SQL injection in Frappe ERPNext (before 15.119.1, and 16.x before 16.32.0) allows an authenticated user with only low privileges to read sensitive data out of the underlying database by sending crafted input to endpoints that do not validate parameters before building SQL queries. Unauthenticated and anonymous users cannot trigger the flaw - a valid ERPNext session is required (PR:L), and the impact is limited to confidentiality (high data disclosure, no integrity or availability loss), which caps the practical severity despite the 7.1 CVSS v4.0 base score. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence; the principal exposure is any production instance running an affected version with normal user accounts.
Authenticated SQL injection in Frappe ERPNext before 16.34.2 allows users holding only low-privilege accounts to send crafted requests to multiple application endpoints and read sensitive data out of the underlying database. The flaw is a missing input validation issue (CWE-89) that is remotely reachable without user interaction, but it is gated behind the need for valid low-privilege credentials, which limits it to a moderate, authentication-dependent risk rather than an anonymous internet-wide exposure; no public exploit code and no confirmed active exploitation were identified at time of analysis.
SQL injection in Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 allows authenticated attackers with low privileges to extract sensitive information from the database via crafted requests to endpoints lacking input validation. The vulnerability is not known to be actively exploited, and no public exploit code has been identified at time of analysis. With a CVSS 4.0 score of 7.1, exploitation requires network access and valid low-privilege credentials, making it a significant risk for insiders or compromised accounts in multi-tenant deployments.
Frappe ERPNext instances running releases before 15.120.0, or 16.x releases before 16.23.0, contain an authorization bypass that allows any authenticated user - including a low-privilege account - to read party records outside the scope of their assigned role. The affected endpoint honours a caller-supplied flag that is meant to disable its own permission enforcement, so simply setting that flag in the request causes the server to skip the role check entirely; the result is a read-only confidentiality exposure with no write, modification, or availability impact. No public exploit code has been identified at time of analysis, but exploitation requires only a valid session and is most consequential on multi-user or multi-tenant deployments where party data is meant to be segregated by role, making this a legitimate but moderate-priority issue rather than a top-tier emergency.
An HQL injection in LogicalDOC Community Edition through 9.3 lets any authenticated user who holds read permission on a single folder escape that folder's scope and read document metadata and database contents they are not entitled to see. The flaw is reachable through the documents.xml data endpoint (DocumentsDataServlet), where the 'indexed' request parameter is concatenated unvalidated into a Hibernate query, so the primary barrier is only the requirement for a low-privileged, read-only account; impact is limited to confidentiality with no modification or denial of service. There is no vendor patch version confirmed in the available data beyond the upstream fix commit, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, though an advisory and public discussion exist.
Missing authorization checks in Frappe ERPNext document-status modification endpoints allow authenticated low-privileged users to alter records beyond their assigned roles, with the primary impact being high integrity loss and limited availability impact (CVSS 4.0 7.1; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:L). Only instances running the 15.x branch below 15.121.0 or the 16.x branch below 16.34.0 are affected, and exploitation requires a valid low-privilege account plus reachability and knowledge of the relevant status endpoints - no administrative access or anonymous path exists, and confidentiality is unaffected. This is a genuine but moderate-priority issue rather than a critical emergency; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
An out-of-bounds read in Progress MarkLogic Server 12.x query-processing functionality allows an authenticated remote attacker to crash or destabilize the server and to read a limited amount of data from process memory by submitting specially crafted input to the affected query routines. The flaw affects MarkLogic Server 12.x releases before 12.1.0; environments on 12.1.0 or later, or on other major branches, are out of scope. Exploitation requires valid low-privilege credentials (CVSS PR:L) plus network reachability to the query interface - this is not an unauthenticated flaw - and no user interaction is needed. Vendor-released patch: 12.1.0. No confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H, driven primarily by the high availability impact of induced server instability.
XML external entity (XXE) processing is enabled by default across multiple request paths in Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0, allowing an attacker who submits crafted XML to trigger server-side requests or read local files. The vulnerability is rated CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L), meaning exploitation requires at least low-privileged credentials or an existing authenticated session - it is not an unauthenticated flaw - and the impact is limited to confidentiality loss and minor availability effects, with no integrity impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so exposure is currently a matter of unpatched, authenticated attack surface rather than active exploitation. Progress has published a security advisory and fixed releases that disable default external entity processing.
