Path traversal in copyparty before 1.20.19 allows a low-privileged authenticated FTP/FTPS user to create a new file outside configured volumes when FTP or FTPS is explicitly enabled. Exploitation requires the non-default FTP/FTPS configuration and a valid low-privileged account; the attacker cannot read or overwrite existing files, the output name receives a randomized suffix, and copyparty does not execute the dropped file, so broader impact depends on unrelated host software processing it. No public exploit was identified at time of analysis, and the issue is fixed in 1.20.19.
Authenticated users of Open WebUI 0.11.0 through 0.11.3 can stall server workers by getting the model to call the grep_knowledge_files or grep_chat_files file-search tools with a catastrophically backtracking regular expression, which blocks the async event loop for roughly two seconds on each repeated invocation. Exploitation requires a valid account with access to those tools (CVSS PR:L), so unauthenticated attackers cannot trigger it directly; the practical exposure is highest on multi-tenant, shared-account, or self-service-registration instances where untrusted users already hold logins. There is no public exploit identified at time of analysis, and the effect is transient availability degradation that must be sustained by repeated calls rather than a one-shot outage (CVSS 4.0 base 7.1; CVSS 3.1 A:H with no confidentiality or integrity impact).
Unauthenticated access to the OTRS Agent Frontend configuration endpoint lets any remote user who can reach the web interface retrieve internal application configuration metadata - frontend routes and their authorization groups, authentication configuration, enabled product features, and third-party integration settings. The flaw affects OTRS 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X, requires no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3), and is exposed by default on any reachable Agent Frontend. No public exploit code has been identified at time of analysis and the vendor has released a fix in the 2026.7.X branch; the practical risk is reconnaissance-grade - the leaked data contains no user credentials and cannot be used to modify configuration, but it materially aids fingerprinting and attack preparation, especially for internet-facing instances.
Brute-force credential guessing against IBM i authentication interfaces can let remote attackers recover valid user credentials, because the platform fails to sufficiently restrict repeated authentication attempts. IBM i releases 7.3, 7.4, 7.5, and 7.6 are affected, and exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base score 5.3), requiring only network reachability to an exposed sign-on endpoint and an account whose password is weak enough to be guessed. This is a moderate-severity weakness rather than a remote code execution or integrity-impacting flaw; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though any organization exposing IBM i authentication services to untrusted networks should prioritize the vendor fix and tighten lockout and rate-limiting controls.
SurrealDB 3.0.0 through 3.2.x allows low-privileged authenticated attackers (or those with leaked grant identifiers) to invalidate other users' refresh tokens via the revoke RPC method without proof of possession, forcing targeted re-authentication and session denial. The flaw stems from missing authentication in the revoke RPC, and exploitation requires either VIEWER permission to run ACCESS SHOW ALL for harvesting grant IDs or previously leaked tokens. Rated medium severity (CVSS 4.0 base 5.3), impact is bounded to session invalidation with no data disclosure, code execution, or privilege escalation; no public exploit identified at time of analysis.
Path traversal in LibreNMS's nfsen_channel_common.inc.php allows an authenticated user who already has authorized access to at least one NFSen-enabled device to read RRD traffic and NetFlow graph data belonging to devices outside their permitted scope by injecting ../ sequences into the channel parameter supplied to graph.php. The flaw affects LibreNMS releases prior to 26.9.0 and is rated moderate (CVSS 4.0 base 5.3; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), because it requires a valid low-privileged account plus an NFSen-enabled deployment and yields only read access with no integrity or availability impact. No public exploit code identified at time of analysis, and the issue is not listed under confirmed actively exploited (CISA KEV); single-tenant installations where the authenticated user is already entitled to every device gain nothing from the technique.
Authenticated users on Open WebUI instances running versions earlier than 0.11.4 can bypass administrator-imposed restrictions and reach model provider backends that have been explicitly disabled, by supplying an explicit backend index as a path segment or query parameter on the Ollama and OpenAI-compatible model listing routes. The issue is an IDOR/missing-authorization flaw (CWE-639) that discloses backend version strings, enumerates configured connections, and causes server-side requests to carry previously stored API keys - although the keys are used in outbound calls rather than necessarily returned in plaintext, and there is no integrity or availability impact. It is a medium-severity information-disclosure issue (CVSS 4.0 base 5.3; assessed CVSS 3.1 5.3) requiring a valid account (PR:L) plus at least one configured backend, and no public exploit code has been identified at time of analysis.
