Authenticated remote code execution in LogicalDOC Community Edition through 9.3 allows any user with a valid account to execute OS commands with the privileges of the LogicalDOC process by injecting Velocity template expressions into the subject or message fields of DocumentService.sendAsEmail. The attacker can bypass the forbidRuntimeUsage denylist by invoking SystemTool exec methods or ClassTool, as the denylist only blocked java.lang.Runtime and not java.lang.ProcessBuilder. No public exploit code has been identified at time of analysis, but a vendor fix is available as commit 66c3a6b9b47f9f6c624047eea43b219851378f00 and the issue is tracked by VulnCheck.
Denial of service in N3.js before 2.11.1 lets unauthenticated remote attackers stall Node.js applications that parse untrusted Turtle or N3 by supplying long runs of digits that never terminate a valid numeric literal, driving the N3Lexer number regular expression into quadratic backtracking that blocks the event loop. The flaw (CWE-1333) is reachable with AV:N/AC:L/PR:N/UI:N and results only in availability loss (VC:N/VI:N/VA:H in the vendor CVSS 4.0 vector; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H in independent assessment), with no confidentiality or integrity impact. It is not listed in CISA KEV and no public exploit identified at time of analysis, so real-world exposure is governed by whether the deployment actually feeds attacker-controlled RDF documents into N3.js parsing paths.
Information disclosure in Grav CMS before 2.1.7 lets unauthenticated remote attackers retrieve Git metadata from nested repositories - for example /user/.git/ - exposing git config, refs, and object files that can be used to reconstruct unpublished history or recover committed secrets. The flaw exists because the web-server configurations bundled with Grav for nginx, lighttpd, IIS, and Caddy 2 block dot-prefixed paths such as .git only at the document root, so repositories created below the root (a version-controlled user/ directory, or git-installed plugins and themes) remain web-readable. No authentication or user interaction is required; no public exploit code or confirmed active exploitation was identified at time of analysis, and real-world impact is gated by the deployment precondition that a web-reachable nested Git repository actually exists and contains private history or sensitive commits. The vendor advisory (GHSA-5vx9-x8f2-f55w) points to the 2.1.7 release as the fix.
Privilege escalation in Nginx UI lets any holder of an authenticated account take over the built-in administrator by changing the admin's password through POST /api/users/:id, which omits the RequireSecureSession step-up that the self-service password-change path enforces. Successful abuse silently invalidates the legitimate administrator's existing tokens, and the attacker can then authenticate as the administrator with full control over the Nginx configuration managed by the UI. All releases prior to 2.4.1 are affected; the vendor-released fix is version 2.4.1, and no public exploit code has been identified at time of analysis, though the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity, and availability. The practical exposure is gated by the need for a pre-existing low-privilege account, so multi-user deployments are directly at risk while single-admin instances that never provision secondary users have no untrusted principal to abuse.
Authenticated attackers with a common operational role can exploit a server-side template injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site. The vulnerability arises because user-controlled message fields are not validated before template rendering, allowing expressions to execute in an unrestricted context (CWE-1336). With a CVSS 4.0 score of 8.7, no public exploit has been identified at time of analysis, but the low privilege requirement makes this a credible priority for organizations running unpatched versions.
Missing authorization in LogicalDOC Community Edition through 9.3 allows any authenticated low-privilege user to disclose, tamper with, or delete documents they are not permitted to access, by invoking SoapDocumentService operations such as copy, getExtractedText, deleteVersion, reindex, deleteLink, and restore over SOAP or the /services/rest/document REST interface. Because document identifiers are sequential, an attacker with ordinary credentials can simply enumerate IDs and reach other users' content with no administrative rights and no user interaction, yielding high confidentiality and integrity impact with limited availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L; vendor-published score 8.7). No public exploit code or confirmed active exploitation was identified at time of analysis, and the main barrier to attack is the requirement for a valid account, so exposure is greatest where account creation is open or user segregation is weak.
SQL injection in Frappe ERPNext 15.x before 15.121.0 and 16.x before 16.34.0 lets any authenticated user, including an account with no assigned roles, inject crafted parameters into several endpoints that lack input validation, read other users' sensitive information, and escalate to a privileged account. Because only the lowest privilege level is needed (CVSS 4.0 PR:L; independently assessed at 8.7 under a 3.1 vector of AV:N/AC:L/PR:L/UI:N with High confidentiality, integrity and availability impact), deployments that permit self-registration or hand out broad low-privilege accounts face a nearly trivial authentication barrier, while tightly controlled instances still require a valid login. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, but the vendor advisory is public, so unpatched, internet-reachable instances should be treated as high priority.
