Path traversal in SeldonIO MLServer up to and including 1.6.1 allows an attacker who can supply or influence a custom environment tarball to write files outside the intended extraction directory, because _extract_env in mlserver/env.py does not sanitize '../' entries in archive member names. The behavior is reachable remotely only when the model's environment_tarball feature is in use and a crafted archive is delivered to the extraction routine; in most deployments that means some form of model-artifact or upload access rather than truly anonymous access, even though the published CVSS 4.0 vector claims PR:N with UI:P (extraction must be triggered). This is a single-source VulDB disclosure, no public exploit code has been identified at time of analysis, no CISA KEV entry exists, and the vendor was contacted but did not respond, so no vendor-confirmed fix version is available.
Security-control bypass in Adobe's Content Credentials tooling allows remote, unauthenticated attackers to obtain limited unauthorized write access to content handled by affected SDKs by supplying malformed input that the library fails to validate. The issue (CVSS 3.1 score 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, CWE-20) affects Content Credentials Rust SDK (c2pa) up to c2pa-v0.90.15, C2PA Tool (c2patool) up to v0.27.15, and Content Credentials JS SDK (@contentauth/c2pa-web) up to 0.13.4, and requires only that the target application processes attacker-supplied content or manifests - no authentication, no user interaction, and no non-default configuration are needed. Impact is confined to integrity (I:L) with no confidentiality or availability loss, so the realistic risk is forged or tampered content-provenance records rather than system compromise; no public exploit identified at time of analysis.
Improper input validation in Adobe's Content Credentials SDK (c2patool ≤0.27.15, c2pa Rust SDK ≤0.90.15, and @contentauth/c2pa-web ≤0.13.4) allows unauthenticated remote attackers to bypass security measures and gain limited unauthorized write access when an application processes attacker-controlled Content Credentials manifests or assets. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), no authentication or user interaction is required, but the impact is confined to integrity with no confidentiality or availability loss. No public exploit code or active exploitation has been identified at time of analysis, and the issue is considered a genuine but modest-severity risk rather than a top-tier emergency.
Improper input validation in Adobe's CAI Content Credentials tooling (the Rust SDK c2pa-rs, the c2patool CLI, and the @contentauth/c2pa-web JS SDK) lets remote, unauthenticated attackers who supply crafted content manifests bypass a security feature and obtain limited unauthorized write access to content-provenance state. Per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N vector, no credentials or user interaction are required, but the impact is bounded to low-integrity writes with no confidentiality or availability loss, giving this a MEDIUM severity of 5.3. There is no public exploit identified at time of analysis and no KEV listing; the practical exposure is limited to applications and pipelines that actually ingest untrusted content or manifests into the affected component versions.
Code injection in PaddlePaddle PaddleX through version 3.7.2 allows an attacker to execute arbitrary Python code by supplying a crafted 'scale' value that the text-detection preprocessing component passes to a bare eval() call. The flaw is not reachable in a default deployment: it requires the victim to load an attacker-controlled PaddleX text-detection model or pipeline configuration, which is why the assessed vector carries User Interaction (UI:P) and a local attack vector despite high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and the upstream fix (PR #5212) is still awaiting acceptance, so no released patched version is independently confirmed.
Code injection in storyicon's comfyui_segment_anything custom node allows arbitrary Python code to run inside the victim's ComfyUI environment when a crafted GroundingDINO configuration is loaded through the SLConfig._file2dict routine in local_groundingdino/util/slconfig.py. Because the loader evaluates config-file contents as Python, an attacker who can place or share a malicious config (for example bundled with a shared workflow or downloaded model set) can execute code with the privileges of the ComfyUI process; the independent assessment rates this AV:L/UI:R with high confidentiality, integrity and availability impact confined to the host running the node. No public exploit was identified at time of analysis, and no vendor-released patch is available - the project was notified through GitHub issue #114 but has not responded.
Authenticated file-write path traversal in ai-fusion-video through 1.2.0 lets a logged-in user escape the intended media directory by supplying parent-directory sequences in the subDir parameter of POST /api/storage/upload, writing attacker-chosen filenames and extensions anywhere the service account can write. Only deployments using the local filesystem backend (LocalStorageStrategy) are affected, and the write primitive produces no confidentiality or availability impact by itself, so the real severity depends on where the service account can write; authentication is mandatory (CVSS 4.0 vector shows PR:L) and no public exploit identified at time of analysis. This is a moderate, not top-tier, priority finding - the risk rises sharply if the account can write into a web-served, startup, or configuration directory, which would turn an integrity-only write into a potential code-execution or configuration-tampering stepping stone.
