Firefox builds prior to 158 mishandle a pointer in the DOM Notifications component, producing undefined behavior that attacker-controlled web content can drive into memory corruption, with possible disclosure of data and, at the high end of the assessed range, code execution in the browser. The attack is remote and needs no credentials, but it is not something an attacker can send at a server: the victim must load a malicious or compromised page in an affected Firefox version, which the independent assessment reflects by requiring user interaction. No public exploit code has been identified at time of analysis, EPSS sits at 0.19% (8th percentile) and the issue is not in CISA KEV, yet vuln.today labels it act_now on the strength of the 9.8 severity and the type of primitive involved.
A logic error in the Xen hypervisor's re-worked mitigation for Zenbleed (CVE-2023-20593 / XSA-433) leaves the AMD DE_CFG 'chicken-bit' workaround unset precisely when it is required, potentially allowing a guest to leak stale vector-register data across privilege boundaries on AMD Zen2 hosts. Only systems running a Xen build that contains the reworked workaround (addressed by XSA-515) on vulnerable AMD Zen2 processors are affected, and the attacker must already have code execution inside a guest domain on that same host. This is a local, microarchitectural-timing-dependent issue with no public exploit identified at time of analysis and a low EPSS score (0.16%), so the 9.8 network-vector CVSS rating supplied in some feeds materially overstates the real exposure. Per the authoritative assessment, the true profile is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N.
Privilege escalation in Adobe Experience Manager (AEM) allows an authenticated, low-privileged user - an author or contributor-level account - to abuse an Improper Restriction of XML External Entity Reference (XXE, CWE-611) in XML parsing and thereby read local files and reach internal resources well beyond their intended permissions, crossing a security boundary as reflected by the scope-changed CVSS 9.6 rating. The vector is network-reachable with no user interaction required (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), so the only real precondition is obtaining valid low-tier credentials, which makes author instances and deployments with broadly provisioned low-privilege accounts the highest-risk exposure. No public exploit code has been identified at time of analysis, and builds updated past the affected ranges are not exploitable.
RClone Manager versions prior to 0.2.7 start their bundled local rclone rcd engine on 127.0.0.1:51900 without authentication and with a wildcard CORS origin, so any web page the user visits while the daemon is running can issue cross-origin requests to that local API using the user's operating-system privileges. An attacker who convinces a user to open a malicious or compromised page can therefore read configured storage credentials and potentially access, modify, upload, or exfiltrate locally stored files and files reachable through the user's configured remotes; the advisory's possible command-execution impact is unconfirmed. Exploitation requires the local engine to be actively running and the user to load attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6); there is no public exploit identified at time of analysis, and the vendor-released patch is 0.2.7.
Incorrect authorization in Adobe ColdFusion 2023 (through update 2023.0.25) and ColdFusion 2025 (through update 2025.0.13) allows an authenticated low-privileged attacker to bypass security controls and gain unauthorized write access, enabling modification of protected resources. The CVSS vector indicates network reachability, low attack complexity, no user interaction, and a changed scope, with the primary impact being high integrity loss and low confidentiality loss; no public exploit code or active exploitation has been identified at the time of analysis. This is assessed as a genuinely high-priority issue due to the ease of exploitation once a low-privilege foothold is obtained.
Arbitrary code execution in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) stems from an incorrect authorization flaw (CWE-863) in a component that is restricted to the administrative network zone by default, letting an attacker who can reach that zone bypass authorization checks and execute code in the context of the current user without authentication or user interaction. The 9.6 CVSS score reflects a scope-changed (S:C) impact in which the compromised component can affect resources beyond its own security boundary, but the adjacent-network vector (AV:A, PR:N, UI:N) means the real-world exposure hinges on segmentation: organizations that properly firewall the ColdFusion administrative interface from ordinary users are largely insulated, while flat networks, exposed admin interfaces, or an existing internal foothold remove the only barrier. No public exploit code or confirmed active exploitation was identified at time of analysis.
A use-after-free in Mozilla Firefox's Networking component can be escalated into a sandbox escape, meaning a malicious page can corrupt freed memory and break out of the browser's content-process sandbox to reach higher-privileged code. Affected are Firefox builds prior to 158 and Firefox ESR builds prior to 153.5; no authentication is required, but exploitation depends on the victim navigating to attacker-controlled web content (UI:R), consistent with the assessed CVSS:3.1 vector of 9.6 and the SSVC 'not automatable' rating. Vendor-released patches exist in Firefox 158 and Firefox ESR 153.5; at time of analysis there is no public exploit identified, no CISA KEV listing, and no confirmed in-the-wild activity.