Privilege escalation in Frappe ERPNext lets any authenticated user - including one holding no operational role - create privileged records such as user accounts and role assignments, ultimately taking full control of the site. The flaw affects releases before 15.111.0 and 16.x before 16.22.0, and stems from a record-creation endpoint that derives the record type from the request and inserts it with permission checks disabled; the only prerequisite is a valid login (CVSS 4.0 vector PR:L, i.e. authenticated, no user interaction, no non-default configuration). Rated 8.7 with high confidentiality, integrity and availability impact across the vulnerable site, and no public exploit code has been identified at time of analysis.
Code injection in the IBM Maximo Application Suite Location Service for Esri component (versions 9.0, 9.1 and 9.2) allows an attacker who already holds high-privilege control over the Kubernetes operator's configuration input - specifically the container image reference consumed from an operator template - to inject a code path that the operator then acts on, resulting in a scope-changing compromise of workloads beyond the operator's own authority (CVSS 3.1 8.7, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, CWE-94). The injected image reference can cause attacker-influenced containers to be deployed under the operator's service account, which is why the impact is rated high for confidentiality and integrity even though the attack is not reachable by an unauthenticated outsider against a default deployment. Exploitation is gated by PR:H - the adversary must be able to modify the Location Service for Esri operator's template or custom resource values - no user interaction is required, and there is no public exploit identified at time of analysis.
Stored cross-site scripting in Tuleap Enterprise Edition 17.0 through 17.5 allows an attacker holding a low-privileged authenticated account to persist arbitrary script into content that is later rendered in another user's browser, where it executes within that victim's authenticated session (CVSS 3.1 base 8.7, scope-changed). Exploitation is not unilateral: it requires a valid account with enough privilege to submit persistent content into a field shown to other users (PR:L) plus a victim who views the poisoned content (UI:R), so practical severity depends on how many users - and how privileged those users - can be induced to open the crafted page. No public exploit identified at time of analysis, and no EPSS or CISA KEV corroboration of active exploitation was supplied with the intelligence.
Stored cross-site scripting in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated user with only low privileges to persist malicious script content into application fields, which then executes in the browser session of any other user who views the poisoned page. Because the payload is stored rather than reflected, a single injection can fire repeatedly against multiple victims, including higher-privileged users, and the CVSS scope change (S:C) reflects that the script runs with the privileges of the victim's origin rather than the attacker's account. Exploitation requires valid credentials (PR:L) and victim interaction (UI:R), and no public exploit code was identified at time of analysis; no EPSS score, CISA KEV entry, or active-exploitation reporting was provided in the available intelligence.
Stored cross-site scripting (XSS) in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated attacker to inject malicious script into a persisted field, which then executes in the browser session of any user who views the affected content. The vulnerability requires a low-privileged account (PR:L) and user interaction (UI:R) from a victim, and can lead to high confidentiality and integrity impact. No public exploit identified at time of analysis.
Remote code execution in Adminer before 6.1.1 allows authenticated users with SQLite access to bypass ATTACH and VACUUM INTO restrictions by prefixing SQL statements with a UTF-8 byte-order mark. An attacker can then attach a database file at a PHP-served path and create a table named with PHP code, which executes as the web server user. No public exploit identified at time of analysis; exploitation requires valid credentials, SQLite usage, and a web-accessible writable PHP-executing path.
Improper verification in the Edgeless Systems Contrast Coordinator's peer-recovery path (versions 1.8.0 through 1.24.0) lets an authenticated actor who holds write access to the Coordinator's manifest history replay a superseded history head, because the recovering peer never confirms that the serving peer is on the same manifest generation. Successful replay can cause withdrawn workloads to receive trusted mesh certificates, and an attacker who additionally possesses the secret seed can disclose the Mesh CA key; the flaw is conditional rather than mass-exploitable, requiring PR:H privileges plus a specific transient/replayable state (AT:P), and no public exploit has been identified at time of analysis. Patched versions of Contrast (1.24.1 and later) address the missing generation check.