A denial-of-service condition in the Rust gitoxide `gix-pack` crate (all versions before 0.75.0) lets a malicious or compromised remote abort a client's fetch or clone by serving a malformed thin pack. The crafted pack combines a REF_DELTA that points at an already-known object with a following OFS_DELTA whose base_distance exceeds the current pack_offset, which drives the LookupRefDeltaObjectsIter into an arithmetic boundary it cannot satisfy and causes a panic that terminates the fetch process. The attack is unauthenticated from the attacker's side (PR:N) but requires user interaction (UI:P/UI:R): the victim must voluntarily fetch from or clone the attacker's repository, so it cannot be triggered against a passive listener. Impact is limited to availability of the fetch operation - no code execution, data disclosure, or integrity impact - and no public exploit code has been identified at time of analysis.
Denial of service in gitoxide gix-pack before 0.75.0 allows a malicious remote to panic and abort a client's git clone or fetch by responding with a crafted 12-byte pack header declaring version 3, which trips a release-enabled assert_eq! in BytesToEntriesIter::new_from_header that expects version 2. The attack requires the victim to initiate the fetch from an attacker-controlled or compromised remote (UI:R), but no authentication is needed (PR:N); automated CI, dependency resolution, or mirror synchronization that pulls from untrusted sources is the primary exposure. No public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 4.0 score is 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H per independent assessment).
SQL injection in LogicalDOC Community Edition through 9.3 allows authenticated low-privileged users to execute crafted SQL via the firstLetter parameter of TagsDataServlet, enabling UNION SELECT statements to be returned in the XML tag list and disclosing usernames, email addresses, and password hashes from the ld_user table. This is a credible but bounded risk: the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) and independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirm that an authenticated session is required, with no integrity or availability impact; no public exploit identified at time of analysis. The upstream fix commit (8428bfb) parameterizes the vulnerable LIKE clause, but a tagged patched release is not independently confirmed.
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 allows authenticated low-privilege users to read financial data beyond their assigned role because certain endpoints do not enforce proper authorization checks (CWE-862). The vulnerability is remote and requires valid ERPNext credentials (PR:L) with no user interaction, but impact is limited to high confidentiality read exposure with no write or availability effect; no public exploit identified at time of analysis. This is a genuine but moderate-priority issue rather than a top-tier emergency, with practical risk highest in broad-user-base or multi-tenant deployments where many low-privilege or portal accounts can reach the affected endpoints.
Frappe ERPNext instances running versions before 15.116.0, or 16.x before 16.27.0, expose financial data to any user who can authenticate, because specific endpoints omit the role-based authorization checks that should gate them. An attacker holding a valid but low-privileged account can query those endpoints directly and read financial records that their role does not permit, resulting in high confidentiality impact with no integrity or availability effect. Exploitation requires authentication (CVSS PR:L) and no user interaction, so the realistic threat is a malicious or compromised insider, portal user, or leaked low-privilege credential rather than an anonymous internet drive-by; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
Authenticated users of Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 can read data, including personal information, beyond their assigned role permissions due to missing authorization checks on certain endpoints. The flaw requires a valid low-privilege account (PR:L) and network access but no user interaction or elevated privileges. No public exploit code has been identified at time of analysis, and this is best treated as a moderate-priority authenticated data-confidentiality exposure.
Missing authorization checks in Frappe ERPNext let authenticated users with low-privilege accounts read item master data outside their permitted role. The flaw affects all releases before 15.118.2 on the 15.x line and 16.x versions before 16.30.0, and is rooted in endpoints that skip server-side role enforcement (CWE-862). Exploitation requires valid credentials (PR:L per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is not reachable by fully unauthenticated attackers, and impact is confined to information disclosure with no write or availability effect; no public exploit identified at time of analysis, and vendor patches are available.