Missing authorization checks in ERPNext's whitelisted batch lookup methods let any authenticated user - including a low-privilege Customer portal account - enumerate every item batch together with its per-warehouse stock quantities, exposing inventory levels that should require Batch read access. The flaw spans versions 9.0.0 through 16.50.0 and is reachable over the network through the Frappe API (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 5.3, AV:N/AC:L/PR:L/UI:N, confidentiality-only). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a moderate information-disclosure issue rather than an emergency; an upstream fix commit has been published.
Authenticated portal users in ERPNext 15.55.0 through 16.50.0 can read timesheet metadata - such as timesheet names, status, time-log dates and last-modified information - for projects they should not have visibility into, because the get_timesheet_html routine enforced only Project read access and ignored both the hide_timesheets flag and project membership. An attacker needs a valid customer/project portal login with read access to the target Project; no anonymous access is possible, and the leak is limited to metadata rather than full timesheet contents (CVSS 4.0 base 5.3, our assessment CVSS 3.1 5.3, C:L only with no integrity or availability impact). Exploitation status is low-urgency: no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; an upstream fix exists in the ERPNext repository via commit eb217deef7bd407d34254aee3b3e175e4d357c90 (PR #60280), though a tagged patched release has not been independently confirmed.
CPU exhaustion in the Gitoxide gix-mailmap crate before 0.35.0 lets a repository carrying a crafted .mailmap file drive quadratic-time parsing inside Snapshot::from_bytes, tying up a worker process for minutes. The trigger is a .mailmap whose entries are ordered in descending fashion, which forces repeated front insertions during parsing; exploitation requires a victim or automated worker to run a mailmap-consuming Gitoxide operation such as git log, blame, or shortlog against the attacker-influenced repository, so the practical barrier is that passive user interaction rather than authentication (CVSS:4.0/AV:N/AC:L/PR:N/UI:P and the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R). Impact is limited to a temporary availability loss - no code execution, data exposure, or persistence - and no public exploit has been identified at time of analysis.
Disabled accounts in Grav API plugin versions before 1.0.36 can continue to access API endpoints because SessionAuthenticator fails to re-validate account state on subsequent requests. Affected are authenticated users who hold a still-valid browser session or remember-me token obtained prior to account disabling, allowing them to bypass operator revocation until the session expires. No public exploit identified at time of analysis, and exploitation requires a pre-existing valid session, limiting the risk to moderate severity.
Server-side request forgery in SPIP before 4.4.18 lets an authenticated user with access to remote-fetching features (such as syndicated site feeds or remote document imports) force the CMS to retrieve internal or link-local resources, including cloud metadata endpoints like 169.254.169.254. The root cause is that recuperer_url() in ecrire/inc/distant.php follows up to 10 HTTP redirects without re-invoking valider_url_distante(), so a benign external URL that passes validation can redirect to a target that would otherwise be blocked. Exploitation requires valid credentials (CVSS:4.0 PR:L) and attacker-controlled or attacker-influenced external hosting; impact is confidentiality-only and read-oriented, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Field-level SELECT permission bypass in SurrealDB versions before 3.3.0 allows an authenticated record-level user to infer values of fields they are not permitted to read by registering LIVE SELECT queries whose WHERE clauses reference $before or $after record state and observing whether CREATE, UPDATE, or DELETE notifications are delivered. Because the notification stream acts as a boolean oracle, an attacker can iteratively narrow restricted field values with repeated crafted predicates; the impact is limited to confidentiality of permission-protected fields, with no write, delete, or availability effect, and no public exploit identified at time of analysis. The issue is confirmed fixed in SurrealDB 3.3.0.
User profile enumeration in IBM i 7.3, 7.4, 7.5, and 7.6 allows unauthenticated remote attackers to determine which user profiles exist by observing distinct error codes returned during the sign-on process. The issue requires only network reachability to an exposed IBM i sign-on interface - no credentials and no user interaction (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N, C:L only) - and yields nothing beyond confirmation of valid profile names, so it is a reconnaissance weakness rather than a compromise vector. No public exploit code has been identified at time of analysis, the vulnerability is not listed in CISA KEV, and IBM has published a fix.
