Reflected cross-site scripting in Cairo-dock Glx-Dock through version 3.4.0 lets remote attackers execute arbitrary script in a victim's browser by crafting a URL that passes malicious input to the 'p' query parameter handled by ww_page.php. Exploitation requires no authentication but depends on a victim being socially engineered into opening the crafted link (UI:P), and the resulting impact is limited to low-integrity manipulation of that user's session with no server compromise or data-at-rest exposure. The vulnerability is rated CVSS 5.3 with a CVSS 4.0 exploit-maturity value of E:P, and publicly available exploit code exists; the vendor was contacted early but did not respond. Given the niche Linux desktop deployment of Glx-Dock and the mandatory user interaction, this is a moderate-to-low real-world priority despite being remotely reachable.
Unrestricted file upload in TinyFileManager 2.6 and earlier allows authenticated remote attackers to write files to arbitrary paths by manipulating the fullpath parameter passed to move_uploaded_file() in tinyfilemanager.php, potentially achieving remote code execution on the server. The vulnerability requires a valid session (PR:L in the CVSS vector) and no user interaction; publicly available exploit code exists, but there is no confirmation of active exploitation in the wild. No vendor-released patch is available because the vendor did not respond to disclosure.
Cross-site scripting in SourceCodester Drug Recommendation System 1.0 allows remote, unauthenticated attackers to inject script payloads into the Student Registration workflow at Auth/add_student.php via the txtname, txtpassword, txtemail, txtphone and txtprevious_school fields. Publicly available exploit code exists (CVSS 4.0 E:P, CVSS 3.1 base 5.3) and the injected script executes only when a victim - plausibly an administrator reviewing submitted registration records - renders the tainted output in a browser, so impact is bounded to that victim's browser session within the application. Exploitation is not confirmed actively exploited (not in CISA KEV), and no vendor-released patch was identified at time of analysis, making this a low-to-moderate priority issue despite the public exploit.
Resource exhaustion in the Hex package manager for Elixir (0.11.2 up to, but not including, 2.5.2) lets an untrusted, attacker-controlled package mirror consume unbounded memory or disk on the machine running mix deps.get, mix deps.update, mix hex.package fetch, or mix hex.docs fetch. Hex decompresses gzip response bodies and downloads/extracts package and docs tarballs before any signature, checksum, or 16 MiB/128 MiB size limits are applied, so the mirror's own payload size dictates consumption. Exploitation is narrow: it requires a non-default attacker-controlled mirror configured via HEX_MIRROR_URL, HEX_MIRROR, or the mirror_url option plus explicit user action to run a fetch, the default hex.pm CDN is not affected, and no public exploit has been identified at time of analysis (unauthenticated per CVSS PR:N, but user interaction is required and impact is availability-only, assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/C:N/I:N/A:L).
Stored cross-site scripting in the Netcore NR268 router (firmware 1.7.121109) lets an attacker on the same network segment supply a crafted DHCP Hostname value that the device's DHCP handler stores without sanitization and later reflects into the administrative 'dynamic IP' display page (dhcp_dynamicip_show.cgi), executing script in the administrator's browser when that page is opened. Publicly available exploit code exists - the disclosure includes a full public write-up and PoC - but there is no CISA KEV listing and no confirmed active exploitation. The practical risk is low: the payload only fires after an authenticated administrator visits the affected page (UI:P), the vector is LAN-side, and impact is limited to low confidentiality/integrity within the router's web UI context.
Stored cross-site scripting in SourceCodester Drug Recommendation System 1.0 lets unauthenticated remote attackers inject arbitrary script through the name or email argument handled by Admin/user_record.php, which then executes in the browser session of an administrator viewing the Admin Record Tables page. Publicly available exploit code exists, and no vendor-released patch has been identified, though CVSS 4.0 scoring of 5.3 with UI:P reflects that a privileged victim must passively render the tainted record before the payload fires. This is a genuinely low-priority issue despite being publicly disclosed, because impact is confined to script execution in the viewing user's browser (integrity-low) with no direct server compromise.
Hard-coded credentials in Meetecho Janus Gateway up to 1.4.2 can expose the Admin API through the bundled demo file html/demos/admin.js; the issue is remotely reachable and publicly available exploit code exists, but the independent assessment rates it low priority because exposure is limited to deployments that serve the demo content or leave the Admin API reachable. The CVSS 4.0 vector indicates low privileges (PR:L) with low confidentiality, integrity, and availability impact, and the provided references are VulDB entries rather than a confirmed vendor patch.
