Path traversal in YouTransfer (versions up to 0.0.7, 1.0.6, and 1.1.0) lets an attacker manipulate the /settings/template endpoint of the Template Rendering component to reach files outside the intended directory, yielding limited confidentiality, integrity, and availability impact (CWE-22). Publicly available exploit code exists, including a GitHub proof-of-concept; no public exploit activity has been confirmed beyond the POC, and the CVE is not reported as actively exploited. The vendor was contacted about the disclosure but did not respond, and no vendor patch is confirmed, so exposure is governed mainly by whether the /settings/template path is reachable and whether that administrative settings surface is protected by authentication in a given deployment.
Unauthenticated information disclosure in yt-dlp-web-ui through 4.0.0 lets remote attackers read server-side files by supplying a dash-prefixed value such as --load-info-json in the url parameter of the Service.Formats JSON-RPC method, causing the underlying yt-dlp process to load an attacker-chosen JSON file whose parsed contents are reflected back in the RPC response. Publicly available exploit code exists, including a published security advisory with reproduction details, though there is no CISA KEV confirmation of active exploitation; the CVSS 4.0 base score is 6.9, while a CVSS 3.1 scoring of the same vector yields 5.3 (Medium) because impact is confined to confidentiality. Any network-reachable instance at or below version 4.0.0 is affected with no authentication, user interaction, or non-default configuration required, so self-hosted instances bound only to localhost or a trusted LAN are materially lower risk than internet-exposed deployments.
Authentication token leakage in GitLab CE/EE (all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2) allows an authenticated user who controls a Kubernetes agent to redirect the Kubernetes proxy to an unintended server, exposing sensitive authentication tokens. Exploitation requires user interaction and only affects instances using the GitLab Kubernetes agent/proxy integration; publicly available exploit code exists. This moderate-severity issue (CVSS 5.8) is not a top-tier emergency but should be patched by affected deployments.
Missing authorization in the Admin/showdoctor.php admin display page of girishsaraf's Online-Appointment-Booking-System allows an unauthenticated remote attacker to directly invoke the endpoint and read administrative doctor-listing data (CWE-862). The project is a rolling-release PHP codebase with no pinned version, so exposure depends entirely on whether an organization has deployed this specific repository; the maintainer was notified through a GitHub issue but has not responded and no vendor patch exists. Publicly available exploit code exists, exploitation requires only network reachability of the affected page, and impact is confined to unauthorized read of admin data with no write or availability effect (per our assessment, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no confirmed active exploitation (CISA KEV) has been reported.
Improper authorization in SourceCodester Simple Cafe Billing System 1.0 allows remote unauthenticated attackers to manipulate the 'Type' parameter in the save_user action of admin_class.php, enabling unauthorized modification of user roles within the User Management component. The vulnerability is network-exploitable (CVSS 4.0 base 5.5, CVSS 3.1 AV:N/AC:L/PR:N/UI:N) with no authentication or user interaction required, and publicly available exploit code exists; active exploitation has not been confirmed (not in CISA KEV). The application's narrow deployment footprint limits real-world exposure.
SQL injection in SourceCodester Online Reviewer System 1.0 allows unauthenticated remote attackers to alter the SQL query behind the login form at login/index.php by supplying crafted input in the username or password field. Because the vulnerable endpoint is the pre-authentication login page, exploitation requires only network reachability to the application - no credentials, user interaction, or non-default configuration - and publicly available exploit code exists (a PoC is published at tracexlabs.com). The impact is moderate rather than catastrophic: CVSS 6.9 and an independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicate limited confidentiality, integrity, and availability effects, most likely authentication bypass and/or disclosure of data held in the application's backend database.
Unauthenticated SQL injection in SourceCodester Online Exam System 1.0 allows remote attackers to manipulate the username and pass parameters submitted to the pre-authentication login handler at adminpanel/admin/query/loginExe.php, potentially bypassing authentication and reading or altering backend database contents. The flaw is remotely reachable with low complexity, no privileges and no user interaction (CVSS 4.0: PR:N/UI:N/AC:L), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported. EPSS and KEV data were not provided for this record.
