidence files. Exploitation requires the shepherd_citation_checker extra to be in use and a victim to actually run a citation check on the attacker-influenced document, then win a time-of-check/time-of-use race in which the guard validates a public IP but the connection re-resolves the hostname to an internal address; no public exploit identified at time of analysis. Impact is read-only information disclosure (low confidentiality, no integrity or availability effect), consistent with the low CVSS 4.0 base score of 2.3 and the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, and the attacker does not need credentials but does need user interaction and DNS control.
Cross-tenant workflow hijacking in iFlytek Astron Agent through 1.1.2 lets an authenticated application on a shared deployment inject content into another tenant's paused workflow and read its continuation output stream by supplying the victim's event_id to POST /workflow/v1/resume. Exploitation requires a valid authenticated application identity (PR:L in the assessed vector) plus a victim workflow that is currently paused awaiting resume; the enabling weakness is that event_id values are time-ordered Snowflake identifiers that are predictable rather than cryptographically random. Severity is genuinely low (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), there is no CISA KEV entry, no public exploit identified at time of analysis, and the cross-tenant impact disappears entirely on single-tenant or otherwise isolated deployments.
Traccar 5.7 through 6.16.0 can log a victim into an attacker-controlled account via a cross-site request forgery flaw in its OpenID Connect callback, causing data the victim enters, such as registered devices, to be stored in the attacker's account. Exploitation requires the non-default OIDC/OAuth SSO configuration plus user interaction, with the supplied CVSS 4.0 score of 2.3 and the independent assessment CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N both indicating low impact. No public exploit identified at time of analysis; this is not an account takeover of the victim and does not permit code execution or availability impact.
An authenticated user with low privileges on an InstantCMS 2 (icms2) installation running version 2.18.2 or earlier can manipulate the 'size' argument passed to the image handler's file-deletion routine, using path-traversal sequences to delete files outside the intended upload directory. Impact is limited to availability and, to a lesser degree, integrity of files on the server - there is no confidentiality gain per the assessed vector - but deletions can break the site or remove stored content. Publicly available exploit code exists for this issue, and while it is not confirmed as actively exploited (no CISA KEV listing), the vendor has published a fix commit, so unpatched instances should be prioritized for update. EPSS data was not provided for this CVE.
SQL injection in erzhongxmu JEEWMS (warehouse management system) through 2026.09.27-W39 lets an authenticated remote user inject arbitrary SQL via the 'searchstr' argument of the notice search endpoint handled by WvNoticeController.list. Publicly available exploit code exists, and the maintainer was contacted early but did not respond, so no vendor-supplied fix has been published; there is no indication of confirmed active exploitation (no CISA KEV entry). Impact is bounded by the privileges of the application's database account (Low confidentiality, integrity, and availability), and exploitation requires a valid low-privileged session (CVSS PR:L).
SQL injection in erzhongxmu JEEWMS (versions up to 2026.09.27-W39) allows an authenticated remote attacker to inject arbitrary SQL through the binstore, binid, des, or cengshu parameters handled by the getbinall and getbinallagv functions of MdBinController.java, potentially reading or altering database content. The CVSS v4.0 base score is 5.3 (assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), reflecting low-level confidentiality, integrity, and availability impact rather than full database takeover. A public exploit has been published and may be used, but there is no KEV confirmation of active exploitation; the vendor was contacted and did not respond, so no official fix is documented. Because exploitation requires a valid low-privileged JEEWMS session (PR:L in the assessed vector), risk is concentrated in deployments where the warehouse management interface is network-reachable and credentials are shared or weakly managed.
SQL injection in Furion .NET Framework up to 4.9.9.92 allows an authenticated low-privilege attacker to manipulate the 'Name' argument processed by String.Replace in framework/Furion/Templates/Extensions/StringRenderExtensions.cs, potentially altering database queries. Publicly available exploit code exists, and the vendor was contacted but did not respond, so no official patch has been released. Network exploitation requires a valid low-privilege session (CVSS 4.0 score 5.3, E:P); no CISA KEV active exploitation is indicated.