A security-feature bypass in the Windows Kernel (CVE-2026-85939, CVSS 5.3) lets an authenticated attacker with only low-level privileges (PR:L per the CVSS vector) reach and subvert a kernel security control over the network, with the outcome limited to integrity impact - no loss of confidentiality or availability. Exploitation is not deterministic: the high attack-complexity rating (AC:H) indicates success depends on conditions outside the attacker's direct control, such as a race or timing window or a specific runtime state, and the affected kernel feature is not named in the available description. A vendor patch is available, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the risk is moderate and best addressed through prompt cumulative-update deployment across all supported Windows client and server branches listed in the advisory.
Improper verification of cryptographic signatures in CAI Content Credentials allows remote, unauthenticated attackers to bypass signature validation and obtain limited write access wherever C2PA manifests are verified against untrusted content. The affected code is the signature-verification path in the c2patool CLI (through v0.27.15), the Rust c2pa SDK (through v0.90.15), and the @contentauth/c2pa-web JS SDK (through v0.13.4). Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are required, but impact is bounded to partial integrity (I:L) with no confidentiality or availability effect, so this is a moderate-severity trust-decision bypass rather than an urgent remote-compromise bug; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Memory exhaustion in Grafana's Git Sync (provisioning) feature allows a Git server under attacker control to drive Grafana into uncontrolled resource consumption by returning oversized or highly compressed responses during a provisioning fetch. Grafana OSS, Grafana Enterprise, and the grafana/nanogit client library are affected, but only instances where an administrator has explicitly enabled Git Sync and pointed it at an attacker-influenced Git server are exploitable - this is not a default configuration. Impact is availability-only (memory exhaustion / denial of service) with no confidentiality or integrity effect; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L (5.3 medium), and no public exploit identified at time of analysis.
Broken access control in Stonewuu ai-fusion-video through 1.2.0 lets any authenticated user read other users' generated images, videos, and output metadata by supplying arbitrary task ids. The image and video generation /items endpoints perform no per-user ownership check, and because task records use predictable auto-increment identifiers, a low-privileged account can simply enumerate ids to harvest other tenants' generation results. Real-world risk is medium severity and confined to confidentiality (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, matching the 5.3 CVSS 4.0 score); no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Account takeover in Gotify server versions prior to 3.0.0 allows an authenticated attacker who possesses a valid client token to change the associated user's password without providing the current password or an elevated authentication step. This CWE-620 (Unverified Password Change) flaw gives the attacker control of password authentication for the account, potentially locking out the legitimate user and forcing recovery through an administrator or direct database access. The vulnerability is fixed in version 3.0.0, and no public exploit code or active exploitation has been identified at time of analysis.
Thread termination in Auth0 java-jwt versions 4.0.0 through 4.6.1 allows remote unauthenticated attackers to degrade service availability by sending JWTs with out-of-range timestamp claims (exp, nbf, iat). The fault occurs during token parsing before signature verification, so no valid credentials are needed. Repeated requests can exhaust service threads, causing a denial-of-service condition; no public exploit code or active exploitation has been identified at time of analysis. A patch is available in version 4.6.2.
Source-IP misattribution in fail2ban's default sshd filter allows a remote, unauthenticated attacker to have fail2ban ban an arbitrary IP address of their choosing. Because OpenSSH records the offered username verbatim in its log lines and fail2ban 0.10.5 through 1.1.1 (before commit ddd879d22664904ace24e1255ac6571808c58187) accepts an "on <token>" suffix after the parsed host address, an attacker can connect to the SSH service using a username such as "x VICTIM-IP on" and cause subsequent failed-login entries to be attributed to that victim address, resulting in a temporary firewall block against a legitimate user or host. The impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium) with no confidentiality or integrity loss; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated users of Siemens RUGGEDCOM CROSSBOW versions below V6.0 can retrieve system-wide infrastructure information-including details on all devices, substations, users, and scheduled activities-because the application fails to restrict database queries to the user's privilege level. This moderate-severity information-disclosure flaw (CVSS 4.3) has no public exploit identified at time of analysis and is not confirmed actively exploited. The impact is limited to read-only confidentiality loss of configuration and topology metadata, with no integrity or availability effects.