Missing authorization checks in certain Frappe ERPNext endpoints let authenticated low-privileged users read personal data beyond what their assigned role permits, affecting releases before 15.112.0 and the 16.x branch before 16.23.0. Because exploitation requires a valid low-privileged account (CVSS PR:L) rather than unauthenticated access, the practical risk is highest in deployments that expose portals or large numbers of low-trust accounts, such as customer/vendor portals, sizable employee bases, or multi-tenant hosting. The flaw is a confidentiality-only issue (CWE-862) with no integrity or availability impact, no public exploit code identified at time of analysis, and no confirmed active exploitation (CISA KEV); the CVSS 4.0 base score is 7.1 while our independent assessment rates it 7.5 under CVSS 3.1, reflecting its genuine but moderate-priority access-control nature.
Missing authorization checks in project-related endpoints of Frappe ERPNext allow any authenticated low-privilege user (CVSS v3.1 PR:L, remote, no user interaction) to read project data that their assigned role should not permit, resulting in a high-confidentiality, read-only disclosure with no integrity or availability impact. Affected deployments are ERPNext versions before 15.111.0 and 16.x before 16.22.0, with vendor patches available at 15.111.0 and 16.22.0; there is no public exploit identified at time of analysis, and the flaw is not confirmed actively exploited (CISA KEV). The practical risk is highest in multi-user or multi-tenant installations where semi-trusted or low-privileged accounts exist, since exploitation only requires a valid account and direct knowledge of the affected endpoint calls.
Missing authorization in Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 allows authenticated low-privileged attackers to read financial data beyond their permitted role. The vulnerability is network-reachable with low attack complexity and requires only a valid low-privileged account, resulting in high confidentiality impact but no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score is 7.1 (High).
Missing authorization checks in Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 allow authenticated users with low privileges to call certain endpoints directly and read data beyond what their assigned role permits. The flaw is confidentiality-only (CWE-862, missing authorization): the CVSS v4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:H/VI:N/VA:N) and the independent assessment (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 7.1) agree that no data modification or denial of service is possible and that network access plus a valid low-privilege ERPNext account is required, with no user interaction. There is no public exploit identified at time of analysis, though the realistic threat population is insiders, compromised credentials, or environments that issue low-trust/portal logins, so the practical risk is moderate-priority exposure of sensitive ERP records rather than unauthenticated compromise.
Missing authorization checks in Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 allow an authenticated user holding only a low-privileged role to bypass role-based access control and read financial data by issuing direct requests to specific endpoints. The affected vector is network-reachable with low complexity but requires a valid account (PR:L), and the impact is limited to read-only confidentiality loss - no data modification or denial of service is possible. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so it is a moderate-priority broken access control flaw rather than an emergency; patched instances and deployments restricted to trusted users carry substantially reduced practical risk.
Missing role-based authorization enforcement in Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 lets any authenticated user read financial data that their assigned role should not permit. Because the vulnerable endpoints can be requested directly over the network with any valid low-privilege account and require no user interaction or non-default configuration, the practical risk is malicious insiders or attackers operating with stolen, shared, or weak credentials rather than anonymous outsiders. Impact is confidentiality-only (no data modification or availability loss), and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has released fixed versions 15.121.3 and 16.35.0.
Missing authorization checks in Frappe ERPNext before 16.34.0 allow any authenticated user to read financial records - accounting, ledger and invoice data - that their assigned role should not permit, resulting in a confidentiality-only breach. Exploitation requires only a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 7.1) and network reachability to the instance; no admin rights, user interaction, or special configuration are needed, which scopes the practical risk toward insiders or attackers holding stolen or self-registered low-trust accounts. No public exploit code has been identified at time of analysis, and CVE-2026-109614 is not confirmed actively exploited (CISA KEV); it is assessed as a credible but moderate-priority issue rather than a critical emergency.
SurrealDB deployments before 3.3.0 allow an authenticated caller who holds table-level WRITE permission but is denied SELECT on specific fields to read those hidden field values anyway, by issuing JSON Patch 'copy' or 'move' operations whose pointers are resolved against the unreduced record before field-level permission filtering is applied. The same weakness lets an attacker use PATCH 'test' operation mismatch errors as a boolean disclosure oracle to confirm the contents of SELECT-restricted fields. The issue is rated CVSS 7.1 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N, and a 3.1-equivalent assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), making it a credible but moderate-priority confidentiality flaw rather than an emergency; no public exploit identified at time of analysis, and it does not affect unauthenticated attackers or deployments that do not rely on field-level SELECT restrictions as a security boundary.