SurrealDB versions 3.1.0 before 3.3.0 contain an authorization bypass (CWE-862) that allows an authenticated user with delete permission on a referenced table to delete protected graph edges. When a record with a REFERENCE ON DELETE CASCADE relationship is deleted, the cascade cleanup disables permission checks for the edge table, erasing edges despite the edge table's PERMISSIONS FOR delete clause. The vulnerability requires authentication and pre-existing delete authorization on the referenced parent record, so it is not anonymously reachable; exploitation enables low integrity and availability impact only, with no confidentiality exposure. No public exploit code has been identified at time of analysis.
Information disclosure in SurrealDB before 3.3.0 allows an authenticated record user to read fields that field-level SELECT permissions are meant to hide, by projecting a restricted field from the unreduced $after or $before parameters of a LIVE SELECT query under an alias. The exact stored value is then delivered inside CREATE, UPDATE, or DELETE live notifications, producing a read-only confidentiality leak scoped to records the user can already observe. Exploitation requires valid record-user credentials (PR:L, authenticated) and a deployment that actually relies on field-level SELECT permissions for secrecy; only versions before 3.3.0 are affected, and no public exploit identified at time of analysis. This is a medium-severity, confidentiality-only issue, not a high-priority emergency.
Open WebUI versions 0.9.6 through 0.11.3 allow an authenticated user who holds read access to any single knowledge base to probe the file-listing endpoint GET /api/v1/knowledge/{id}/files with a directory UUID belonging to a different knowledge base, and the response breadcrumbs disclose folder names, owner user IDs and knowledge base IDs for that directory and all of its ancestors. The flaw is an authenticated tenant-to-tenant metadata leak (CVSS 3.1 base 5.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) - credentials are mandatory, file contents are not exposed, and the attack requires possession of a valid foreign directory UUID, which the advisory characterizes as a previously retained identifier rather than a guessable or sequential value. No public exploit code or active exploitation has been identified at time of analysis, and the primary remediation is upgrading to 0.11.4 or later.
Missing authorization enforcement in SnapOtter 1.15.10 through 2.2.0 lets any holder of a valid API key - including one scoped only to settings:read - call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers, staging arbitrary files outside their storage quota and feeding crafted bytes to the image and video decoders (Sharp, libheif, LibRaw, FFmpeg) behind the tool workflow. Because staged content is subsequently served by /api/v1/download without authentication, a low-privilege authenticated foothold is converted into unauthenticated file hosting and an expanded decoder attack surface. Exploitation requires a valid key but no file or tool permission; no public exploit code has been identified at time of analysis, and the issue is rated moderate (CVSS 3.1 5.3, PR:L), consistent with confirmed integrity and availability impact but no confidentiality impact.
Authorization bypass in ZKTeco BioTime 9.5.6 Build 20260130.3206 allows an authenticated low-privilege user to read personnel records outside their authorization scope through the Employee REST API at /personnel/api/employees/. Exploitation requires a valid session (CVSS PR:L) and network reachability to the BioTime web/REST interface, and the resulting impact is confined to confidentiality of employee data (VC:L) with no integrity or availability effect. No public exploit code has been identified at time of analysis, no EPSS or CISA KEV data was provided, and the vendor was contacted about the disclosure but did not respond, so no vendor-released patch is identified at time of analysis.
Authorization bypass in ZKTeco BioTime 9.5.6 Build 20260130.3206 lets an authenticated low-privilege user read biometric records belonging to other employees by manipulating the emp_code argument on the /iclock/finger_data/ Biometric Data Endpoint. Impact is confined to confidentiality of biometric data (assessed CVSS 3.1 5.3, PR:L, C:L, no integrity or availability effect) and requires the BioTime web interface to be network-reachable; no public exploit code identified at time of analysis, the issue is not confirmed actively exploited (CISA KEV), and the risk is assessed as genuine but moderate rather than an urgent priority. The vendor was contacted early about the disclosure and did not respond, so no fixed build is known.