Sandbox escape and site-isolation bypass in Mozilla Firefox allow unauthenticated remote attackers to break the browser's security boundary by triggering a use-after-free in the Networking component. Affected are Firefox versions before 158 and Firefox ESR before 153.5; exploitation requires the victim to load attacker-controlled web content, meaning no autonomous trigger exists. No public exploit identified at time of analysis, though the 9.6 CVSS score and total technical impact warrant urgent patching.
Heap buffer overflow in ANGLE, Chrome's graphics translation layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox on Android. Chrome on Android builds prior to 155.0.8059.79 are affected, and the attack requires no authentication (PR:N) but does require the victim to render attacker-controlled web content (UI:R), with a CVSS base score of 9.6 and a scope change indicating sandbox-escape impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and SSVC rates exploitation as 'none' with automatable 'no', although technical impact is rated total and Google classifies the issue as Critical (Chromium security severity: Critical).
Mozilla Firefox before 158 contains a site-isolation weakness in the DOM Web Authentication component that can let attacker-controlled web content bypass intended authorization boundaries, with high confidentiality and integrity impact. Exploitation requires the victim to interact with malicious or compromised web content (UI:R); the attacker needs no authentication, and no public exploit code was identified at time of analysis, with EPSS at 0.22% (12th percentile). Mozilla fixed the issue in Firefox 158, and the referenced advisories should be used to confirm update paths.
Use-after-free in the Chrome Browser process before version 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. Google rates this Chromium security severity Critical, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects confirmed high confidentiality, integrity and availability impact with a sandbox-escape scope change; only user interaction - opening the malicious page - is required, and no authentication or prior access is needed. At the time of analysis there is no CISA KEV listing and no public exploit code identified, although weaponization of Chrome browser-process use-after-frees is a realistic near-term concern given the sandbox-escape payoff. Vendor patch: Google shipped a fix in the 155.0.8059.79 stable channel release.
Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).
A use-after-free in the Core component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Affected builds are those prior to 155.0.8059.79, per the vendor advisory (EUVD's affected-version data lists the same 155.0.8059.79 threshold). Exploitation requires unauthenticated remote delivery with user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) and is rated Critical by Chromium; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, though the SSVC Technical Impact rating of "total" and the scope-changing (S:C) sandbox-escape impact make prompt patching important. Note a platform discrepancy: the description specifies Chrome on Android while the cited vendor reference is a desktop stable-channel update, so the exact affected platform should be confirmed against the advisory.
Use-after-free in Google Chrome's network component allows remote attackers to execute arbitrary code outside the sandbox by delivering crafted network traffic to versions prior to 155.0.8059.79. Exploitation requires a victim to interact with attacker-influenced content (UI:R) but no authentication (PR:N), and the vulnerability carries a CVSS score of 9.6 (Critical). Although no public exploit code or active exploitation has been identified at time of analysis, the severity and potential for full system compromise warrant immediate patching.
Sandbox escape in Mozilla Firefox before 158 and Firefox ESR before 153.5 stems from uninitialized memory handling in the DOM Web Serial component. Unauthenticated remote attackers can induce a victim to load crafted web content that triggers the flaw and escapes the browser sandbox, with high confidentiality, integrity, and availability impact; user interaction is required. The issue is rated CVSS 9.6, but EPSS is only 0.19% and no public exploit was identified at time of analysis.
A sandbox escape in Mozilla Firefox's Networking component allows unauthenticated remote attackers to break out of the browser's security sandbox and potentially execute code on the host when a victim loads attacker-controlled web content. The vulnerability stems from incorrect boundary conditions (CWE-119) and carries a CVSS score of 9.6, though exploitation requires user interaction (UI:R) and the sandbox escape alone must be chained with a separate content-process code-execution primitive for full host compromise. No public exploit code has been identified, and the EPSS score is low at 0.19% (8th percentile); patched versions are Firefox 158 and Firefox ESR 153.5.
A sandbox escape in Mozilla Firefox's DOM Content Processes component lets a remote, unauthenticated attacker break out of the content-process sandbox if a victim merely renders attacker-controlled web content in any Firefox build prior to 158 (CVSS 3.1 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the score is scope-changed, a successful escape grants impact outside the sandboxed content process - high confidentiality, integrity and availability effects on the host rather than on the page alone - but in practice the escape generally has to be paired with a separate content-process code-execution flaw to convert the boundary crossing into full code execution. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.19% (8th percentile), and the mandatory user interaction of loading the malicious page is the main practical constraint on real-world exploitation.