Authenticated users of LogicalDOC Community Edition (versions through 9.3) can bypass folder-level access controls and download the full contents of any restricted folder as a ZIP archive by calling the /zip-export servlet with an arbitrary folderId parameter. Exploitation requires only a valid low-privilege session (CVSS 3.1 PR:L, C:H/I:N/A:N), and because folder IDs are sequential numeric identifiers they can be enumerated, so the practical barrier is low for any user holding an account. The vulnerability is not confirmed as actively exploited (CISA KEV) and no public exploit code was identified at time of analysis, but a vendor fix is available; the impact is limited to confidentiality (document disclosure) with no write or availability effect, making this a moderate-priority information-exposure issue rather than an emergency.
Missing authorization checks in Frappe ERPNext allow an authenticated user to create and modify records beyond what their assigned role permits, giving high integrity impact with no confidentiality or availability effect. Exploitation requires a valid ERPNext login with at least low privileges (CVSS PR:L), so fully unauthenticated outsiders cannot abuse it, and only deployments running versions before 15.119.0 or 16.x before 16.31.0 are affected. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, making this a moderate-priority integrity and access-control problem whose realistic risk is concentrated among insiders or anyone holding standard user credentials.
Missing authorization in Frappe ERPNext document-creation endpoints (all versions before 15.121.0, and 16.x before 16.34.0) lets any authenticated low-privileged user - a portal, employee, or customer self-service account - create documents against records beyond their permitted role, bypassing role-based access controls. Impact is confined to integrity: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) and our independent CVSS 3.1 assessment of 7.1 (I:H, C:N, A:N) both show unauthorized document creation with no data disclosure or service disruption. No public exploit code has been identified at time of analysis and no CISA KEV listing is present, while vendor-released fixes exist in ERPNext 15.121.0 and 16.34.0.
Broken object-level authorization in Shaark 1.2.13 through 1.2.44 lets any authenticated non-admin user overwrite or delete other users' links, stories, chests, and albums by sending PUT or DELETE requests to /api/{link,story,chest,album}/{id} with sequential numeric IDs, because the API controllers load records with findOrFail() and never verify that the underlying post belongs to the calling user. Integrity impact is high (content can be modified or destroyed, including private items) while confidentiality is not affected and availability impact is limited; exploitation requires a valid low-privilege account on a multi-user instance, and the attacker must be able to obtain one via open registration or an existing tenant. This is a genuine but moderate-priority IDOR-class flaw (CWE-639); no public exploit code or confirmed in-the-wild activity was identified at time of analysis, and single-user or self-only deployments have no victim content to target.
SQL injection in LibreNMS before 26.9.0 allows an authenticated user at any privilege level to read arbitrary database tables - including the users.password hash column - by passing an array-valued notification_id parameter to notifications.inc.php instead of a scalar. The injected values break query construction in the notifications subsystem, and because extracted data is persisted into notifications_attribs and surfaced through the normal web interface, a low-privileged account can retrieve the results without any further foothold. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV); the primary constraint on exploitation is the need for a valid LibreNMS login, which matches the PR:L rating in the assessed vector (CVSS 3.1 7.1, confidentiality High, integrity Low).
An out-of-bounds write in the language-processing functionality of Progress MarkLogic Server lets an authenticated remote user with only low-level privileges crash or destabilize the server and, more narrowly, modify limited data. Only MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) confirms availability is the dominant impact while confidentiality is untouched and integrity impact is limited. The mandatory pre-existing authenticated session is the primary limiting factor, so the realistic threat is an insider or an attacker who already holds valid credentials, and no public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing per-document authorization checks in the ConvertPdf servlet of LogicalDOC Community Edition through 9.3 allow any authenticated user to download PDF documents - and every stored version of them - from folders they are not permitted to access. An attacker with a low-privileged account can enumerate the sequential docId parameter and combine it with the version parameter to pull PDFs outside their permission scope; no administrative rights, user interaction, or non-default configuration are required, though valid credentials are mandatory since the flaw is not reachable unauthenticated. Impact is confined to confidentiality (bulk disclosure of restricted PDF content and revision history), with no write, modification, or denial-of-service capability; no public exploit identified at time of analysis and no CISA KEV listing.