Path traversal in FreeRDP's WinPR clipboard file redirection (winpr/libwinpr/clipboard/synthetic_file.c) allows a malicious RDP server to slip '../' sequences into server-supplied cFileName fields of FileGroupDescriptorW clipboard data, so that the victim's next clipboard paste copies an arbitrary local file readable by the client user instead of the intended remote file. All FreeRDP versions before 3.32.0 are affected; exploitation requires the user to connect to a hostile or compromised RDP server and then paste a redirected clipboard file (reflected in the assessed vector as UI:R and AT:P), and unauthenticated remote attackers are sufficient per the CVSS PR:N vector. Impact is confidentiality-only (single local file disclosure, no code execution or integrity/availability loss), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in houtini-ai voice-analyser-mcp through version 2.1.1 allows a low-privilege authenticated user to make the server issue arbitrary outbound HTTP requests by supplying a crafted sitemap_url to the collect_corpus tool. Because the crawler's fetch function in src/utils/crawler.ts forwards the user-controlled URL without adequate validation, an attacker who can reach and invoke that feature can pivot requests toward internal services, localhost ports, or cloud metadata endpoints, though the assessed impact is bounded to low confidentiality, integrity, and availability effects with no subsequent-system scope. Publicly available exploit code exists and the vendor was contacted but did not respond, and no vendor-released patch has been identified at time of analysis; this is a genuine but low-priority SSRF rather than an unauthenticated or high-severity flaw.
Server-side request forgery in houtini-ai seo-crawler-mcp through version 2.1.5 allows an authenticated caller of the MCP tool interface to coerce the Crawler component into issuing requests to arbitrary destinations through the run_seo_audit function in src/core/CrawlOrchestrator.ts. The vendor was contacted about the flaw but did not respond, so there is no upstream fix at time of analysis, and publicly available exploit code exists (disclosed via the Net-defense/public_exp reference), though there is no evidence of confirmed active exploitation (not in CISA KEV). The independent assessment rates this low priority: exploitation requires low-level privileges on the MCP server (PR:L per both the vendor CVSS 4.0 vector and the assessed CVSS 3.1 vector), needs no user interaction, and yields only low read-level impact, with real risk concentrated where the MCP server has network reach to sensitive internal endpoints such as cloud metadata or internal APIs and lacks URL/egress filtering.
Authenticated SQL injection in erzhongxmu JEEWMS through version 2026.09.27-W39 allows remote low-privileged users to execute arbitrary SQL via the 'searchstr' parameter in the PDA interface's WmToMoveGoodsController.list endpoint. Publicly available exploit code exists (CVSS 4.0 E:P), though no confirmed active exploitation (CISA KEV) has been reported. The vendor did not respond to disclosure, and no vendor-released patch has been identified, so risk is moderate and depends on limiting exposure of the PDA interface.
SQL injection in the Autocomplete Handler of erzhongxmu JEEWMS (versions up to 2026.09.27-W39) allows remote attackers who already hold a valid low-privilege account to manipulate the trem, searchField, or entityName arguments passed to CommonServiceImpl.getAutoList and execute arbitrary SQL against the backend database, exposing data reachable by that account. Publicly available exploit code exists, so the attack is practical for any user able to authenticate and reach the endpoint; the vector's E:P rating and the reporter's note that the exploit was made public confirm exploitability, though there is no CISA KEV listing indicating confirmed active exploitation. The vendor was contacted early but never responded, and no vendor-released patched version has been identified.
SQL injection in the JEEWMS warehouse management system (erzhongxmu JEEWMS through build 2026.09.27-W39) lets an authenticated low-privilege user execute arbitrary SQL by manipulating the 'searchstr' argument handled by WmInQmIController.list in the Inbound Quality Check PDA interface. The vulnerability is remotely reachable (CVSS:4.0 base 2.1; assessed CVSS:3.1 6.3, AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity and availability impact), so the primary constraint on exploitation is that the attacker needs a valid low-privilege account - it is not exploitable by fully unauthenticated parties. Publicly available exploit code exists and the vendor was contacted but never responded, so no vendor patch is currently identified; the issue is not in CISA KEV and real-world priority is low given the authentication prerequisite and the niche deployment footprint of this product.