Sandbox escape in Mozilla Firefox on Windows (Widget: Win32) lets attacker-controlled web content break out of the browser sandbox when chained with a separate content-process compromise, yielding high confidentiality, integrity, and availability impact. It affects Firefox builds before 158 and Firefox ESR before 153.5, with a CVSS 3.1 score of 9.6 that requires user interaction (UI:R) but no authentication (PR:N). No public exploit was identified at time of analysis, and EPSS is low at 0.16% (5th percentile), so the high severity and low observed exploitation signals diverge sharply.
Sandbox escape in Google Chrome desktop builds prior to 155.0.8059.79 allows an attacker who can already run a program on the target host to abuse an incorrect authorization check in Chrome's Updater component and execute arbitrary code outside the browser sandbox, with high impact to confidentiality, integrity and availability plus a scope change across the sandbox boundary. The independent assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning a pre-existing low-privileged local foothold and user interaction are both required, and CISA's SSVC rates the issue non-automatable, so opportunistic mass exploitation is unlikely. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped a vendor patch in Chrome 155.0.8059.79.
Missing authorization in the Admin/showdoctor.php admin display page of girishsaraf's Online-Appointment-Booking-System allows an unauthenticated remote attacker to directly invoke the endpoint and read administrative doctor-listing data (CWE-862). The project is a rolling-release PHP codebase with no pinned version, so exposure depends entirely on whether an organization has deployed this specific repository; the maintainer was notified through a GitHub issue but has not responded and no vendor patch exists. Publicly available exploit code exists, exploitation requires only network reachability of the affected page, and impact is confined to unauthorized read of admin data with no write or availability effect (per our assessment, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no confirmed active exploitation (CISA KEV) has been reported.
A double-free in Dragonfly's RDB stream loader (OpaqueObjLoader::CreateStream in src/server/rdb_load.cc) lets a remote, unauthenticated attacker corrupt the allocator, crash the server, and potentially execute code as the Dragonfly service account by sending a crafted serialized stream to the RESTORE command. All Dragonfly builds prior to the 1.40 fix are affected, and exposure is highest because Dragonfly ships with authentication disabled by default (no requirepass or ACLs), so network reachability to the client port is the only real precondition (assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; the upstream advisory scores it 9.6 with an AV:A/S:C vector). No public exploit code was identified at time of analysis and the issue is not tied to a CISA KEV entry, but the trigger is a single crafted RESTORE payload and the upstream fix has not yet been mapped to a published release, so unpatched, internet-reachable instances should be considered urgent.
Improper authorization in SourceCodester Simple Cafe Billing System 1.0 allows remote unauthenticated attackers to manipulate the 'Type' parameter in the save_user action of admin_class.php, enabling unauthorized modification of user roles within the User Management component. The vulnerability is network-exploitable (CVSS 4.0 base 5.5, CVSS 3.1 AV:N/AC:L/PR:N/UI:N) with no authentication or user interaction required, and publicly available exploit code exists; active exploitation has not been confirmed (not in CISA KEV). The application's narrow deployment footprint limits real-world exposure.
SQL injection in SourceCodester Online Reviewer System 1.0 allows unauthenticated remote attackers to alter the SQL query behind the login form at login/index.php by supplying crafted input in the username or password field. Because the vulnerable endpoint is the pre-authentication login page, exploitation requires only network reachability to the application - no credentials, user interaction, or non-default configuration - and publicly available exploit code exists (a PoC is published at tracexlabs.com). The impact is moderate rather than catastrophic: CVSS 6.9 and an independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L indicate limited confidentiality, integrity, and availability effects, most likely authentication bypass and/or disclosure of data held in the application's backend database.
Unauthenticated SQL injection in SourceCodester Online Exam System 1.0 allows remote attackers to manipulate the username and pass parameters submitted to the pre-authentication login handler at adminpanel/admin/query/loginExe.php, potentially bypassing authentication and reading or altering backend database contents. The flaw is remotely reachable with low complexity, no privileges and no user interaction (CVSS 4.0: PR:N/UI:N/AC:L), and publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported. EPSS and KEV data were not provided for this record.
SQL injection in the Admin/deleteclinic.php endpoint of girishsaraf's Appointment Booking System allows remote attackers to manipulate the cid and did parameters and alter backend SQL queries, with low confidentiality, integrity, and availability impact per the supplied CVSS 4.0 score of 6.9. Because the project uses a rolling release, no versioned affected or fixed release is published, and publicly available exploit code exists; no CISA KEV status is provided to confirm active exploitation. The supplied CVSS 4.0 vector marks PR:N (unauthenticated), but the authoritative independent assessment uses PR:L (authenticated) because the vulnerable script is in the Admin area and may require an admin session if access controls are enforced.