SQL injection in the Admin/deleteclinic.php endpoint of girishsaraf's Appointment Booking System allows remote attackers to manipulate the cid and did parameters and alter backend SQL queries, with low confidentiality, integrity, and availability impact per the supplied CVSS 4.0 score of 6.9. Because the project uses a rolling release, no versioned affected or fixed release is published, and publicly available exploit code exists; no CISA KEV status is provided to confirm active exploitation. The supplied CVSS 4.0 vector marks PR:N (unauthenticated), but the authoritative independent assessment uses PR:L (authenticated) because the vulnerable script is in the Admin area and may require an admin session if access controls are enforced.
Unauthenticated SQL injection in the registration form of itsmeravitejak Online-Examination-System lets remote attackers inject arbitrary SQL through the 'branch' parameter, reaching the MySQLDB::addNewUser function in include/database.php. Because the registration form is intended to be reachable before authentication and requires no user interaction or non-default configuration, any internet-exposed deployment is directly attackable; impact is rated Low across confidentiality, integrity, and availability in our assessment, implying partial rather than full database compromise. Publicly available exploit code exists (a linked GitHub issue) and the maintainer has not responded, so no vendor-released patch or fixed version is available for this rolling-release project.
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker manipulate the ID argument of /opils/staff/sales_history.php and inject arbitrary SQL into the application's database queries. Publicly available exploit code exists, and the provided CVSS 4.0 vector rates the issue 5.5 (AV:N/AC:L/PR:N/UI:N), though the /staff/ path indicates the endpoint may sit behind a staff-authenticated area, which would constrain real-world exploitation. Overall real-world priority is low because the product is rarely deployed and no CISA KEV or active-exploitation reporting is present in the supplied data.
SQL injection in the 'credit' parameter handled by /opils/staff/edit_credit.php in SourceCodester Performance Indicator System 1.0 lets remote attackers inject arbitrary SQL into backend database queries, with limited confidentiality, integrity, and availability impact as reflected in the 6.9 score and the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists - a proof-of-concept write-up was published in a GitHub issue linked from the CVE record - but there is no confirmed active exploitation (CISA KEV) at time of analysis. The supplied CVSS 4.0 vector asserts PR:N (no privileges required), yet the endpoint sits under a /staff/ administrative path, so defenders should verify whether their deployment requires a staff session; the dominant real-world limiter remains deployment scarcity of this niche PHP application.
SQL injection in SourceCodester Performance Indicator System 1.0 allows remote attackers to manipulate the Category argument in /opils/staff/product.php and alter database queries, yielding low impact to confidentiality, integrity, and availability. Publicly available exploit code exists; no CISA KEV confirmation is present, and authentication requirements are not confirmed because the supplied vector marks PR:N while the independent assessment suggests the staff endpoint may require login. Real-world risk leans low because the product has a rare deployment footprint and the assessed impact is limited, despite the medium CVSS 4.0 base score of 6.9.
SQL injection in SourceCodester Performance Indicator System 1.0 lets an attacker inject arbitrary SQL through the 'prodcategory' parameter handled by /opils/admin/addproduct.php, allowing manipulation of the underlying database contents and disclosure of stored data. The vulnerable endpoint sits under /admin/, so realistic exploitation most likely requires either a valid administrative session or an add-product page that lacks an adequate session check, which the independent assessment captures by scoring the issue PR:L rather than PR:N; the vendor-style vector instead lists PR:N, and that authentication requirement remains the key unconfirmed limiting factor. Publicly available exploit code exists for this issue, raising the likelihood of opportunistic scanning and abuse, though impact is bounded to low confidentiality, integrity and availability effects (CVSS 3.1 base 6.9, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and no CISA KEV listing indicates confirmed active exploitation.
Authorization bypass in the AdithyaYelloju Restaurant-Management-System lets remote attackers manipulate the user-controlled 'ID' argument processed by mysqli_query in the Order Management component to reach order records that belong to other users (CWE-639 / IDOR). No authentication or user interaction is required (CVSS PR:N/UI:N), and the impact is bounded to individual order records with Low confidentiality, integrity, and availability effects and no scope change. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and a public GitHub issue details the flaw), though there is no confirmed active exploitation (not in CISA KEV); real-world exposure is limited primarily by the project's negligible deployment footprint rather than by any technical barrier.