SQL injection in erzhongxmu JEEWMS (versions up to and including 2026.09.27-W39) lets an authenticated low-privileged user inject arbitrary SQL through the 'searchstr' argument of the WmSttInGoodsController.list endpoint, potentially reading, tampering with, or disrupting warehouse-management data. Publicly available exploit code exists, and the vendor was contacted early but did not respond, so no vendor-released patch has been identified; there is no confirmed active exploitation (CISA KEV). With an assessed CVSS:4.0 base score of 5.3 and low confidentiality, integrity, and availability impact, this is a moderate-priority issue whose main limiting factor is the authentication prerequisite - anonymous, unauthenticated users cannot reach the vulnerable code path.
DOM-based cross-site scripting in the Craft CMS control panel login and two-factor verification flow (Craft CMS 5.0.0 before 5.10.14) lets an unauthenticated attacker run JavaScript in the browser of a control-panel user who has TOTP 2FA enabled, executing with the victim's own permissions. The attacker must lure the victim into opening a crafted /admin/login?verify=1 URL whose returnUrl parameter carries a javascript: scheme, and the victim must do so during the narrow window between password submission and TOTP entry, so exploitation requires precise timing, social engineering and active user interaction (CVSS 4.0 base 2.1, reflecting AT:P and UI:A with no server-side impact). No public exploit code has been identified at time of analysis and the flaw cannot be triggered against accounts without 2FA; overall this is a genuinely low-priority issue where the multiple signals agree rather than conflict.
Launching an arbitrary activity with Samsung Flow's own privileges is possible for a local attacker on a device running Samsung Flow prior to version 4.9.22.4, because the app ships with an incorrect default permission setting that exposes the capability to other local code on the device. Only users of the affected Samsung Flow builds on devices that are actually paired/connected to a counterpart device are exposed, and the resulting impact is bounded to the connected system with low confidentiality and integrity effect (vendor CVSS 4.0 base 2.1; our assessment CVSS 3.1 AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N). There is no indication of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and the presence of the AT:P attack-requirement in the vendor vector means a specific pairing/connection state must exist before exploitation is even feasible.
Stored cross-site scripting (XSS) in the Netis WF2409E router (firmware 3.3.42541) allows an authenticated attacker with access to the web management interface to inject a malicious script into the Wireless Settings SSID parameter, which then executes in the browser of an administrator who loads that page. The exploit is publicly available, and while this raises exploit maturity (E:P), the issue is rated low priority because it requires valid credentials (PR:L) and depends on administrator interaction (UI:R or UI:P), with impact limited to script execution in the admin's browser context (integrity-low; no confidentiality or availability impact). No vendor patch has been released, as the vendor did not respond to the disclosure.
Insufficient session expiration in Eleveo Call Recording Software (versions up to and including 10.3.0) leaves the Keycloak OpenID Connect logout endpoint at /auth/realms/default/protocol/openid-connect/logout unable to fully invalidate session state, so a session can persist after a user believes they have logged out (CWE-613). Exploitation requires an attacker to already hold a low-privileged authenticated account (PR:L) and depends on passive user interaction (UI:P), such as a victim performing or relying on a logout action; the resulting impact is limited to minor confidentiality exposure (VC:L) with no integrity or availability effect. Publicly available exploit code exists, no confirmed active exploitation has been reported, and with a CVSS 4.0 base score of 2.0 this is a genuinely low-priority issue despite being remotely reachable.
Local file disclosure in ImageMagick before 7.1.2-32 stems from a time-of-check time-of-use symlink race in the MagickWand script-token loader, which lets an attacker who can already invoke a magick script replace an authorized path with a symlink in the window between the policy check and the actual file open. The impact is limited: it only matters on installations that deploy a restrictive policy.xml ReadPolicyRights (there is nothing to bypass on default configurations), the attacker must win a non-deterministic race, and the result is read-only disclosure of files the policy intends to block - consistent with the low assessed severity. No public exploit was identified at time of analysis, the issue is not listed in CISA KEV, and a vendor-released patch is available in ImageMagick 7.1.2-32.
Denial of service in ImageMagick 6.x before 6.9.13-57 and 7.x before 7.1.2-32, where a type confusion in the INFO, JSON and YAML encoders lets a locally positioned low-privilege user crash the ImageMagick process (SIGABRT or SIGSEGV) when an image is written to a compressed or blob-backed output stream. The flaw is reached only when the write targets a non-FILE stream such as zip:, bzip2: or a blob/FIFO destination, so ordinary file, pipe and standard-stream output are unaffected; impact is limited to availability of the single process, with no confidentiality or integrity loss. This is a genuinely low-priority issue - the assessed vector is local, low-privilege and availability-only - and no public exploit identified at time of analysis, though vendor patches are available.