Unauthenticated SQL injection in the registration form of itsmeravitejak Online-Examination-System lets remote attackers inject arbitrary SQL through the 'branch' parameter, reaching the MySQLDB::addNewUser function in include/database.php. Because the registration form is intended to be reachable before authentication and requires no user interaction or non-default configuration, any internet-exposed deployment is directly attackable; impact is rated Low across confidentiality, integrity, and availability in our assessment, implying partial rather than full database compromise. Publicly available exploit code exists (a linked GitHub issue) and the maintainer has not responded, so no vendor-released patch or fixed version is available for this rolling-release project.
SQL injection in SourceCodester Performance Indicator System 1.0 lets a remote attacker manipulate the ID argument of /opils/staff/sales_history.php and inject arbitrary SQL into the application's database queries. Publicly available exploit code exists, and the provided CVSS 4.0 vector rates the issue 5.5 (AV:N/AC:L/PR:N/UI:N), though the /staff/ path indicates the endpoint may sit behind a staff-authenticated area, which would constrain real-world exploitation. Overall real-world priority is low because the product is rarely deployed and no CISA KEV or active-exploitation reporting is present in the supplied data.
SQL injection in the 'credit' parameter handled by /opils/staff/edit_credit.php in SourceCodester Performance Indicator System 1.0 lets remote attackers inject arbitrary SQL into backend database queries, with limited confidentiality, integrity, and availability impact as reflected in the 6.9 score and the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists - a proof-of-concept write-up was published in a GitHub issue linked from the CVE record - but there is no confirmed active exploitation (CISA KEV) at time of analysis. The supplied CVSS 4.0 vector asserts PR:N (no privileges required), yet the endpoint sits under a /staff/ administrative path, so defenders should verify whether their deployment requires a staff session; the dominant real-world limiter remains deployment scarcity of this niche PHP application.
SQL injection in SourceCodester Performance Indicator System 1.0 allows remote attackers to manipulate the Category argument in /opils/staff/product.php and alter database queries, yielding low impact to confidentiality, integrity, and availability. Publicly available exploit code exists; no CISA KEV confirmation is present, and authentication requirements are not confirmed because the supplied vector marks PR:N while the independent assessment suggests the staff endpoint may require login. Real-world risk leans low because the product has a rare deployment footprint and the assessed impact is limited, despite the medium CVSS 4.0 base score of 6.9.
SQL injection in SourceCodester Performance Indicator System 1.0 lets an attacker inject arbitrary SQL through the 'prodcategory' parameter handled by /opils/admin/addproduct.php, allowing manipulation of the underlying database contents and disclosure of stored data. The vulnerable endpoint sits under /admin/, so realistic exploitation most likely requires either a valid administrative session or an add-product page that lacks an adequate session check, which the independent assessment captures by scoring the issue PR:L rather than PR:N; the vendor-style vector instead lists PR:N, and that authentication requirement remains the key unconfirmed limiting factor. Publicly available exploit code exists for this issue, raising the likelihood of opportunistic scanning and abuse, though impact is bounded to low confidentiality, integrity and availability effects (CVSS 3.1 base 6.9, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and no CISA KEV listing indicates confirmed active exploitation.
Authorization bypass in the AdithyaYelloju Restaurant-Management-System lets remote attackers manipulate the user-controlled 'ID' argument processed by mysqli_query in the Order Management component to reach order records that belong to other users (CWE-639 / IDOR). No authentication or user interaction is required (CVSS PR:N/UI:N), and the impact is bounded to individual order records with Low confidentiality, integrity, and availability effects and no scope change. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and a public GitHub issue details the flaw), though there is no confirmed active exploitation (not in CISA KEV); real-world exposure is limited primarily by the project's negligible deployment footprint rather than by any technical barrier.
Unrestricted file upload in SourceCodester Library Management System 1.0 allows remote attackers to upload arbitrary files via the 'image' parameter to admin/add_admin.php, which uses move_uploaded_file without validating file type or extension, potentially leading to remote code execution if the uploaded file is web-accessible and the server executes PHP. Publicly available exploit code exists (though not confirmed as actively exploited in the wild), and the CVSS vector asserts unauthenticated access (PR:N), but the endpoint resides under an admin/ path, so exploitation may be limited to authenticated administrators in deployments that enforce access controls on that directory. Risk signals conflict and must be weighed carefully.