Improper session revocation in Open WebUI 0.8.8 through 0.11.4 allows an authenticated user whose account has been deactivated to continue executing terminal commands and reading or writing files on the terminal server through an already-established terminal WebSocket. The terminal proxy route in terminals.py validates access only on the first WebSocket message and never re-checks it, so the deactivated session persists until the socket is closed; the attacker cannot open a new session after deactivation, and PR:L in the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) confirms prior valid access to the terminal feature is required. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a moderate privilege-persistence flaw rather than a high-impact remote code execution issue.
Missing authorization in the Codection 'Products Restricted Users for WooCommerce' WordPress plugin, version 0.7 and earlier, allows unauthenticated remote attackers to bypass the plugin's access-control logic and alter which products are restricted. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are required against a default installation, although the impact is limited to low integrity (C:N/I:L/A:N) on plugin-controlled restriction state rather than data disclosure or denial of service. No public exploit code was identified at time of analysis, and the plugin has a narrow deployment footprint, so this is a moderate rather than high priority finding.
Stored cross-site scripting in zofe/rapyd-admin (Rapyd Admin) 9.4.0 before 9.20.0 lets an unauthenticated attacker who can self-register pick a display name containing HTML/JavaScript, which the x-rpd::select-list Blade component renders unescaped and which then executes in a privileged administrator's browser session - specifically when the admin opens Logs → Activity (Author filter) or the users and permissions forms. The CVSS vector confirms PR:N (no authentication) but UI:P/UI:R, so exploitation depends on open self-service registration plus an administrator viewing the affected screen; impact is confined to the admin's browser session, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the vendor addressed it in 9.20.0 by escaping the option labels and rejecting names containing '<' or '>'.
Cross-site request forgery in yangzongzhuan RuoYi 4.8.3 lets a remote, unauthenticated attacker cause a logged-in privileged user to unknowingly trigger state-changing actions - according to the referenced public security report, a GET-based delete operation that lacks anti-CSRF token validation. Impact is limited to actions the victim is already authorized to perform (CVSS 4.0 base 5.3, low integrity impact only), and exploitation hinges on the victim holding an active authenticated session at the moment they load attacker-controlled content. The vendor was contacted early but did not respond, no vendor-released patch has been identified, and no public exploit code was identified at time of analysis, though the GitHub security report describing the vulnerable GET-based delete endpoint is publicly available.
Improper authorization in Open WebUI 0.11.0 through 0.11.3 allows an authenticated user who is a member of a shared folder to insert attacker-controlled chats into that folder by calling POST /api/v1/chats/{id}/fork on chats they created there while they still held write access, even after being downgraded to read-only. The endpoint places the forked chat in the source chat's folder without re-checking the caller's current write permission on that folder (CWE-862), so the injected content becomes visible to the folder owner and other members. Exploitation is not opportunistic: it requires a valid account, a non-default multi-member shared folder, and the specific stateful precondition that the attacker's own chats were created before the downgrade; impact is confined to integrity (content insertion) with no disclosure or availability effect, and no public exploit code has been identified at time of analysis.
Authorization bypass in Open WebUI 0.11.1 through 0.11.3 allows an authenticated user with a linked OAuth account to retain their previous role after their identity provider role is downgraded or revoked, provided the provider sends role claims only in the ID token and not in the userinfo response. The vulnerability resides in the OAuth token exchange endpoint, which does not demote the user's existing role when no roles claim is found in userinfo. No public exploit has been identified, and impact is limited to retaining an already-held role rather than gaining new privileges.
Insecure direct object reference in QloApps through 1.7.0 lets an authenticated, hotel-restricted back-office employee manipulate sequential identifiers to act on resources belonging to other hotels - reading, uploading and deleting booking documents, deleting rooms, room images, room-type product images and hotel images. The flaw is exploitable only in multi-hotel installations that actually use per-hotel scoping via htl_access, and only by a user who already holds a valid low-privilege back-office account (CVSS vector PR:L, so authenticated rather than unauthenticated); a single-hotel deployment or a deployment without hotel-restricted profiles is not meaningfully exposed. Exploitation is a low-severity-to-moderate integrity and confidentiality problem across tenant boundaries rather than an emergency remote compromise: no public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), and the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L is consistent with a medium-severity insider authorization issue. Vendor-side fixes exist upstream (PR #1922 and commit 83eb851) but a tagged patched release was not independently confirmed from the supplied data.