ImageMagick 7.1.0-20 through 7.1.2-31 can crash or corrupt memory through a use-after-free in the MagickCore -fx expression evaluator, which is reached when the internal RPN element table must grow and the underlying memory allocation fails. Exploitation is constrained: it requires a local, low-privileged caller who can supply crafted -fx expressions to a process that is simultaneously under genuine memory pressure (the AT:P precondition in the CVSS 4.0 vector, base score 2.0), and the independent assessment caps impact at low availability loss with no confidentiality or integrity effect. The condition is not attacker-deterministic under ordinary conditions, no public exploit code has been identified at time of analysis, and this is not confirmed actively exploited (no CISA KEV listing), making it a genuinely low-priority issue whose signals are consistent rather than conflicting.
An invalid memory free in ImageMagick's fx expression evaluator (MagickCore/fx.c) lets a local attacker with low privileges crash the process by forcing initialization of an FX runtime entry to fail, producing a denial-of-service condition in applications that pass attacker-controlled input to the -fx operator. Only the error-cleanup path is defective - the code frees fxrts[t] instead of fxrts[t2] - so the bug does not trigger during normal FX usage or default processing of benign images, and there is no confidentiality or integrity impact. No public exploit code has been identified at time of analysis and the issue is not referenced by CISA KEV; the independent assessment rates it low (CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L), and vendor fixes are available.
ImageMagick 6.9.13-57 and earlier and 7.1.2-32 and earlier allow a local attacker to bypass configured security policy restrictions by pointing a symbolic link at a policy-restricted path, because the IsRightsAuthorizedByName rights check fails to account for symlinks and evaluates the wrong target. Exploitation requires a pre-existing local account with permission to create symlinks (low privileges, PR:L) plus a deployment that actually enforces ImageMagick policy.xml as a trust boundary; where no such policy is configured there is nothing to bypass. Impact is confined to low-level confidentiality and integrity loss with no availability impact, and no public exploit code has been identified at time of analysis.
Heap buffer over-write in ImageMagick versions before 6.9.13-57 (6.x) and before 7.1.2-32 (7.x) is triggered when the security policy is read and written concurrently by multiple threads, crashing the application and causing a denial of service. Exploitation requires local low-privileged code execution (CVSS:4.0 AV:L/PR:L) inside a process that embeds the library and that modifies its policy at runtime, combined with winning a probabilistic timing race (AT:P); the flaw yields no confidentiality or integrity impact, only availability loss. No public exploit code has been identified at time of analysis, and vendor-released patches are available as 6.9.13-57 and 7.1.2-32.
Local process termination in Yungengxin Cloud Billing 2024.11.28.11 allows any authenticated local user who can reach the bundled LWBilling64.sys kernel driver to kill arbitrary processes running on the host, because the IOCTL handler at sub_14000443C acts on a caller-supplied Pid without adequate access control. Exploitation requires only local low-privileged access (CVSS 3.1 AV:L/AC:L/PR:L/UI:N), with no user interaction and no elevation beyond that, and the impact is confined to integrity and availability - no data disclosure and no remote path exist. Publicly available exploit code has been published and may be used, but the issue is not in CISA KEV, the scored severity is low (CVSS 4.0 base 1.9, E:P), and the software's narrow deployment footprint limits real-world reach; the vendor was contacted prior to disclosure and did not respond.
Local authenticated attackers with low privileges can bypass or break the Sandbox component in deepseek-harness up to 0.1.1-rc.2 by manipulating the 'Profile' argument to the spawn function, resulting in a sandbox issue that may lead to limited privilege escalation. Publicly available exploit code exists, but the impact is capped at Low for confidentiality, integrity, and availability with no scope change, making this a low-priority issue. The vendor did not respond to disclosure, and no patch has been identified.
Eleveo Call Recording Software up to 10.3.0 transmits the OpenID Connect id_token_hint JWT as a GET query-string parameter on its logout endpoint (/auth/realms/default/protocol/openid-connect/logout), allowing that token to be captured from browser history, referrer headers, proxy caches, or server access logs. Exploitation is remote but constrained: the CVSS vector indicates a low-privileged authenticated context (PR:L), passive user interaction (UI:P), and high attack complexity (AC:H), with the vendor itself stating exploitability is difficult, and impact limited to low confidentiality disclosure of the token - no integrity or availability effect. Publicly available exploit code exists and the disclosure has been published, but there is no evidence of confirmed active exploitation (not in CISA KEV); the overall CVSS base score is only 1.2, making this a very low-priority issue.