Stored cross-site scripting in Omnispace Agora Project before 26.10.0 lets an authenticated user post a message containing attacker-controlled iframe markup that survives the messenger's HTMLPurifier SafeIframe handling; the message is persisted and automatically rendered to every other member of the same channel, producing zero-click framed JavaScript execution and drive-by download delivery inside victims' browsers. Exploitation requires a valid Agora Project account with permission to post into a channel and shared channel membership with the intended victims, which confines the practical blast radius to that channel's participants and keeps priority moderate rather than urgent (CVSS 4.0 base 5.3, CWE-79, scoped impact S:C with low confidentiality and integrity effects). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor has addressed it in the 26.10.0 release.
Broken server-side authorization in Siemens RUGGEDCOM CROSSBOW (all versions before V6.0) allows an authenticated user holding only minimal privileges to retry, stop, or delete scheduled tasks belonging to other users, because the server does not re-verify authorization when these state-changing requests are submitted. The flaw is remotely reachable over the network with low complexity and no user interaction, but it requires a valid low-privilege CROSSBOW account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, vendor score 6.3), which narrows realistic exposure to insiders or attackers who have already obtained a low-tier account. Impact is limited to integrity and availability of scheduled-task state; there is no public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV). Siemens addressed the issue in the SSA-508506 advisory, with CROSSBOW V6.0 and later as the corrected release line.
RUGGEDCOM CROSSBOW versions prior to V6.0 insufficiently enforce server-side authorization for requests that schedule special operations, allowing an authenticated attacker with minimal privileges to schedule unauthorized actions on managed devices. The flaw is a client-side enforcement of server-side security (CWE-602) that can be triggered remotely without user interaction, though the attacker must already have valid credentials and network access to the CROSSBOW server. Siemens has released V6.0 to correct the issue; no public exploit code has been identified at time of analysis.
Malicious or compromised RD Gateway servers can crash FreeRDP clients running versions 3.0.0 up to but not including 3.32.0 by returning consent or service messages whose MsgBytes field is set far larger than the NDR string ActualCount, causing the UTF-8 conversion routine to read past the end of the stream allocation. The defect is a client-side heap out-of-bounds read (CWE-125) with a CVSS score of 5.3; the CVSS 4.0 vector indicates PR:N but UI:P, meaning the attacker needs no credentials on the client yet the victim must actively initiate an RDP session through the attacker-controlled gateway. The only confirmed outcome is a client-process crash - there is no code execution or data exposure - and at time of analysis there is no public exploit identified and the issue is not in CISA KEV; a vendor fix is available in FreeRDP 3.32.0.
Improper request handling in the Auth0 Lock (auth0-lock) login widget causes Active Directory login submissions to be issued as GET requests instead of POST, so user-entered form data is appended to the URL as query string parameters where it can be retained in server logs, browser history, proxy records, or Referer headers sent to downstream hosts. The issue affects auth0-lock 10.9.0 through 13.2.0 and 14.0.0 through 15.0.1, and per the CVSS vector it requires no privileges (PR:N) but does require user interaction (UI:R); exploitation further depends on an AD/enterprise connection being configured and a user entering a username that is a bare domain with no local part (for example 'example.com' rather than 'user@example.com'). Rated 5.3 with high attack complexity and a CWE-532 information-disclosure classification, this is a hygiene/patch-when-convenient item rather than an emergency, and no public exploit code was identified at time of analysis.
Authenticated members of the waynboot-mall mobile H5 API can overwrite or delete other members' saved shipping addresses, because AddressController in the waynboot-mobile-api module never verifies that the address record being changed belongs to the caller. Exploitation requires only a valid registered member account - no user interaction and no special configuration - and because address identifiers are auto-incrementing, victims are trivially enumerable via POST /address and DELETE /address/{addressId} requests. Rated CVSS 5.3 / assessed CVSS:3.1 5.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), this is a medium-severity IDOR (CWE-639) whose blast radius is bounded to address-record integrity and availability, with no confidentiality loss or account takeover; confirmed actively exploited? No - no public exploit code has been confirmed, though a technical disclosure writeup exists.