Buffer overflow in the Edimax BR-6208AC router (firmware 1.32) allows an attacker who can reach the device's HTTP management interface to corrupt memory via a crafted 'ifname' argument sent to the /goform/formWlSiteSurvey endpoint, with high impact to confidentiality, integrity, and availability. Exploitation requires at least low-privileged authenticated access to the web UI (CVSS 4.0 vector PR:L; independently assessed CVSS 3.1 base 8.6), meaning the endpoint must be reachable either from the LAN or from an internet-exposed admin panel using valid or default credentials; no user interaction is required once the attacker is authenticated. Publicly available exploit code exists (a PoC walkthrough is published on GitHub), but there is no evidence of confirmed active exploitation in the wild, and the vendor did not respond to disclosure - the product is end-of-life and no fix is expected.
Remote code execution in the Thelia e-commerce platform (all versions before 3.1.2 and 3.2.x before 3.2.1) allows an authenticated back-office user to upload a PHP payload that is written into the web-served public/cache/documents/ directory and executed as the web server user. The flaw exists because FileProcessorService validates the filename exactly as the client sent it, while FileManager::renameFile()/sanitizeFileName() later strips characters outside [a-zA-Z0-9-_.], so a name such as 'report.php ' survives validation but is stored as the executable 'report.php'. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires a valid administrative account with access to the document-upload feature; no public exploit code has been identified at time of analysis, and the vendor has released fixed versions 3.1.2 and 3.2.1.
Privilege escalation in the Grav API plugin (grav-plugin-api) before 1.0.36 allows an account that already holds the api.users.write capability - a delegated user manager rather than a super-admin - to obtain full super-admin API access. The attacker edits account access maps or pending invitations so that a positive scalar value is stored on an 'admin' or 'api' parent grant; the plugin's inheriting permission resolver then treats that grant as satisfying its requireSuper checks, exposing super-only API endpoints. Exploitation is authenticated and requires the high-privilege api.users.write capability (CVSS vectors show PR:H, scope unchanged), so the flaw matters mainly where user-management rights have been delegated below super-admin; no public exploit code or confirmed active exploitation was identified at time of analysis.
Two-factor authentication bypass in the Grav Login plugin versions 2.7.0 through before 3.9.9 allows an authenticated remote attacker who already possesses a valid password to restore a remember-me cookie issued after the password step and obtain a fully authorized session without completing the second factor, yielding high confidentiality and integrity impact. This is a genuine elevated-priority issue for environments using the plugin with 2FA and remember-me enabled, though not a mass-exploitation emergency; no public exploit identified at time of analysis.
Authentication bypass in Grav Login plugin versions 2.7.0 before 3.9.9 allows attackers who already know a victim's password to disable two-factor authentication (2FA) and take over the account by invoking the update_user task through a published page form without an access rule. The flaw resides in processUserProfile(), which verifies that a session user exists but fails to confirm that a pending front-end 2FA session is fully authorized. Exploitation requires three conditions: the attacker must possess the victim's password, have an in-progress front-end login that has reached the 2FA step, and be able to publish a Grav page form lacking an access rule; no public exploit has been identified at time of analysis.
Improper privilege management in Rapyd Admin (the open-source Rapyd Admin scaffolding package for Laravel) versions 9.0.0 through 9.19.x lets an authenticated user who already holds the 'edit users' permission - the shipped 'operator' role is sufficient - promote their own account to the 'admin' role by submitting the admin role ID through the UsersEdit Livewire component, which prior to 9.20.0 synced browser-supplied roles without validating them against a server-side allow-list. Successful exploitation lifts tenant scoping, bypasses per-record authorization and enables impersonation of other users, including higher-privileged accounts, giving high confidentiality, integrity and availability impact within the affected installation. The flaw is fixed in v9.20.0, which computes assignable roles server-side and prevents a non-super-admin from granting a role to itself; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the prerequisite of an already-delegated privileged account makes this an insider or compromised-account escalation rather than a default-configuration, unauthenticated issue.
Configuration-gate bypass in Crawl4AI 0.9.0 through 0.9.3 lets an authenticated but non-admin API client submit a laundered LLMConfig object through the server's configuration endpoint and read back environment-resolved secrets, including SECRET_KEY and provider API keys, which can then be used to forge admin JWTs. Exploitation requires Crawl4AI to be running in server/API mode with the /config/dump endpoint reachable and the attacker to already hold a provisioned non-admin API token (CVSS 4.0 base 8.6, vector PR:L), so pure library or embedded deployments are not affected; impact is highest where SECRET_KEY and provider keys are present in the server environment. Independent assessment flags this as a credible high-priority issue for hosted Crawl4AI deployments, with no public exploit identified at time of analysis and no CISA KEV listing.