Unrestricted file upload in SourceCodester Library Management System 1.0 allows remote attackers to upload arbitrary files via the 'image' parameter to admin/add_admin.php, which uses move_uploaded_file without validating file type or extension, potentially leading to remote code execution if the uploaded file is web-accessible and the server executes PHP. Publicly available exploit code exists (though not confirmed as actively exploited in the wild), and the CVSS vector asserts unauthenticated access (PR:N), but the endpoint resides under an admin/ path, so exploitation may be limited to authenticated administrators in deployments that enforce access controls on that directory. Risk signals conflict and must be weighed carefully.
Unrestricted file upload in SourceCodester E-Learning System 1.0 lets remote attackers write arbitrary files, including executable PHP scripts, onto the server by manipulating the img argument in the save_users handler at /classes/Users.php?f=save. Successful exploitation depends on the endpoint being reachable and on the handler accepting the upload without file-type, extension, or content validation, followed by retrieving the uploaded file from a directory where PHP execution is permitted. Publicly available exploit code exists (referenced at tracexlabs.com as an 'elearning-preauth-rce' release) and the VulDB-sourced input warns it might be used; the CVSS 4.0 vector scores 6.9 with PR:N and UI:N, though our assessment notes that save_users is normally an administrative user-management action, so genuine pre-authentication reachability in a default install is not confirmed from the available data and should be verified.
SQL injection in the Admin/getclinic.php AJAX endpoint of girishsaraf's Online-Appointment-Booking-System lets remote attackers inject arbitrary SQL through the unsanitized city and cid parameters, allowing unauthorized read of database contents and limited data modification. The project uses a rolling release with no tagged versions, so every deployment up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 is presumed affected, and publicly available exploit code exists (no public exploit identified as actively exploited; not listed in CISA KEV). VulDB rates it CVSS 4.0 6.9 with PR:N, while our assessment scores it CVSS 3.1 PR:L and flags that authentication on the Admin/ path must be verified in the deployed instance, since that is the decisive limiter on real-world impact; the vendor was notified via issue #13 and has not responded.
Unauthenticated SQL injection in the AdithyaYelloju Restaurant-Management-System password-reset endpoint (User/forgot3.php) allows remote attackers to manipulate the email and password parameters and inject arbitrary SQL into backend queries. The flaw sits in the pre-authentication Password Reset component, so no valid account or prior login is required (CVSS:4.0 PR:N, UI:N), and the assessed impact is limited to partial confidentiality, integrity, and availability loss (C:L/I:L/A:L). Publicly available exploit code exists and has been described in the vendor's own issue tracker, but there is no indication of confirmed active exploitation and no vendor-released patch, since the project uses rolling releases and has not responded to the report.
Unauthenticated SQL injection in SourceCodester Art Gallery Management System 1.0 lets a remote attacker inject arbitrary SQL through the 'Name' argument handled by Action::save_user in admin/admin_class.php during account creation, allowing manipulation of the underlying database. The vulnerable code path is reachable without credentials or user interaction (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N), and publicly available exploit code exists, including a pre-authentication admin-creation proof of concept, though this CVE is not listed in CISA KEV so active exploitation is not confirmed. Impact is rated low across confidentiality, integrity and availability (CVSS 6.9 base, assessed CVSS 3.1 6.9-equivalent), making this a moderate, opportunistic risk concentrated on internet-exposed instances of this niche PHP application.
Remote unauthenticated attackers can alter other users' appointment booking statuses in girishsaraf's Online-Appointment-Booking-System because the changebookingstatus.php submit2 handler lacks authorization checks (CWE-862). Publicly available exploit code exists, but the issue is assessed as moderate-risk and limited-impact - affecting only booking data - with the product's negligible deployment footprint constraining real-world exposure. No vendor patch has been released, and the project has not responded to the reported issue.
Unauthenticated SQL injection in the girishsaraf Online-Appointment-Booking-System allows remote attackers to manipulate the 'dateselected' argument of changebookingstatus.php and thereby alter backend database queries, with the assessed impact limited to low confidentiality, integrity and availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists - the vulnerability is documented in public issue report and VulDB entries - but there is no confirmation of active exploitation (no CISA KEV listing was provided). Because the project follows a rolling-release model, no version-tagged release can be pinned as affected or fixed: the observable snapshot is up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, the maintainer was informed via GitHub issue #11, and no response or fix has been published. Multiple signals converge on this being a genuine but low-tier remote risk rather than an emergency, since the product is a niche open-source project with minimal production deployment and exposure - not a configuration prerequisite - is the principal limiting factor.