An out-of-bounds read in Microsoft SQL Server exposes memory contents to unauthenticated attackers who can reach the server's database listener from an adjacent network segment. The flaw is rated CVSS 3.1 base 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), so the disclosure is high-impact confidentiality only - there is no integrity or availability effect - and exploitability is constrained by High attack complexity, meaning success depends on server memory layout, timing, or state that the attacker cannot control, making the leak non-deterministic rather than reliably repeatable. Microsoft has published a fix through its update guide, and there is no public exploit code and no confirmed active exploitation (no POC, no CISA KEV; CISA SSVC records Exploitation: none).
Authorization bypass in Wazuh Manager 4.0.0 through 4.14.7 lets an authenticated low-privileged API user read the RBAC catalog by calling the GET /security/actions and /security/resources endpoints, which omit the caller's RBAC policy checks. The exposure is read-only: an attacker learns which privileged actions and endpoints exist, giving them a map to plan lateral movement or privilege escalation within the platform, but cannot modify data or disrupt the service. Authentication with a valid API account is mandatory (CVSS vector PR:L), the assigned score is 5.3, and no public exploit code has been identified at time of analysis; this is a medium-severity information-disclosure issue rather than an emergency, and vendor-released patch version 4.14.8 is available.
Improper authorization in QloApps through 1.7.0 lets an authenticated back-office employee who is scoped to a single hotel view, PDF-export, mark as redeemed, and convert other hotels' credit slips (refunds) into store-credit vouchers, exposing guest identities and refund amounts. The flaw only manifests in multi-hotel deployments, since the weakness is missing per-hotel scoping in the credit-slip queries, and the attacker must already hold a low-privilege back-office account that permits credit-slip access; an upstream fix (commit a759ae96 and PR #1650) is published but a tagged patched release was not independently confirmed. There is no confirmed active exploitation and no public exploit identified at time of analysis; the issue is tracked as CWE-862 (Missing Authorization) with a moderate CVSS of 5.3.
Hotel-restricted back-office employees in QloApps through 1.7.0 can create room types and inventory under hotels they are not assigned to by posting an arbitrary id_hotel value to AdminProductsController. The room-type form's hotel selector is populated by the unfiltered hotelsNameAndId() lookup, so a low-privileged employee can enumerate every hotel on the instance before targeting a foreign one; exploitation requires only a valid back-office account (CVSS vector PR:L), a multi-hotel deployment for the cross-tenant impact to matter, and no victim interaction (UI:N). No public exploit code has been identified at time of analysis, and the assessed impact is limited to low confidentiality and integrity loss (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), making this a genuine but medium-priority authorization fix rather than an emergency.
Server-side request forgery in Finsys Dockhand before 1.0.45 lets an authenticated low-privilege user redirect outbound requests to internal services by smuggling private, loopback, or cloud-metadata IPv4 addresses inside NAT64, 6to4, or Teredo IPv6 transition literals. The flaw lives in the ipCategory() function of src/lib/server/url-safety.ts, which does not classify IPv6 transition ranges as private, so any of the notification, backup, template, registry, git, or secret-provider URL fields can be abused as an SSRF vector. Rated 5.3 (CVSS 4.0; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), this is a genuine but moderate-priority issue rather than a critical one: exploitation requires an authenticated account, network reachability from Dockhand to the target service, and - for the highest-impact credential-theft scenario - a cloud deployment exposing the 169.254.169.254 metadata endpoint. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 1.0.45.
Stored cross-site scripting (CWE-79) in the integrated web server Trace page of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-supplied JavaScript embedded in a crafted calculated-signal file to execute in the browser session of a user who holds the 'Read diagnostics' function right, after that user is socially engineered into importing the file. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1 medium), the attacker is unauthenticated at the network layer but must rely on the victim performing a manual import, and the resulting script can drive PLC operations through the web server only within that user's existing authorization scope. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so exploitation is not confirmed as active; the practical risk is concentrated in environments where the PLC web server is exposed and diagnostic staff routinely import calculated-signal files.
Reflected cross-site scripting in the integrated web server of a broad range of Siemens SIMATIC S7-1500, ET 200SP, and Drive Controller CPU families allows attacker-controlled JavaScript to execute in the browser of an authenticated user who imports a crafted CSV trace file on the Trace page. The signal names inside the imported file are not sanitized before being echoed back into an error message, so the script runs in the context of that user's session, with the assessed impact limited to low confidentiality and low integrity (CVSS 3.1 base 6.1, CWE-79). Exploitation is not self-propagating and requires social engineering: the victim must hold the 'Read diagnostics' function right and must be persuaded to import the malicious trace file, since the CVSS vector specifies PR:N but UI:R, meaning no attacker credentials are needed while user interaction is mandatory; no public exploit code has been identified and the issue is not listed as actively exploited at time of analysis.