FreeRDP clients before 3.0.0 and in the 3.6.0-before-3.32.0 range can be coerced by a malicious RDP server into painting uninitialized heap memory onscreen or into aborting the client process via crafted WBT_TILE_FIRST and WBT_TILE_UPGRADE progressive codec messages. This client-side uninitialized heap read (CWE-908) occurs because the tile->current buffer is allocated without zeroing, and exploitation requires the victim to connect to an attacker-controlled or man-in-the-middle RDP server while the session negotiates the RemoteFX/progressive codec. No public exploit identified at time of analysis, and confirmed active exploitation has not been reported; the CVSS 4.0 score is 7.1 (High), driven primarily by availability impact (client abort) with a low, opportunistic confidentiality impact.
Authenticated low-privileged users can create documents beyond their permitted roles in Frappe ERPNext before 15.121.0 and 16.x before 16.34.0, because certain document-creation endpoints omit the role-based authorization checks the Frappe permission model normally enforces. The flaw is a CWE-862 missing authorization issue scored CVSS 4.0 7.1 (an independent CVSS 3.1 assessment also returns 7.1), with high integrity impact and low confidentiality impact, requiring only a valid low-privilege account (PR:L) and no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, but deployments that permit self-registration or issue portal/customer accounts widen the realistic attacker pool.
Frappe ERPNext fails to enforce permission checks on certain inventory-record endpoints, letting any authenticated user - regardless of assigned role - modify stock and inventory data they should not be able to touch. The flaw affects releases before 15.110.0 and 16.x before 16.21.0, requires a valid ERPNext session (CVSS PR:L, not anonymous), and impacts data integrity only: there is no disclosure of records and no denial of service. It is a moderate-priority authorization defect rather than a critical emergency, and no public exploit code has been identified at time of analysis; vendor fixes are available in 15.110.0 and 16.21.0. EPSS and CISA KEV data were not provided, so active exploitation is not confirmed.
Missing authorization checks in Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 let an authenticated, low-privileged user reach specific endpoints that modify production records and change data beyond the scope of their assigned role. Because the flaw is an integrity-only problem (CVSS:4.0 7.1; VI:H, VC:N, VA:N), attackers cannot read protected data or disrupt availability - they can only tamper with production/manufacturing records they should not be able to touch. Exploitation requires a valid low-privileged account and knowledge of the affected endpoint paths (PR:L per the assessed CVSS:3.1 vector); no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, making this a genuine but moderate-priority issue rather than a critical emergency.
ERPNext instances before 15.115.0 (15.x) and before 16.26.0 (16.x) allow authenticated low-privileged users to modify inventory records through endpoints that omit role-based authorization checks (CWE-862), carrying a CVSS 4.0 base score of 7.1 (High) and an assessed CVSS 3.1 integrity-only impact. Exploitation requires a valid low-privilege ERPNext account and network access, with no confidentiality or availability impact per the vector; no public exploit identified at time of analysis. Vendor-released fixes are 15.115.0 and 16.26.0, and instances at or above those versions are not affected.
Missing authorization checks in Frappe ERPNext versions before 16.14.0 allow authenticated users to modify master data records that lie outside their assigned role, giving them write access they were never granted. The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VI:H) confirms the issue is network-reachable but requires at least a low-privileged account; only data integrity is affected, with no confidentiality or availability impact. Per our assessment this is a legitimate but moderate-priority access-control gap rather than a critical emergency, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Upgrading to 16.14.0 removes the condition entirely.
Missing authorization checks in Frappe ERPNext allow an authenticated low-privileged user to invoke status-modification endpoints that omit proper role enforcement, altering record status and business data beyond the attacker's assigned role. Affected versions are ERPNext before 15.121.0 and 16.x before 16.34.0; exploitation requires a valid ERPNext account with at least low privileges (CVSS PR:L) and is reachable over the network, but carries no confidentiality or availability impact, making it primarily an integrity-focused insider or post-account-compromise escalation path. No public exploit code has been identified and the issue is not confirmed as actively exploited (no CISA KEV listing); EPSS data was not available in the provided intelligence. Vendor-released fixes are available in 15.121.0 and 16.34.0.