Authorization bypass in @neo4j/graphql 7.0.0 through 7.6.3 lets an authenticated user read, create, and delete records that @authorization filter rules were written to deny, because the library translates the 'none' quantifier on relationship and connection filters into Cypher without the required negation so the predicate is evaluated as though it were 'some'. The flaw only manifests in applications whose typedefs actually use the 'none' quantifier inside an @authorization filter on a relationship or connection field (for example creator: { none: { id: { eq: "$jwt.sub" } } }), so applications that never use that construct are not affected; the CVSS vector specifies PR:L, meaning the attacker must hold a valid JWT accepted by the API. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor patch and the upstream fix commit are available.
Reflected cross-site scripting in Frappe ERPNext (all versions before 14.92.1, and 15.x before 15.83.0) lets an attacker inject arbitrary JavaScript that runs inside an authenticated user's session, enabling session/account takeover. The attacker needs no credentials (PR:N in the CVSS vectors), but exploitation requires a logged-in victim to follow a crafted URL (UI:P), so it is delivered by phishing or social engineering rather than by a direct server-side attack. Impact is rated high for confidentiality and integrity (VC:H/VI:H) with scope change under the CVSS 4.0 vector (8.6) and CVSS 3.1 equivalent (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N); there is no CISA KEV entry and no public exploit identified at time of analysis, and the issue is lower priority than a zero-interaction network RCE.
SurrealDB versions before 3.3.0 fail to validate a caller's authorization level when the SurrealQL USE statement switches the session to a different namespace or database, allowing an authenticated tenant to cross tenant boundaries and read, create, update, or delete rows in other tenants' tables wherever the table's PERMISSIONS clause permits it (for example PERMISSIONS FULL). Exploitation requires a valid account at the namespace, database, or record level (CVSS 4.0 vector PR:L, unauthenticated access is not possible) and only has impact on instances hosting multiple tenants with permissively configured tables. The vendor has released 3.3.0 to correct the missing authorization check; no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Cross-tenant data access in SurrealDB before 3.3.0 allows an authenticated namespace- or database-level SYSTEM user to bypass namespace/database scoping and read, create, modify, or delete rows and read DEFINE PARAM values in other tenants where table PERMISSIONS clauses permit. The CWE-639 authorization bypass is triggered by setting the Surreal-NS/Surreal-DB headers on the /sql endpoint or invoking the RPC 'use' method, as the server fails to validate the caller-selected namespace or database against the level at which the user authenticated. No public exploit identified at time of analysis; impact is limited to multi-tenant deployments and requires valid low-privilege credentials.
OS command injection in mac-shell-mcp before 2.0.0 lets a connected MCP client - including a legitimate client driven by a malicious or prompt-injected LLM - escape the tool's command whitelist by appending shell metacharacters to the arguments of an otherwise permitted command such as pwd, causing forbidden commands to run as the server user without approval. Exploitation requires an existing MCP client session to the local server (CVSS 4.0 vector AV:L/PR:L/UI:N, mirroring the independent CVSS 3.1 assessment AV:L/PR:L/UI:N with high confidentiality, integrity and availability impact), so this is an authenticated, locally-scoped flaw rather than an internet-facing unauthenticated one, and impact is bounded by the privileges of the account the server runs under. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but a vendor fix and upstream patch commit are available; EPSS data was not provided for this CVE.
Stored cross-site scripting in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows unauthenticated visitors to plant crafted HTML/script through a public-facing booking page; the payload is stored without neutralization and executes in the browser session of a privileged user who later views the booking content, enabling account takeover of that user. Exploitation is conditional: the instance must expose the public booking feature to untrusted submitters, and impact only completes when an authenticated, higher-privileged user opens the tainted content (UI:P in the CVSS 4.0 vector), so the attack is not fully automatable to immediate compromise and no public exploit code was identified at time of analysis. The vendor has released fixed versions, and this is a genuine priority for organizations that run the vulnerable booking workflow, not merely a high-score-on-paper issue.