Stored/DOM cross-site scripting (CWE-79, CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the web-based Trace page of Siemens SIMATIC S7-1500, ET 200SP and Drive Controller CPUs allows attacker-controlled JavaScript to run in an authenticated user's browser session when signal names taken from an imported CSV trace file are rendered unsanitized in Trace page selection menus. The attack is not self-triggering: an attacker must first socially engineer a user who holds the 'Read diagnostics' function right into importing a crafted trace file through the built-in CSV import feature, and execution occurs only when that victim subsequently interacts with an affected selection menu, so impact is confined to the victim's authenticated session with low confidentiality and integrity effects and no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and there is no path for an unauthenticated remote attacker to trigger the flaw without victim interaction.
Authenticated Waynboot-mall members can read, modify, or cancel other users' orders through the mobile order API (detail, cancel, confirm, delete, and refund endpoints) by supplying another member's order ID or serial number. Because order identifiers are sequential and enumerable, an attacker only needs any registered member account to automate retrieval of other members' shipping addresses and phone numbers or to disrupt their orders. The flaw is present through release 2.0.0; no public exploit code identified at time of analysis.
Jorani leave-management systems before version 1.0.4 allow any authenticated user-regardless of HR or administrative role-to export sensitive employee data through the unprotected HR controller actions hr/exportEmployees, hr/exportLeaves/{id}, and hr/exportOvertime/{id}. Because those actions lacked the list_employees authorization check, a low-privileged account holder can directly request the endpoints and download employee names, emails, contracts, managers, and other employees' leave and overtime records. This is a genuine but moderate-severity information-disclosure issue (CWE-862, CVSS:4.0 5.3; assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with read-only impact; no public exploit code was identified at time of analysis and there is no confirmed active exploitation.
Cart tampering in waynboot-mall through 2.0.0 allows any authenticated shop member to modify or delete other members' shopping cart items by manipulating sequential cart identifiers through the mobile API endpoints PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId}. The flaw is an insecure direct object reference (CWE-639): the CartController forwards a client-supplied cartId to CartServiceImpl without verifying that the referenced cart record belongs to the requesting member, so an attacker can enumerate neighboring cart IDs to alter quantities, change selection state, or remove items from other users' carts. Impact is limited to integrity of other members' cart data - there is no confidentiality exposure, account takeover, or availability impact - and exploitation requires a valid member-level account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 5.3). No public exploit code has been identified at time of analysis, and no vendor-released patch has been confirmed; a public technical write-up describing the flaw is linked from the references.
Authenticated sellers can alter shipping freight templates for other stores' products in lilishop through 4.4 by exploiting an insecure direct object reference (IDOR) at PUT /store/goods/goods/freight. This requires a valid seller account on a multi-tenant instance with more than one store, and the flaw allows binding a seller's own freight template to competitors' goods and SKUs, modifying shipping charges without affecting data confidentiality or availability (CVSS 3.1: 5.3, PR:L, I:L). No public exploit identified at time of analysis and no CISA KEV confirmation; the risk is a genuine but contained authorization bypass, bounded to business sabotage rather than system compromise.
Authenticated users holding only query-level access in JetLinks Community (through 2.10.0) can enable or disable any alarm configuration by ID, allowing an attacker to silently suppress alerts for monitored IoT devices. The AlarmConfigController _enable and _disable endpoints omit the save-action authorization annotation, so a state-changing operation is reachable with read-only permissions (CWE-862 missing authorization; the supplied CVSS:4.0 vector shows PR:L, VI:L). Exploitation requires valid low-privilege credentials and knowledge or enumeration of alarm configuration IDs; no public exploit code or confirmed active exploitation has been identified at time of analysis.
FrankenPHP's official Debian and Alpine Docker images prior to 1.12.5 ship a placeholder /app/public/index.php that executes phpinfo(), so any derived image that never replaced that file serves a full diagnostics page from its web root; a single unauthenticated HTTP GET (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) discloses environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and filesystem paths. The precondition is narrow and non-default: only containers built from those official base images and left with the untouched placeholder are exposed, while deployments that supply their own /app/public/index.php per the documented pattern are not affected. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the fix is a simple base-image bump to 1.12.5 plus a rebuild of every derived image, since existing derived images keep the placeholder even after the upstream fix.