Improper authentication in AdithyaYelloju Restaurant-Management-System (pinned to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c) allows unauthenticated remote attackers to bypass the login form via crafted email and passwd parameters in User/login.php. Publicly available exploit code exists (referenced in GitHub issue #11), but no confirmed active exploitation (CISA KEV) has been observed. Despite a CVSS 4.0 score of 6.9, real-world risk is moderate-to-low because the project has no versioned releases and essentially no production installations; a successful bypass yields only low confidentiality, integrity, and availability impact.
Unrestricted file upload in SourceCodester Contact Tracing System 1.0 allows remote attackers to send a crafted file through the save handler at /classes/Users.php?f=save so that move_uploaded_file places attacker-controlled content into a web-accessible location, potentially yielding PHP code execution if the upload directory is executable. The provided CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P, indicating no privileges or user interaction in the assessed scenario, though the endpoint's Users save context warrants source-level confirmation of pre-auth reachability, and impact is limited to version 1.0. Publicly available exploit code exists, but the supplied data does not confirm CISA KEV active exploitation.
Incorrect comparison in the session handler of itsmeravitejak Online-Examination-System (Session::checkLogin in include/session.php) allows remote, unauthenticated attackers to subvert login validation by submitting crafted cookname and cookid cookie values, producing low confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the project follows a rolling release with no version pinning and has not responded to the early issue report; no KEV listing or EPSS data is available, and the practical exposure is limited by the small production footprint of this open-source examination application.
Authenticated remote attackers can exploit a SQL injection vulnerability in SourceCodester Performance Indicator System 1.0 by manipulating the 'pqty' parameter in the /opils/staff/edit_quantity.php endpoint. A public exploit has been disclosed, but the product's limited production use and the requirement for valid staff credentials (as indicated by the /staff/ path) make this a moderate, low-priority issue. No active exploitation has been confirmed.
SQL injection in code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate database queries via the User Update Handler at /reviewer/system/system/admins/manage/users/btn_functions.php, potentially leading to unauthorized data access or modification. The flaw has publicly available exploit code (Proof-of-Concept) and requires only network access to a deployed instance; no authentication or user interaction is needed per the CVSS vector (PR:N/UI:N). Rated moderate with a CVSS 4.0 base score of 5.5, exploitation could compromise the confidentiality, integrity, and availability of the application's data.
Unauthenticated information disclosure in GitLab CE/EE allows remote attackers to read confidential notes on public projects because of incorrect authorization checks, affecting versions from 17.4 up to specific branch fix releases. The flaw carries a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so exploitation needs no credentials or user interaction and is confined to confidentiality. Publicly available exploit code exists via a HackerOne report, but there is no confirmed active exploitation (CISA KEV not listed); GitLab states the issue is only exploitable under certain conditions, so not every public project is necessarily affected.
An incorrect authorization check in GitLab CE/EE allows an unauthenticated remote user to read work item contents from private groups and projects, exposing information that should be restricted to authorized members. All versions from 17.11 before 19.2.8, every 19.3 release, and 19.4 before 19.4.2 are affected, with vendor-released fixes available in 19.2.8 and 19.4.2. The issue carries a moderate CVSS of 5.3 (confidentiality-only impact) and publicly available exploit code exists via a HackerOne report, though exploitation is gated by unspecified 'certain conditions' and there is no confirmed active exploitation (CISA KEV).
Unauthenticated attackers can read internal notes and confidential system notes on public GitLab CE/EE projects through the GraphQL API, which fails to enforce proper authorization checks on affected versions (19.2 through 19.2.7, 19.3 through 19.3.4, and 19.4 through 19.4.1). The flaw carries a CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting a confidentiality-only impact with no integrity or availability effect. Publicly available exploit code exists, with a HackerOne report and a GitLab work item referenced, so unpatched, internet-exposed instances hosting public projects with internal or confidential notes are the highest-priority targets for remediation.