Stored cross-site scripting in Frappe ERPNext (before 15.112.0 and 16.x before 16.23.0) lets unauthenticated attackers inject crafted markup through a publicly exposed portal form that saves submissions for later back-office review; the payload executes in the browser of the authenticated staff member who opens the stored record. Because the CVSS 4.0 vector carries PR:N, the entry point is unauthenticated, but exploitation is not self-triggering - a human review action is a hard prerequisite (UI:P), and impact is confined to the reviewing user's browser session (SC:L/SI:L) with no direct server-side confidentiality, integrity, or availability loss (VC:N/VI:N/VA:N). Rated 5.3 (medium), with no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); vendor-released patches exist in ERPNext 15.112.0 and 16.23.0.
Server-side request forgery in Frappe ERPNext (before 15.112.0 and 16.x before 16.23.0) allows an authenticated user holding a common operational role to point a writable configuration field at an arbitrary destination, causing the ERPNext server to issue outbound requests to hosts that are only reachable from inside the deployment's network. The issue is rated CVSS 5.3 and requires a valid session with permissions to edit the affected field (PR:L), so it is not exploitable by fully unauthenticated attackers; real-world impact depends entirely on what internal services - such as cloud metadata endpoints, internal APIs, or databases - are reachable from the application server. No public exploit code has been identified and the flaw is not confirmed as actively exploited (no CISA KEV listing); per our assessment this is a moderate, not urgent, priority that is fully resolved by upgrading to a fixed release.
Missing authorization checks in certain Frappe ERPNext endpoints allow any authenticated user to read records beyond the scope their assigned role should permit, exposing data that role-based access control is intended to restrict. The flaw affects ERPNext versions before 15.110.0 and 16.x before 16.21.0 and is exploitable only by a logged-in user holding at least a low-privilege account (CVSS PR:L, assessed CVSS 3.1 base 5.3); it is not reachable by unauthenticated attackers, and impact is limited to confidentiality since no integrity or availability effects were identified. Vendor patches are available in 15.110.0 and 16.21.0, and no public exploit identified at time of analysis.
Missing authorization checks in Frappe ERPNext before 15.121.0 and in 16.x before 16.34.0 let an authenticated user call certain endpoints that do not enforce role-based permission rules, exposing records the account's role should not be able to read. Exploitation requires valid credentials or an active session as a lower-privileged user (PR:L per the CVSS vector), and the impact is confined to unauthorized data disclosure - no modification, deletion, or code execution is possible through this flaw. Independent assessment rates it medium severity (CVSS 3.1 5.3), and no public exploit code has been identified at time of analysis; the practical risk scales with how many low-trust or untrusted authenticated accounts exist in a given deployment and how sensitive the role-restricted data is.
Authenticated users can infer the size and membership of protected Parse Server Relation fields by issuing count queries with the $relatedTo operator before 8.6.93 and in the 9.0.0 line before 9.10.1-alpha.13. The flaw bypasses identity-scoped protectedFields for authenticated, role, or per-user group rules and can act as a membership oracle when combined with an objectId constraint, leaking confidential relation membership such as private groups or block lists. The issue has a CVSS 4.0 score of 5.3, requires prior read access to the owning object, and no public exploit has been identified at time of analysis.
ZKTeco BioTime 9.5.6 Build 20260130.3206 exposes its System Settings API at /base/api/systemSettings to improper access controls, allowing a remote attacker who already holds valid low-privilege credentials to retrieve sensitive system settings due to a CWE-284 authorization flaw. The vulnerability carries a CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) and is not known to be actively exploited or to have public exploit code at the time of analysis. Note the discrepancy between the 'Authentication Bypass' tag and the PR:L vector: the assessed impact is limited to confidentiality of system settings, with no integrity or availability impact, making this a low-to-moderate priority issue despite the tag.
Missing authorization and cross-site request forgery flaws in the Grav Guestbook plugin versions 0.5.0 and 0.5.1 allow an authenticated admin without the admin.guestbook permission, or an external site leveraging a logged-in moderator's session via nonce-less GET requests, to delete or approve guestbook entries. The impact is limited to the integrity of guestbook content, with no confidentiality or availability effect and no code execution. The CVSS 4.0 base score is 5.3, no public exploit code is identified in the provided intelligence, and the issue is not listed in CISA KEV.