Information disclosure in Plane (open-source, self-hosted project management) before version 1.4.0 lets remote attackers probe the backend database schema and infer stored field values by manipulating the order_by query parameter, which is passed unsanitized into Django's order_by(). The only fully unauthenticated path runs through published public deploy boards handled by IssueListSpaceEndpoint; the other affected listing endpoints (cycles, modules, intake, notifications, projects, issue activity) require authenticated project access. No public exploit code has been identified at time of analysis and there is no KEV listing, but the upstream fix commit and pull request are publicly visible, so reverse-engineering is feasible; the issue is fixed in 1.4.0.
Authenticated low-privileged users of the Bender Customer & Partner platform can retrieve the administrator-only role list because an affected endpoint performs no server-side authorization check (CWE-862). The flaw is reachable over the network with no user interaction, but an attacker must already hold a valid low-tier account, and the exposed data is explicitly limited to a non-sensitive role listing, so the impact is confined to a low-level confidentiality loss. No public exploit code has been identified at time of analysis, and the overall issue is a genuinely low-priority one: it is a broken access control on an already-authenticated endpoint rather than a true authentication bypass, despite the record's 'Authentication Bypass' tag.
Authenticated members on PublicCMS trade/shop deployments can overwrite other members' shipping address records via an insecure direct object reference in the TradeAddressController tradeAddress/save handler. The flaw affects PublicCMS through V6.202608.a and lets an attacker submit another member's sequential numeric address id to change addressee, telephone, and address fields because ownership by the session user and site is never verified. The independent assessment rates it as a genuine but limited-impact CWE-639 integrity flaw (CVSS 3.1 PR:L, I:L, no confidentiality or availability impact), not a high-priority emergency, and no public exploit was identified at time of analysis.
Cross-site scripting (CWE-79) in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPUs allows attacker-controlled JavaScript to run in an operator's browser when a crafted CSV trace file is imported and its calculated signal data is rendered on the Trace page. Exploitation is not automatic: an attacker must socially engineer a user who already holds the 'Read diagnostics' function right into importing the malicious file, and the injected script then executes within that user's session and can drive PLC operations through the web server, limited to that user's authorization scope. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) reflects that access is remote over the network but requires victim interaction; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP and SIMATIC Drive Controller CPUs allows an attacker to bury JavaScript inside the visual properties of calculated signals in a crafted CSV trace file, which then executes in the browser session of anyone who imports that file and opens the Trace page. Exploitation is neither remote nor automatic: the CPU web server must be enabled and reachable, and a social-engineered operator holding the 'Read diagnostics' function right must import the file (CVSS 6.1, UI:R, PR:N), after which any resulting PLC operations are confined to that operator's own authorization scope. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Authenticated IDOR in Jorani (PHP leave-management application) before 1.0.4 lets any ordinary self-service employee - no HR or administrator role required - view, tamper with, or delete colleagues' leave and overtime requests by supplying another employee's numeric request ID to Leaves::edit(), Leaves::delete(), Leaves::history(), Extra::edit(), or Extra::delete(). Because the five affected endpoints authorize by operation name only and never confirm that the targeted record belongs to the acting user, the flaw is a classic authorization design error (CWE-639) whose impact is confined to the confidentiality and integrity of leave/overtime records rather than code execution or data exfiltration at large. Independent assessment places this at medium severity; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited.
FreeRDP clients from 3.0.0 through 3.31.x can leak uninitialized heap memory to a malicious or compromised RDP server through the smartcard redirection channel. An unauthenticated remote attacker controlling the server side sends an SCardTransmit request carrying an invalid card handle together with a nonzero receive length, which causes smartcard_pack_transmit_return to serialize up to 66,560 bytes of stale heap contents back to the attacker, disclosing client process memory but not enabling code execution or service disruption. Exploitation is not trivial: the victim must initiate the RDP session to the hostile endpoint and must have smartcard/device redirection enabled, and no public exploit code or CISA KEV confirmation was identified at time of analysis, so this is a genuine but non-urgent medium-severity (CVSS 4.0 base 5.3) client-side information disclosure.