Authenticated low-privileged users can modify documents and data beyond their assigned role permissions in Frappe ERPNext before 15.119.1 and in 16.x before 16.32.0, because certain endpoints fail to enforce proper permission checks (CWE-862, Missing Authorization). The issue is rated CVSS 4.0 7.1 (CVSS:3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - integrity-only impact with no confidentiality or availability effect - and exploitation requires a valid ERPNext session for a low-privileged account plus knowledge of the specific unguarded endpoints, so it is not reachable by anonymous or unauthenticated attackers. There is no CISA KEV listing and no public exploit identified at time of analysis; realistic risk is confined to malicious insiders or attackers who already hold low-privilege credentials, and vendor-released fixes are available in 15.119.1 and 16.32.0.
Authenticated low-privileged users on IBM Planning Analytics 2.0 and 2.1 can delete folders and applications belonging to other users because the platform enforces access control at the wrong functional level. The flaw carries a CVSS v3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H), with the risk driven almost entirely by the high availability impact of destroyed workspaces rather than by any data disclosure. No public exploit code has been identified at time of analysis, and exploitation requires a valid account on a network-reachable instance, making this most realistically an insider or compromised-credential threat.
A crafted license plate value submitted through the bulk license plate search feature of Flock's Night Shift hosted service can be used to inject SQL, allowing an authenticated user of one customer organization to read license plate recognition records and other data belonging to other customer tenants; data modification was not possible. Exploitation requires a valid tenant account on the hosted platform (PR:L per the assessed vector), so this is not an unauthenticated attack. Flock discovered the flaw through internal security review, remediated it server-side on 2026-08-12, and states no customer action is required; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and because the fix was applied to the hosted platform the issue is no longer exploitable. The vendor-assigned CVSS 4.0 score is 7.1, while the independent assessment rates it CVSS 3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting high confidentiality impact confined to cross-tenant read access.
SQL injection in Tuleap Enterprise Edition 17.5 allows an authenticated attacker with only low-level privileges to inject arbitrary SQL and gain read access to the underlying Tuleap database, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1) indicating high confidentiality impact but no integrity or full availability loss. Because exploitation requires a valid session (PR:L) and no user interaction, the practical risk is concentrated in internet-facing or broadly provisioned instances rather than being an emergency for every deployment; there is no public exploit identified at time of analysis and no confirmed active exploitation. This is a credible but moderate-priority issue whose urgency depends on how freely accounts can be obtained on the affected instance.
Broken object-level authorization in Telegram-Stremio through 5.1.0 lets an attacker who holds a valid low-privilege API token read arbitrary Telegram chat messages - including private channels, groups, and Saved Messages - by setting a global routing flag in the stream_handler endpoint and enumerating sequential, unsigned msg_id values that the application only obfuscates with its encode_string/decode_string routines. The separate thumb_handler endpoint performs no token validation at all, so thumbnails from those same chats are disclosed without any authentication, widening the exposure beyond the token-gated path. Publicly available exploit code exists (a public PoC gist) and VulnCheck has published an advisory, but no CISA KEV entry confirms active exploitation and no vendor-released patch was identified at time of analysis; the assessed impact is confidentiality-only (high), with no integrity or availability effect.
Out-of-bounds write in libnfs through 6.0.2 lets an attacker-controlled or man-in-the-middled NFS/RPC server corrupt memory in a client application linked against the library: the ZDR decoders libnfs_zdr_bytes(), libnfs_zdr_string() and libnfs_zdr_array() do not honour the caller-supplied maxsize, so a wire-declared length larger than the caller's preallocated buffer is accepted and copied past its end. The assessed CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H, i.e. an unauthenticated remote server can trigger it but the victim must first connect to that server (UI:R), and impact is limited to integrity plus high availability loss rather than data disclosure. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the flaw only affects callers that pass a non-zero, non-~0 maxsize with their own fixed-size storage, since zero/0xFFFFFFFF lengths remain intentionally unbounded.