Authenticated EspoCRM users holding Import scope access can read other users' file attachments by abusing an insecure direct object reference in the Import module, allowing disclosure of files they do not own. The flaw affects EspoCRM releases before 10.0.7 and is reachable over the network by any logged-in account that has been granted the administrative Import permission; anonymous users and accounts without Import scope cannot trigger it. Exploitation requires knowledge or guessing of a valid foreign attachmentId, after which the attacker creates an Import record referencing that ID and calls the error-export endpoint to copy the referenced rows into a CSV they control. Publicly available exploit code exists, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms a confidentiality-only, medium-severity impact with no integrity or availability effect; no public exploit identified as confirmed actively exploited (CISA KEV) status was reported in the source data.
An access-control bypass in EspoCRM 4.0.0 through 10.0.6 lets any authenticated user who already holds Stream access to a parent record read historical 'was'/'became' values of fields protected by field-level security, by calling the REST endpoint GET /Note/{id} directly, which skips the NoteAccessControl filter. Impact is limited to confidentiality (CVSS 4.0 base 5.3, VC:L with VI:N/VA:N; independently assessed as CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and is meaningful only in deployments that actually use field-level security to hide audited fields from lower-privilege users. Publicly available exploit code exists (GitHub advisory GHSA-mr36-xx82-qf6h, VulnCheck advisory), while there is no evidence of active exploitation or CISA KEV listing at time of analysis.
EspoCRM versions 4.0.0 through 10.0.6 allow authenticated users to read email addresses that Role-based field-level restrictions are supposed to conceal, because the address-book search API does not enforce the emailAddress field permission. An attacker only needs a valid account with record access plus a deployment that relies on Roles to hide emailAddress from that user; environments that do not restrict the field have nothing to leak. Publicly available exploit code exists, though the impact is read-only disclosure and the issue has been assessed as a medium-severity, low-urgency information exposure (CVSS 5.3) with no indication of confirmed active exploitation in the wild.
Unauthenticated access to the real-time video streaming function in Swann SWIFI-SE2KIC cameras running firmware version 2.0.22 and earlier allows an attacker positioned on the same local network segment to view live camera footage without credentials or user interaction. The root cause is a missing-authentication weakness (CWE-306) affecting a critical function, rated 6.9 under the vendor's CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N); our independent CVSS 3.1 assessment agrees on the unauthenticated, no-interaction nature of the flaw and limits impact to confidentiality loss (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (the CVE is not in CISA KEV); the practical risk is bounded by LAN reachability rather than internet exposure.
Unauthenticated snapshot retrieval in Swann Communications SWIFI-SE2KIC camera firmware 2.0.22 and earlier lets any device already positioned on the same local or adjacent network segment pull a still image of the camera's live video feed without credentials or user interaction. The flaw is a missing-authentication-for-critical-function weakness (CWE-306) in the snapshot endpoint, and the assessed impact is confidentiality-only (C:H with I:N/A:N), so the exposure is a privacy/surveillance-data leak rather than code execution or denial of service. No public exploit code has been identified at time of analysis and the CVE is not tied to confirmed active exploitation; the practical attacker population is narrow because a network foothold on the camera's LAN or Wi-Fi is required, and the device is not reachable from the internet unless it has been deliberately port-forwarded or otherwise exposed.
Authenticated users with limited project permissions in GitLab Enterprise Edition (EE) can alter CI/CD deployment rollback settings without proper authorization due to insufficient access control checks (CWE-863). This low-severity integrity flaw (CVSS 2.7) affects GitLab EE versions from 13.6 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; publicly available exploit code exists, though active exploitation is not confirmed. The impact is limited to unauthorized modification of rollback settings, with no confidentiality or availability consequences, and exploitation requires an authenticated account and specific conditions.
A missing authorization check in GitLab CE/EE (Community and Enterprise Edition) lets an authenticated user holding only the Reporter role on a project read restricted CI artifact report content they should not be able to access, resulting in a confidentiality-only exposure (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Every release from 13.8 up to - but not including - 19.2.8, 19.3.5, and 19.4.2 is affected, so the exposure window spans several years of deployments. Publicly available exploit code exists (a HackerOne report is referenced), but there is no confirmed active exploitation (CISA KEV) and the issue is rated low-to-moderate priority; exploitation still requires a valid authenticated account with Reporter access and a target project that actually stores restricted CI artifact reports. Patched versions 19.2.8, 19.3.5, and 19.4.2 are available from GitLab.