Insufficient session expiration in y_project RuoYi up to 4.8.3 allows an authenticated low-privileged remote user to retain or reuse a session token that should have been invalidated, specifically via the changeStatus handling in the Disable API associated with /system/config/add. The issue is rated CVSS v4.0 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X; CWE-613), with an independent assessment aligning on PR:L but limiting impact to confidentiality only (C:L/I:N/A:N), so real-world risk is narrowed to insiders, credential-reuse scenarios, or follow-on activity after another compromise. No evidence of active exploitation in CISA KEV and no public exploit identified at time of analysis; a public security report is referenced.
Stored cross-site scripting (XSS) in LibreNMS before 26.9.0 allows an attacker who controls the SNMP agent of a monitored device to inject JavaScript via wireless sensor description fields, which executes in the browser of an authenticated user viewing that device's Wireless tab and can lead to session hijacking. The CVSS 4.0 base score is 5.3, and exploitation requires user interaction (the victim must open the affected tab) plus the unusual precondition of controlling monitored-device SNMP data rather than LibreNMS credentials. No public exploit has been identified at time of analysis, and the independent assessment rates real-world urgency as materially lower than the raw score suggests because impact is confined to the victim's authenticated session.
Unauthenticated stored cross-site scripting in Admidio 5.0.0 through 5.0.14 allows attackers to inject JavaScript into the FIRST_NAME registration field, which is later rendered unencoded in a data-message attribute on the Manage registrations page. When an administrator hovers over the malicious entry, the script executes in their browser session, potentially leading to session hijacking or data theft. The vulnerability is fixed in version 5.0.15, has a moderate CVSS 4.0 score of 5.3, and no public exploit code is identified at time of analysis.
Stored cross-site scripting (CWE-79) in the Grav Guestbook plugin before 0.5.2 lets unauthenticated visitors persist markup in guestbook author and message fields that is later rendered as unescaped HTML through jQuery by the AJAX 'Load more' pagination handler and the admin 'Load all' moderation view. Because the CVSS vector carries PR:N, submission of the payload requires no authentication, but execution depends on victim interaction (UI:P/UI:R) - another visitor must trigger AJAX pagination, or, on versions 0.5.0 and 0.5.1 specifically, an administrator must open the moderation view, which elevates the impact to a moderation-session compromise. Rated CVSS 5.3 (vendor CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:P/SC:L/SI:L) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Improper authorization in the PswRecovery servlet of LogicalDOC Community Edition through 9.3 lets any user who can hold a valid low-privileged account hijack the password-recovery flow and reset credentials for arbitrary accounts, including administrators. Recovery tickets are issued but never bound to the requesting user, so an attacker can obtain a ticket for their own account and replay it with any arbitrary userId parameter, forcing the victim's password to a newly generated value, locking the victim out, and disclosing the victim's registered email address in the servlet response. The flaw is rated CVSS 5.3 (CVSS 4.0 base) with an assessed 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L; exploitation requires a valid LogicalDOC account, no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
SQL injection in the Database Migration functionality of ZKTeco BioTime 9.5.6 (Build 20260130.3206) allows an authenticated, low-privileged remote attacker to manipulate SQL statements through the /base/api/v1.0/systemSettings/db_migrate_setting/ API endpoint, potentially exposing or modifying limited data. This medium-severity flaw (CVSS 3.1 base 5.3) has no vendor-released patch at time of analysis, and no public exploit has been identified. The vendor was contacted about the disclosure but did not respond, leaving affected deployments reliant on compensating controls.
Missing authorization checks in Frappe ERPNext party-record endpoints let any authenticated user with a low-privileged role modify party records beyond what their role permits. Affected deployments are ERPNext versions before 15.110.0 and 16.x releases before 16.21.0; the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 5.3) confirms the attack requires a valid low-privileged account and results in limited integrity impact only, with no confidentiality or availability effect. There is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a medium/low-priority hardening issue rather than an urgent one, and instances already on 15.110.0 or 16.21.0+ are unaffected.