Authenticated users of Siemens RUGGEDCOM CROSSBOW versions prior to V6.0 can read, modify, or delete subnet configurations because the platform's subnet-management database queries fail to enforce proper per-object authorization (CWE-639). The flaw carries a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning exploitation requires valid credentials (PR:L), is network-reachable, and results in limited confidentiality and integrity impact on subnet configuration data with no availability impact. Siemens addressed the issue in V6.0; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Authenticated insecure direct object reference (IDOR) in Yshopmall through 2.0.0 allows any logged-in member to read, tamper with, or delete other members' after-sales records by supplying a victim's after-sales id together with the matching orderCode. The flaw affects the after-sales API endpoints deleteAfterSalesOrder, addLogisticsInformation, and GET /applyForAfterSales/{key}, where server-side logic never verifies that the referenced record belongs to the caller. Rated 5.3 (CVSS 4.0) and assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, this is a bounded, medium-severity authorization issue requiring valid member credentials; no public exploit code has been identified and there is no CISA KEV entry indicating active exploitation.
Missing authorization in Jorani's Contracts::import() handler lets any authenticated user, including a low-privilege one, submit a contract id plus an arbitrary URL over POST to import days off into any contract, overwriting its non-working-day calendar and driving server-side requests into internal networks. The flaw is present in default installations of Jorani before 1.0.4, where the import action lacks the isAllowed('adddayoff_contract') permission check that v1.0.4 introduces, so no non-default configuration is required. Exploitation requires a valid Jorani session and is network-reachable with no user interaction (CVSS 4.0 base 5.3 Medium; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N with limited confidentiality and integrity impact); no public exploit code identified at time of analysis.
Unauthenticated information disclosure in SAP NetWeaver Enterprise Portal allows remote attackers to bypass resource restrictions and retrieve non-critical application information, producing only a low confidentiality impact (CVSS 5.3). The issue is mapped to CWE-552 and tagged as path traversal, so exposed portals may leak reconnaissance-grade data rather than credentials or code execution. No public exploit identified at time of analysis; exposure is reduced when the portal is not internet-facing or is protected by a reverse proxy/WAF that filters traversal patterns.
Froxlor versions before 2.3.14 expose the full contents of other administrators' email templates to authenticated reseller admins through an insecure direct object reference in the email template editor (admin_templates.php). A reseller admin supplies their own subjectid while substituting a sequential, foreign mailbodyid in an edit request, and the application returns the mail body without verifying that the requester owns the referenced record. Rated CVSS 5.3 (v4.0) and independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, this is a moderate authorization-boundary issue: there is no public exploit identified at time of analysis, no write or code-execution capability, and it yields nothing in single-admin deployments where no other tenants' templates exist.
Froxlor 0.10.0 before 2.3.14 leaks full-admin-only MySQL server and cronjob configuration metadata to authenticated reseller accounts through the MysqlServer.listing, MysqlServer.get, and Cronjobs.listing API read commands in api.php. The missing authorization check (CWE-285) requires an authenticated reseller-level account on a multi-tenant instance with API access enabled, and impact is limited to read-only disclosure of management usernames, hosts, ports, TLS settings, and cron metadata with no write or code-execution capability. No public exploit identified at time of analysis, and the issue is assessed as modest-severity information disclosure rather than a top-tier priority.
Missing authorization in the WordPress plugin WP User Manager (all versions through 2.9.23) allows remote attackers to reach plugin functionality that should be protected by access-control checks, disclosing limited information. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with confidentiality-only impact (C:L/I:N/A:N), exploitation requires no authentication and no user interaction against any site running the vulnerable plugin version, but the consequences are capped at low-severity information exposure. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; with a CVSS base score of 5.3 and the Patchstack-reported broken access control classification, this is a moderate, low-priority finding that still warrants patching or virtual patching on internet-facing WordPress sites.
Premium Addons for Elementor, a WordPress plugin that extends the Elementor page builder, fails to enforce an authorization check on at least one of its functions in versions up to and including 4.11.110, allowing remote attackers to reach functionality or data that should be restricted. The published CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the flaw is network-reachable with no credentials and no user interaction required, so default installations are exposed, but the scored impact is confined to LOW confidentiality (C:L/I:N/A:N) - read access to limited information or a restricted action rather than site takeover. There is no CISA KEV entry and no publicly available exploit code identified at time of analysis, so this is a moderate-severity, low-priority issue best handled through routine plugin patch cycles.