Authenticated GitLab CE/EE users with only Guest-level access can read confidential epic content that is supposed to be restricted by external authorization, because the instance performs an incorrect authorization check on that content. All versions from 17.0 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 are affected, and the exposure is limited to read-only disclosure in deployments that actually protect confidential epics through external authorization. Publicly available exploit code exists, including a referenced HackerOne report, but there is no confirmed active exploitation (not in CISA KEV); GitLab itself reported and has since remediated the issue, and CVSS 3.1 scores it 4.3, reflecting the low, confidentiality-only impact.
Incorrect authorization logic in GitLab CE/EE allows an authenticated user holding a project-scoped fine-grained Personal Access Token to permanently delete or modify group-level labels that the token should not be able to reach, affecting versions 18.11 through before 19.2.8, 19.3 through before 19.3.5, and 19.4 through before 19.4.2. The flaw is rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), meaning exploitation requires a low-privileged authenticated account and token, is confined to integrity impact on group labels, and does not expose data or cause a denial of service; GitLab states exploitation is further gated by unspecified 'certain conditions' around label ownership. Publicly available exploit code exists and the issue was reported through HackerOne, but the impact is limited to label tampering rather than broader project or repository compromise, making this a low-to-moderate priority authorization issue for affected self-managed and GitLab.com-style deployments.
Improper authorization checks in GitLab CE/EE (CWE-863) allow an authenticated user to download package files belonging to a public project through the package registry when they should not have access, effectively bypassing project visibility and package-level access controls. The issue affects all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2; the CVSS vector (AV:N/AC:H/PR:L/UI:N) requires a valid account and depends on 'certain conditions' that are not fully enumerated, so exploitation is not reliable against arbitrary configurations. Publicly available exploit code exists - details were reported via HackerOne - but the CVE is not listed in CISA KEV, and the assessed impact is limited to unauthorized disclosure of package files, with no code execution, data modification, or availability impact, making this a low-to-moderate priority issue rather than an emergency.
Broken authorization in GitLab CE/EE lets an authenticated user who holds a project-scoped fine-grained Personal Access Token modify integrations belonging to a group outside that token's scope, affecting versions 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2. The issue carries a low CVSS 3.1 score of 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) and a CWE-863 root cause, requiring a valid token plus a high-complexity, not fully enumerated trigger, which limits the outcome to unauthorized integration changes rather than account or instance compromise. Publicly available exploit code exists (HackerOne report referenced as exploit material) and vendor-released patches are available; the vulnerability is not listed in CISA KEV, so it should be treated as a low real-world priority rather than an urgent one.
Information disclosure in Visual Studio Code stems from a path traversal flaw (CWE-22) that allows an attacker holding a low-privileged position and delivering crafted content to read files outside the intended workspace boundary once a victim opens that content. Versions from 1.0.0 up to but not including 1.141.1 are affected, and exploitation is not autonomous: the CVSS vector requires user interaction (UI:R) for the victim to open the malicious workspace, repository, or project folder, along with the privilege level indicated by PR:L, while impact is confined to confidentiality (C:H) with no integrity or availability effect. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis; at CVSS 6.8 this is a moderate-severity information-disclosure issue rather than a drop-everything emergency, and the vendor has published an update guide with patch availability.
Swann Communications SWIFI-SE2KIC cameras running firmware 2.0.22 and earlier expose their live video stream without any authentication check, allowing anyone who can reach the device over the local network to view the video feed using no credentials and no user interaction. The vulnerability is rated CVSS 4.0 base 5.9 by the originating CNA, while our independent assessment scores it CVSS 3.1 5.9 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact only and unaffected integrity or availability. Exploitation is constrained by the need for network adjacency to the camera (same LAN or Wi-Fi network); there is no default internet-facing vector, and no CISA KEV listing or public exploit code was identified at time of analysis, so this is a medium-severity information-disclosure issue whose risk is driven by access requirements rather than exploit difficulty.