Privilege escalation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows an attacker who can supply user-controlled values to certain higher-order XQuery functions to have those values evaluated in an elevated security context, potentially gaining permissions beyond those granted. The vendor's CVSS 3.1 vector (8.6 High, AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) claims unauthenticated exploitation, but the independent assessment assesses PR:L and high confidentiality and integrity impact, consistent with the requirement for access to an XQuery-evaluating interface (a MarkLogic account with query/evaluation rights or an application that passes user input into such functions). No public exploit code or CISA KEV entry is present in the provided intelligence, and no EPSS score was supplied.
Local code execution in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows an unprivileged local attacker to execute arbitrary code by supplying a crafted HEIF image on devices running firmware prior to SMR Oct-2026 Release 1. The flaw is an improper input validation issue in the 'sheifd' parsing path, rated 8.6 (CVSS 4.0) with high confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and the local attack vector requires the malicious file to be delivered from an on-device context.
Local code execution in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows unprivileged attackers to run arbitrary code by supplying a crafted HEIF cover image. This improper input validation flaw, tracked as CVE-2026-21124, affects Samsung devices prior to the SMR Oct-2026 Release 1 security update and carries a CVSS 4.0 score of 8.6, indicating high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and patched devices are not affected.
Session token theft in Open WebUI 0.7.0 through 0.11.3 lets any website a signed-in user visits post an unvalidated 'verify:chat' message that the SyncStatsModal component accepts without checking the sender's origin, ultimately returning the victim's JWT and granting full API access to their account. The attack is client-side and remote, scoring 8.6 (CVSS 4.0) and independently assessed at CVSS 3.1 8.x severity (AV:N/AC:L/PR:N/UI:R, C:H/I:H); it requires no server-side authentication, but does require that the victim hold a live session and interact with an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix in 0.11.4.
Stored cross-site scripting in EdgeEver 1.6.0 through 1.112.0 allows an attacker with a valid API or MCP token to inject HTML event handlers into template contentMarkdown, which executes when a victim opens the template preview, granting access to the privileged window.edgeeverDesktop bridge. Exploitation requires a low-privileged authenticated token (PR:L) and user interaction to open the preview (UI:P), and no public exploit code has been identified at time of analysis.
Path traversal in the legacy InfoStudio modules shipped with Progress MarkLogic Server lets a low-privileged authenticated remote attacker reach files outside the intended module directory and, because user-context values are also insufficiently validated, potentially have code run under an unintended identity. Affected deployments are MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 that still have the legacy InfoStudio modules present and reachable. The vendor rates this 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), reflecting a confidentiality-first impact that crosses a security boundary; no public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, but fixed builds are already available, so this is a priority patching item rather than an emergency.
Authenticated role administrators in Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 can add users to roles belonging to a different organization on the same instance, escaping their own tenant's authorization boundary and gaining privileged membership that lets them sign in to the target organization and modify its user profiles. The flaw is a missing cross-organization ownership check on the role UUID submitted to members_assignment.php (CWE-639), rated CVSS 4.0 8.5 and assessed independently as CVSS 3.1 8.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N). Exploitation is gated on the attacker already holding role-administrator rights and on the deployment hosting more than one organization, so single-org installations and anonymous or low-privilege users cannot reach the vulnerable path; no public exploit code has been identified at time of analysis and there is no CISA KEV listing. This is a genuine but conditional priority, bounded to insiders or compromised administrator accounts.
Password-reset token disclosure in the Grav Login plugin (versions 1.2.0 up to but not including 3.9.9) allows any user holding a publisher-level account to hijack more privileged accounts. A publisher authors a page at the plugin's password-reset route so that Login::getPage() renders attacker-controlled content on that route; when a higher-privileged victim opens an emailed reset link, the rendered page exposes the victim's username and bearer reset token, which the attacker can redeem to take over the account. Exploitation requires an existing publisher account plus victim interaction (clicking the emailed reset link), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Stored cross-site scripting in Open WebUI versions from 0.6.33 up to (but not including) 0.11.4 lets an authenticated user embed a javascript: URL in a citation's embed_url field inside a chat, then share that chat so that when the victim clicks the citation the URL is handed to window.open. Successful exploitation executes script in the victim's browser session, allowing theft of localStorage.token and full account takeover as the victim. The attacker must already hold a valid account (PR:L) and the victim must actively click the crafted citation (UI:P), so exposure is limited to instances where chat sharing is enabled and users interact with untrusted shared content; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor fix is released in 0.11.4.