Authenticated users holding only low-privilege roles in Frappe ERPNext can call specific endpoints that fail to enforce role-based permission checks, allowing them to deactivate master records outside their assigned permissions. The flaw affects ERPNext releases before 15.108.0 and 16.x before 16.18.0 and carries a moderate 5.3 severity, with impact confined to the integrity of master data - the assessed vector shows no confidentiality loss, no availability impact, and no scope change. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (not listed in CISA KEV).
Missing authorization in Frappe ERPNext versions before 15.105.0 and 16.x before 16.15.0 allows an authenticated low-privilege portal user to create documents on behalf of other parties, compromising data integrity. The flaw affects document-creation endpoints that fail to verify the requesting portal user belongs to the target party. No public exploit code has been identified at time of analysis, and the independent assessment rates this as a moderate access-control issue requiring a valid portal account.
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 allow authenticated users to modify data beyond their permitted role, compromising data integrity with no confidentiality or availability impact. Exploitation requires a valid low-privilege ERPNext account (PR:L) and reachable endpoints that fail to enforce role-based authorization; anonymous access is not possible, and no public exploit identified at time of analysis. This is a moderate-severity broken access control issue, not a critical flaw.
Missing authorization checks in Frappe versions before 15.113.3 and 16.x before 16.25.0 allow authenticated users with low-privilege roles to modify records beyond their assigned permissions via crafted API requests to certain endpoints. Exploitation requires a valid authenticated session (PR:L) and impacts only integrity, with no confidentiality or availability impact. No public exploit has been identified at time of analysis, and the flaw is fixed in versions 15.113.3 and 16.25.0.
Missing authorization in LibreNMS before 26.9.0 allows any authenticated account holding the global-read (read-only) role to permanently purge port records it has no delete rights over. By issuing a DELETE request to /ports/purge - optionally with purge=all - a low-privilege user can irreversibly erase every soft-deleted port across all devices visible to that account. The flaw is an authenticated privilege-escalation-style access-control gap (CVSS 3.1 5.3, PR:L) with integrity-only impact confined to already soft-deleted port entries; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV). The vendor-released patch is LibreNMS 26.9.0.
Authenticated participants of the Meetecho Janus Gateway VideoRoom plugin can bypass a room's max_publishers cap by winning a narrow timing race between a session's 'starting' and 'started' states, allowing more concurrent publishers in a room than the operator configured (CWE-362). The issue is a low-severity one: it requires an authenticated, low-privileged VideoRoom participant able to send 'publish' requests, only matters for rooms that actually enforce a publisher limit, and yields only Low integrity and Low availability impact with no confidentiality loss (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L; CVSS 4.0 base 2.3 with AC:H and E:P). Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and the vendor responded quickly with an upstream fix in PR #3678 (commit 27c0d1af888153e818675b56a4e6267f62d57097).
Stored cross-site scripting in LibreNMS before 26.9.0 allows unauthenticated remote attackers who control the Oxidized API response or a monitored device's SNMP sysName to inject script that executes in the browsers of authenticated users viewing the Tools > Oxidized page. The flaw is rated medium severity (CVSS 5.3) and only affects the victim's browser session, not the LibreNMS host; exploitation requires the Oxidized integration to be enabled and limits exposure to deployments that actually use it. No public exploit code has been identified at time of analysis.
Input data manipulation in WP Desk Flexible Quantity - Measurement Price Calculator for WooCommerce through 2.3.22 lets unauthenticated remote attackers alter submitted quantity or measurement values because the plugin does not properly validate those inputs (CWE-1284). The issue is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so impact is limited to integrity of pricing/quantity calculations, with no read, denial-of-service, or code-execution impact. No public exploit identified at time of analysis, and no CISA KEV active-exploitation entry is present in the provided data.
Authenticated users on LogicalDOC Community Edition through 9.3 can abuse the default-enabled XMLConverter to make the server fetch attacker-chosen URLs and apply attacker-controlled XSLT during document conversion, because xml-stylesheet href values are resolved without scheme or host allowlisting. The vulnerable converter accepts http, ftp, file, and jar URLs, so a low-privileged user who can upload an XML document can reach internal services, read local files, or influence the resulting converted output. The issue is rated medium severity (CVSS 4.0 base 5.3; independently assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), authentication is mandatory and no unauthenticated path exists, and no public exploit code or confirmed active exploitation was identified at time of analysis.