Nginx UI deployments that use Casdoor OAuth/SSO for authentication can issue a valid application session for an attacker-chosen identity on versions prior to 2.4.1, because the OAuth 'state' value is a fixed constant (the configured Casdoor application name) and the callback never binds it to the browser session that started the login. An unauthenticated attacker who persuades a victim to open a crafted Casdoor authorization link can have the victim's browser complete the attacker-controlled authorization flow, after which the callback mints an Nginx UI session for the identity returned by that authorization code - yielding high confidentiality impact with limited integrity impact (CVSS 3.1 7.1, AV:N/AC:L/PR:N/UI:R). The flaw is conditionally gated: it only applies to instances with Casdoor OAuth configured and requires victim interaction, so it is a genuine authentication-bypass issue rather than a universally exploitable one; no public exploit code was identified at time of analysis, and a vendor-released patch in version 2.4.1 is available.
Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 create certain log files with overly permissive operating-system permissions, allowing a local, already-authenticated low-privilege user on the server host to read or alter log data (CWE-732). Exploitation requires local OS access to the MarkLogic host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and is not remotely reachable, so the practical risk is moderate and concentrated on multi-tenant or multi-user hosts where untrusted local accounts exist; no public exploit identified at time of analysis. Notably, the vendor fix only corrects the default permissions for newly created and rotated logs, so previously written log files on an upgraded host remain permissively accessible until an administrator manually remediates them.
SQL injection in Frappe ERPNext releases before 15.98.0 and 16.x before 16.6.0 lets remote attackers who already hold a valid application session inject crafted input into a subset of endpoints and manipulate backend database queries, reading sensitive records the account would not otherwise be able to access. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms the primary limiting factor is authentication: a low-privilege ERPNext account is required, but no user interaction and no non-default configuration are needed, so default deployments on the affected versions are exposed to any logged-in user. Impact is confined to confidentiality - no integrity or availability effect - which keeps this a credible but moderate-priority issue rather than an emergency; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing). Exposure is highest for internet-facing ERPNext instances that offer self-service registration or lightly provisioned accounts.
Missing authorization checks in Frappe ERPNext 15.x before 15.113.0 and 16.x before 16.24.0 allow any authenticated user to call affected endpoints that omit role validation and read financial records their assigned permissions do not cover. Exploitation requires a valid ERPNext session (CVSS PR:L), so the practical threat is a low-privilege insider, malicious employee, or compromised portal account rather than an anonymous internet attacker, and the outcome is limited to data disclosure with no modification or service disruption. No public exploit code has been identified at time of analysis, and the issue is assessed as a moderate-priority confidentiality exposure rather than a critical emergency.
SQL injection in Frappe ERPNext before 15.102.0 and in the 16.x line before 16.11.0 lets an authenticated, low-privilege user manipulate database queries through endpoints that fail to validate input, exposing sensitive records held in the ERP database. The gating factor is the credential requirement: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the corroborating CVSS 3.1 assessment both indicate exploitation requires a valid low-privilege ERPNext session, so risk scales with the number of low-trust accounts on an instance and whether that instance is internet-facing. Impact is confined to confidentiality (VC:H with VI:N and VA:N) - this is a read/data-exfiltration flaw rather than database takeover or service disruption - and no public exploit code has been identified at time of analysis.
Authenticated low-privileged users in Frappe ERPNext (all versions before 15.119.0, and 16.x before 16.31.0) can read valuation and stock-costing data beyond what their assigned role permits, because specific endpoints fail to enforce authorization checks. Exploitation requires a valid low-privileged account (PR:L per the CVSS 4.0 vector) and network access to the application; the assessed impact is confidentiality-only (CVSS:3.1 C:H/I:N/A:N), so this is primarily an insider or compromised-account risk in multi-user or multi-tenant deployments rather than an unauthenticated intrusion path. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though a vendor security advisory and a third-party (VulnCheck) advisory are available.
SQL injection in Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 allows an authenticated attacker holding a low-privilege account to read sensitive information from the backend database by sending crafted requests to specific endpoints that fail to validate input. The assessed impact is confidentiality-only (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor CVSS 4.0 base 7.1), meaning data extraction rather than integrity or availability loss, and exploitation is gated by the need for a valid ERPNext session and reachability of the affected endpoints. No public exploit code has been identified at time of analysis and there is no KEV listing, but the low complexity of the attack and the availability of vendor advisories mean patched versions should be applied promptly.