Crafted ABC Music Format files cause uncontrolled resource consumption in libmodplug up to and including 0.8.9.1, where the abc_add_gchord() routine in src/load_abc.cpp can be driven into excessive CPU/memory use, resulting in a denial-of-service condition (crash or hang) of the hosting application. The issue is remotely triggerable but not self-triggering: per the assessed vector (UI:P/UI:R), an attacker must get a victim or an ingesting application to open the malicious .abc file, and impact is limited to availability (VA:L) with no code execution or data disclosure. Publicly available exploit code exists (CVSS 4.0 E:P proof-of-concept maturity), but there is no confirmed active exploitation (CISA KEV) and no EPSS signal was supplied; the vendor was contacted early but did not respond, so no fixed version is confirmed.
An authenticated authorization bypass (IDOR) in BerriAI LiteLLM up to and including 1.95.0 allows a low-privileged user holding any valid proxy API key to read spend and usage logs belonging to other users, keys, or teams by supplying a foreign session_id to the Spend Tracking UI endpoint ui_view_session_spend_logs. Exploitation requires a valid credential (CVSS PR:L) but no user interaction, and the impact is limited to confidentiality - an attacker can view another tenant's token counts and cost data but cannot modify records or disrupt service. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and VulDB reports a published exploit), but there is no confirmed active exploitation (CISA KEV); the realistic risk is materially higher in multi-tenant or shared-proxy deployments where tenant isolation matters, and low in single-tenant or trusted-internal installations. Vendor-released patch: v1.96.0.
SQL injection in highwarden Super Store Finder 3.8 and earlier allows an attacker who can reach the /products/superstorefinder/index.php endpoint and holds low-level application privileges to inject arbitrary SQL through the lat and lng request parameters, giving limited read and write access to the backend database. Publicly available exploit code exists, but the flaw is not listed in CISA KEV, so it is not confirmed as actively exploited; the vendor has already shipped version 3.9 to fix it. With a CVSS 4.0 base score of 5.3 and only low confidentiality, integrity and availability impact, this is a moderate, not high-priority, issue whose real-world reach is constrained by the authentication prerequisite and the product's limited deployment footprint.
Server-side template injection in Furion .NET Framework up to and including 4.9.9.95 allows an authenticated, low-privileged user to have attacker-supplied template expressions evaluated by the ViewEngine.RunCompile routine, potentially disclosing or tampering with data rendered through the view engine. The flaw is rated moderate (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 5.3, AV:N/AC:L/PR:L/UI:N, C:L/I:L/A:L) and is only reachable where a deployed application routes user-influenced content into RunCompile. Publicly available exploit code exists, and no CISA KEV entry confirms active exploitation.
Server-side request forgery in Casdoor's CAS proxy-validation handler (CasP3ProxyValidate in controllers/cas.go) lets a low-privilege authenticated user who already holds a valid CAS service ticket supply a crafted pgtUrl callback value and make the Casdoor server issue outbound HTTP requests to an arbitrary destination of the attacker's choosing. Only deployments that expose the CAS protocol endpoints and use CAS proxy authentication in versions up to 3.164.0 and 4.10.0 are affected, and because the pre-patch code fetches the attacker-supplied URL with http.DefaultClient.Do without destination validation, redirect restrictions, or a timeout, the practical impact is a blind or limited SSRF (some confidentiality exposure, no integrity or availability impact) rather than full compromise of internal services. Publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV listing), and the assessed severity is genuinely low, so this is a low-priority hardening item for CAS-enabled Casdoor instances rather than an emergency patch; upgrading to 4.11.0 resolves it.
Improper authorization in BerriAI LiteLLM through version 1.94.0 allows an authenticated low-privilege user to manipulate the api_key argument handled by get_secret() in secret_managers/main.py (Secret Resolution component), causing secrets to be resolved for credentials the caller should not be able to reference. Exploitation requires an authenticated account on a deployment that exposes LiteLLM's secret-resolution path to non-trusted users (multi-tenant proxy setups); confidentiality, integrity, and availability impact is assessed as low, and single-user or trusted-operator installations face negligible exposure. Publicly available exploit code exists, but no CISA KEV entry confirms active exploitation, and the vendor did not respond to the disclosure, so no fixed version has been confirmed.