Better Auth versions 1.3.8-beta.3 to before 1.7.0-rc.3 with the deviceAuthorization plugin enabled are vulnerable to a UI misrepresentation flaw (CWE-451) in which the GET /device approval screen omits the requesting client_id and scope, letting unauthenticated remote attackers initiate a device code and trick a signed-in user into approving it, resulting in a live session token. Exploitation requires user interaction and is not actively exploited; no public exploit identified at time of analysis, and the independent assessment rates it as a credible but not critical-severity risk.
Stored cross-site scripting in Frappe ERPNext allows an authenticated user with permission to create or rename records to plant script payloads in record names that are later rendered without proper neutralization on certain dashboards, tools, and portal pages. Versions before 15.103.0 and 16.x before 16.12.0 are affected; the vulnerability scores CVSS 4.0 8.5 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N) and the independent assessment rates it a credible, above-average-priority issue rather than an emergency, because a valid low-privilege login is mandatory, the payload only fires when a victim - ideally a privileged user - opens the specific affected view, and the attacker cannot control exact timing. Successful exploitation can read or modify data and steal session tokens from other users' browsers; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Installations running 15.103.0+ or 16.12.0+ are not vulnerable.
Stored cross-site scripting in Frappe ERPNext (before 15.113.0 and 16.x before 16.24.0) allows an authenticated low-privilege user to persist malicious script in a profile field that is rendered without escaping into portal pages; the payload executes in the browser of any administrator viewing those pages, enabling administrator account takeover. Exploitation requires a low-privilege account with access to edit the vulnerable profile field - realistic where ERPNext exposes self-service portal/website accounts for customers or suppliers - plus administrator interaction to load the poisoned page, which bounds risk below that of a pre-authentication, zero-interaction XSS. No public exploit code was identified at time of analysis.
Stored cross-site scripting in Frappe ERPNext allows an authenticated low-privilege user to plant a malicious payload in a record field that is rendered into an HTML attribute context without escaping; the payload executes in the browser of any higher-privileged user who opens the affected page, which can lead to account takeover of that privileged session. Affected deployments are ERPNext before 15.119.0 and 16.x before 16.31.0, with patched releases 15.119.0 and 16.31.0 addressing the flaw. Exploitation requires an authenticated low-privilege account and depends on a victim with greater privileges passively opening the page, which is the primary limiting factor; there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS score was provided, so this should be treated as a credible, actionable priority rather than an emergency.
Stored cross-site scripting in Frappe ERPNext allows any authenticated user with permission to create records to plant a crafted record name that is later rendered unescaped in a report view, executing arbitrary script in the browser session of whichever user opens that report. Exploitation is not remote-unauthenticated: it requires valid credentials plus create-record rights (CVSS 4.0 PR:L) and is further gated on a second user subsequently opening the vulnerable report (UI:P), meaning the payload lies dormant until then. Impact spans the confidentiality and integrity of the affected session and can be severe when a high-privileged administrator views the report; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the issue is rated 8.5 and warrants prompt patching.
Stored cross-site scripting in Frappe ERPNext versions before 15.112.0 and 16.x before 16.23.0 allows an authenticated user who can create the affected record type to embed script in a record name, which is then interpolated unescaped into markup by a tool view and executed in the browser session of any user who later opens that tool. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) agree that exploitation is authentication-gated at low privileges and depends on victim interaction, making this a moderate-priority, insider-reachable issue rather than an unauthenticated emergency; no public exploit code and no confirmed active exploitation were identified at time of analysis. Because the payload persists in stored data, a single malicious record name can affect every user who subsequently visits the vulnerable tool view, so scope is limited to session-level script execution in the victim's context rather than direct server compromise.
Server-side request forgery in Linux-based Progress MarkLogic Server 11.x and 12.x allows an authenticated, low-privileged user to coerce the database server into making HTTP requests toward internal endpoints reachable from its network position, which in cloud-hosted deployments can expose instance metadata services and the cloud credentials they hold. Exploitation requires valid low-privilege credentials (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) plus a deployment where an internal metadata or credential service is actually reachable, so on-premises or otherwise isolated installations gain no credential-theft payoff and no unauthenticated path exists. Only releases before 12.1.0 (12.x) and before 11.3.7 (11.x) are affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in Progress MarkLogic Server 12.x (before 12.1.0) and 11.x (before 11.3.7) when hosted on Microsoft Azure lets an authenticated attacker induce the server to issue requests against internal cloud services, potentially exposing Azure credentials or tokens. The flaw carries a CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), reflecting a scope change into the cloud control plane and high confidentiality impact; exploitation requires a valid low-privileged MarkLogic account and an Azure deployment, so on-premises and non-Azure instances are outside the described scope. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the highest-value outcome for an attacker is credential or token theft rather than code execution or denial of service.