Microsoft SharePoint Server Subscription Edition is affected by an observable-discrepancy weakness (CWE-203) that allows an authenticated, low-privileged user with network access to compare response content, timing, or error signals and use those differences to extract protected information and tamper with server-side data. Scope is limited to SharePoint Server Subscription Edition, and exploitation is not remote-unauthenticated: the attacker needs a valid account and must meet conditions outside their direct control (high attack complexity), so the issue is situational rather than mass-exploitable. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV not applicable; SSVC reports Exploitation: none, Automatable: no, Technical Impact: total), so the surrounding signals indicate limited real-world urgency for this moderate-severity issue.
Local privilege escalation in the .NET runtime lets an authenticated attacker who already holds low-privileged code execution on a host abuse improper link resolution (CWE-59) - planting a symbolic or hard link that a higher-privileged .NET file operation then follows - to acquire the privileges of the process that performs that file access. Exploitation is limited by local-only reachability, required user or privileged-process interaction (UI:R), and high attack complexity (AC:H) implying a race or narrow precondition the attacker cannot reliably control, which matches the SSVC rating of Exploitation: none and Automatable: no; no public exploit has been identified at time of analysis. Affected deployments include the .NET 9.0, 10.0 and 11.0 runtimes as well as Visual Studio 2022 17.14 and Visual Studio 2026 18.10, and the vendor has released patched builds for each affected line.
Path traversal (CWE-22) in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker read files outside an intended restricted directory over the network. Exploitation requires a valid low-privileged session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is not an anonymous, internet-wide attack - the credential requirement is the primary limiting factor, and CISA's SSVC assessment rates it Exploitation: none, Automatable: no, Technical Impact: partial. Impact is confidentiality-only (no integrity or availability effect), and no public exploit code has been identified at time of analysis; Microsoft has released a vendor patch.
Path traversal in Microsoft SharePoint Server Subscription Edition allows an authenticated attacker to read files outside the intended content directory, resulting in disclosure of confidential information over the network. The flaw affects SharePoint Server Subscription Edition builds prior to 16.0.20326.20190 and carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), meaning exploitation requires valid low-privilege credentials, needs no user interaction, and cannot modify data or cause denial of service. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis - the practical risk is concentrated on insiders or attackers holding stolen or low-privilege accounts rather than anonymous internet adversaries.
Improper input validation in Microsoft SharePoint Server Subscription Edition (versions 16.0.0 prior to 16.0.20326.20190) allows an attacker holding a valid low-privilege authenticated session to disclose confidential information over the network, with a CVSS 3.1 base score of 6.5. Because the vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the weakness is remotely reachable and trivially triggered once a session exists, but it cannot be exploited by a fully unauthenticated attacker and produces no integrity or availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a moderate-priority patch-and-monitor item rather than an emergency, though the high confidentiality rating means successful abuse could expose content the attacker is not entitled to read, and the affected server must be network-accessible to the attacker for exploitation.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated remote attacker with low privileges coerce the SharePoint server into making requests to destinations of the attacker's choosing, exposing information held on network-accessible resources that the server can reach (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Because the vector specifies PR:L, a valid low-privileged session on the affected build (16.0.0 before 16.0.20326.20190) is required and unauthenticated exploitation is not indicated; no user interaction is needed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a medium-priority, confidentiality-only issue whose urgency is driven by how widely low-privileged accounts are granted and whether the farm is internet-exposed.
Information disclosure in the Windows Presentation Foundation (WPF) component of .NET can be triggered when a Windows desktop application built on an affected Microsoft.WindowsDesktop.App.Runtime version renders attacker-supplied XAML or XPS markup, allowing an unauthenticated remote attacker to leak data (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The attack is unauthenticated but requires user interaction - the victim's application must load or navigate untrusted markup - and impact is limited to confidentiality, with no integrity or availability loss. No public exploit code was identified at time of analysis, CISA SSVC records exploitation as none and the issue as not automatable; vendor-released patches are available for .NET 8.0, 9.0, 10.0, 11.0 and the affected Visual Studio channels.
Incorrect authorization in Microsoft SharePoint Server Subscription Edition (versions below 16.0.20326.20190) allows an authenticated attacker with low privileges to disclose information over the network, with no user interaction required. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to properly validate whether a user is entitled to access certain data. No public exploit code or confirmed active exploitation is identified at time of analysis for CVE-2026-102865; the limiting factor is that the attacker must already hold valid low-privilege access, so realistic risk is highest in environments with many authenticated users or multi-tenant/shared SharePoint sites where cross-account disclosure matters.