Insufficient authenticity verification in the PayPal billing handler of InstantSoft icms2 (version 2.18.2 and earlier) lets an authenticated remote user forge a PayPal order by manipulating the 'bid' and 'sig' arguments, causing the application to accept payment notifications it should have rejected. Exploitation requires the Billing Module to be enabled with PayPal configured as a payment method and a low-privileged account able to start a billing/PayPal order; the impact is limited to integrity (fraudulent order acceptance) with no confidentiality or availability effect. Publicly available exploit code exists (the disclosed CVSS 4.0 vector carries E:P), and the vendor was contacted but did not respond, so no vendor-released patch is identified at time of analysis; the flaw is not confirmed actively exploited (CISA KEV).
SQL injection in the erzhongxmu JEEWMS warehouse management system (versions up to 2026.09.27-W39) allows an authenticated user to inject arbitrary SQL through the 'searchstr' argument processed by the WvGiController.list endpoint, enabling unauthorized reads of database contents and potentially modification or deletion of records. Both the supplied CVSS 4.0 vector (PR:L, E:P) and our independent assessment require a valid low-privilege session before the payload can be delivered, which keeps the rating moderate (CVSS 4.0 base 5.3) and bounds realistic exploitation to insiders or attackers who have already acquired credentials rather than anonymous internet-wide attacks. Publicly available exploit code exists, and the vendor was contacted about the disclosure but did not respond, so no official fix has been published at time of analysis.
SQL injection in erzhongxmu JEEWMS (versions up to 2026.09.27-W39) lets an authenticated attacker who supplies a crafted 'goodscode' argument to the docheck handler in WmOmNoticeHController.java manipulate the underlying SQL query. The CVSS v4.0 score is only 2.1 (Low) and our independent re-scoring lands at CVSS 3.1 5.4 (Medium) because exploitation requires a valid low-privileged session (PR:L), yields limited confidentiality and integrity impact, and is confined to one parameter of one controller. Exploit code is publicly available, but there is no CISA KEV entry and no evidence of active exploitation; the vendor was contacted and did not respond, so no official patch is identified. Overall this should be treated as a low-priority hardening item rather than an urgent exposure.
Cross-site scripting in Deep Chat through 2.5.1 enables remote attackers to inject javascript: links into AI responses, addMessage content, or loaded history because the embedded Remarkable markdown renderer disables link scheme validation; victims must click the crafted link for script execution in the embedding page. The flaw requires the attacker to first place malicious Markdown into the chat stream-typically via control over the AI backend, supplied history, or a reflection path-and no authentication is needed, though user interaction is decisive. This is a genuinely low-priority issue despite being a real XSS flaw, and no public exploit code was identified at time of analysis.
Stored cross-site scripting in InstantCMS 2 (icms2) up to 2.18.2 lets an authenticated low-privilege user inject script through the user 'nickname' field, which is rendered unescaped into the title attribute of contact links in the Private Message Handler templates (templates/default and templates/modern, controllers/messages/index.tpl.php). When a victim views the private-message contact list, the injected markup executes in their browser session, which can lead to session or content manipulation within the CMS, and because the payload is stored on the profile it can trigger whenever a contact list is rendered. An exploit has been disclosed publicly and may be used, but the issue is not confirmed as actively exploited (no CISA KEV listing); the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a moderate, interaction-dependent risk rather than an urgent remote-code-execution-class flaw.
Symlink-following path handling in the answer-me-with-html `am` CLI (through version 0.5.0) causes `am render` to embed files from outside the repository checkout - potentially SSH keys, config files or other data readable by the victim's process - into the generated HTML, which then leaks them if that output is shared or published. The attack is narrow: an attacker must deliver a crafted repository (local vector, AT:P), the victim must deliberately render it (passive user interaction), and the targeted file must be readable by the victim's process, which is why the CVSS 4.0 base score is only 2.0 (AV:L/AC:L/AT:P/PR:N/UI:P, confidentiality low, no integrity or availability impact). No public exploit code and no confirmed active exploitation were identified at time of analysis; the CVSS vector carries PR:N, so no authentication is required, and our independent assessment rates this as a low-priority, low-real-risk issue despite being a genuine vulnerability.