Local privilege escalation in Edgeless Systems Contrast 1.8.0 through 1.24.0 allows a low-privileged local user on a node to modify the world-writable containerd configuration and overwrite the runc runtime path, leading to high confidentiality, integrity, and availability impact on that node. This is a credible local privilege-escalation issue rather than a remotely wormable threat; the CVSS vector requires local access with low privileges (PR:L), and no public exploit identified at time of analysis.
Privilege escalation in Progress MarkLogic Server affects 11.x releases before 11.3.7 and 12.x releases before 12.1.0, where an attacker who already holds an administrative account can reach authentication material belonging to higher-privileged users and use it to obtain unauthorized administrative access (CWE-269, CVSS 8.4 with scope change). Exploitation is gated by pre-existing admin privileges, so this is primarily an insider or post-compromise escalation risk rather than an externally reachable entry point; no public exploit has been identified at time of analysis and there is no CISA KEV association. No EPSS score was supplied in the available intelligence, so likelihood estimates should be treated as unquantified.
Stored cross-site scripting in EdgeEver through 1.112.0 lets authenticated users who can invoke the application's MCP tools (create_notebook, rename_notebook, create_memo) plant a script payload inside a notebook name or memo title, which is then rendered unsanitized by setMemoDragPreview when the item is dragged, executing attacker script in the app context with access to the desktop bridge's session token. Exploitation requires the victim to perform the drag interaction (UI:A) and the attacker to already hold the privilege needed to call the MCP tools (PR:L), so the payoff is scoped to the desktop bridge session token in affected builds; no public exploit code or confirmed active exploitation was identified at time of analysis. The supplied CVSS 4.0 score of 8.4 overstates real-world urgency for most environments, consistent with the independent assessment's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), which frames this as a moderate-priority authenticated-attacker issue rather than an unauthenticated emergency.
Navigation allowlist bypass in EdgeEver Desktop versions 1.6.26 through 1.112.0 allows an attacker who can get crafted content rendered in the app (for example a note-template preview) to load an arbitrary origin into the main window and capture the edgeeverDesktop bridge, including the session token, sidecar RPC, and ACP channels. The flaw is an incorrect-authorization issue (CWE-863) in which the will-navigate handler trusts a string-prefix match, so a URL that places the trusted dev-server prefix in the userinfo portion (e.g. https://devserver@attacker.tld) is accepted while the real origin is attacker-controlled. Exploitation requires a low-privileged authenticated foothold to plant the content and user interaction for the victim to open or preview it, and no public exploit code has been identified at time of analysis; the source CVSS 4.0 vector scores 8.4 (High), driven by high confidentiality and integrity impact that can escalate to command execution through ACP adapters.
Stored cross-site scripting in Open WebUI 0.11.1 through 0.11.3 lets any authenticated user who can upload chat attachments plant malicious script inside a DOCX file, which then executes in the browser of a higher-privileged user who previews it - typically an administrator. The injected code can read the administrator's session token from browser local storage and hand it to the attacker, resulting in full takeover of the instance. Exploitation requires a valid low-privileged account plus an admin voluntarily opening the attachment preview, so it is a credible, above-average-priority issue rather than an emergency; no public exploit code has been identified at time of analysis, and no confirmed active exploitation (no CISA KEV listing) has been reported. Fixed in 0.11.4.
Authenticated users with access to the MCP configuration interface in Nginx UI versions prior to 2.4.1 can bypass the directive filtering that the regular HTTP configuration API enforces, injecting restricted Nginx directives such as load_module, js_import, and js_content and then applying them via a configuration reload. Because the attacker can load the NJS module (ngx_http_js_module.so) and import JavaScript they control, they can execute arbitrary code inside the Nginx worker process, giving high impact to confidentiality, integrity, and availability of the managed Nginx instance. Exploitation requires a valid account (per the CVSS vector, PR:L, i.e. authenticated) and depends on the MCP interface being reachable and the Nginx build supporting NJS; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but it should be treated as high priority for any deployment below 2.4.1. The vendor-released patch is version 2.4.1, published with security advisory GHSA-5r62-gj48-897x.