Unrestricted file upload in SourceCodester E-Learning System 1.0 lets remote attackers write arbitrary files, including executable PHP scripts, onto the server by manipulating the img argument in the save_users handler at /classes/Users.php?f=save. Successful exploitation depends on the endpoint being reachable and on the handler accepting the upload without file-type, extension, or content validation, followed by retrieving the uploaded file from a directory where PHP execution is permitted. Publicly available exploit code exists (referenced at tracexlabs.com as an 'elearning-preauth-rce' release) and the VulDB-sourced input warns it might be used; the CVSS 4.0 vector scores 6.9 with PR:N and UI:N, though our assessment notes that save_users is normally an administrative user-management action, so genuine pre-authentication reachability in a default install is not confirmed from the available data and should be verified.
SQL injection in the Admin/getclinic.php AJAX endpoint of girishsaraf's Online-Appointment-Booking-System lets remote attackers inject arbitrary SQL through the unsanitized city and cid parameters, allowing unauthorized read of database contents and limited data modification. The project uses a rolling release with no tagged versions, so every deployment up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 is presumed affected, and publicly available exploit code exists (no public exploit identified as actively exploited; not listed in CISA KEV). VulDB rates it CVSS 4.0 6.9 with PR:N, while our assessment scores it CVSS 3.1 PR:L and flags that authentication on the Admin/ path must be verified in the deployed instance, since that is the decisive limiter on real-world impact; the vendor was notified via issue #13 and has not responded.
Unauthenticated SQL injection in the AdithyaYelloju Restaurant-Management-System password-reset endpoint (User/forgot3.php) allows remote attackers to manipulate the email and password parameters and inject arbitrary SQL into backend queries. The flaw sits in the pre-authentication Password Reset component, so no valid account or prior login is required (CVSS:4.0 PR:N, UI:N), and the assessed impact is limited to partial confidentiality, integrity, and availability loss (C:L/I:L/A:L). Publicly available exploit code exists and has been described in the vendor's own issue tracker, but there is no indication of confirmed active exploitation and no vendor-released patch, since the project uses rolling releases and has not responded to the report.
Arbitrary file overwrite in Wazuh Manager (3.9.0 through versions prior to 4.14.8) lets an attacker who already controls an enrolled cluster worker node corrupt protected master-side files - including ossec.conf and agent.conf - by abusing a trailing-slash basename path-validation bypass and the lack of extra_valid enforcement in MasterHandler.process_files_from_worker. Because the manager runs as root and pushes configuration out to its fleet, the overwritten files escalate into root-level remote code execution on the manager and on every connected agent, which is why the vulnerability carries a CVSS 4.0 base score of 9.4 (independent CVSS 3.1 assessment: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The PR:H prerequisite is the key limiter: the attacker must already control a worker node that is enrolled and syncing with the master, so this is not anonymously reachable from the internet, standalone (non-clustered) managers do not expose the vulnerable path, and no public exploit code had been identified at time of analysis.
Unauthenticated SQL injection in SourceCodester Art Gallery Management System 1.0 lets a remote attacker inject arbitrary SQL through the 'Name' argument handled by Action::save_user in admin/admin_class.php during account creation, allowing manipulation of the underlying database. The vulnerable code path is reachable without credentials or user interaction (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N), and publicly available exploit code exists, including a pre-authentication admin-creation proof of concept, though this CVE is not listed in CISA KEV so active exploitation is not confirmed. Impact is rated low across confidentiality, integrity and availability (CVSS 6.9 base, assessed CVSS 3.1 6.9-equivalent), making this a moderate, opportunistic risk concentrated on internet-exposed instances of this niche PHP application.
Remote unauthenticated attackers can alter other users' appointment booking statuses in girishsaraf's Online-Appointment-Booking-System because the changebookingstatus.php submit2 handler lacks authorization checks (CWE-862). Publicly available exploit code exists, but the issue is assessed as moderate-risk and limited-impact - affecting only booking data - with the product's negligible deployment footprint constraining real-world exposure. No vendor patch has been released, and the project has not responded to the reported issue.
Unauthenticated SQL injection in the girishsaraf Online-Appointment-Booking-System allows remote attackers to manipulate the 'dateselected' argument of changebookingstatus.php and thereby alter backend database queries, with the assessed impact limited to low confidentiality, integrity and availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Publicly available exploit code exists - the vulnerability is documented in public issue report and VulDB entries - but there is no confirmation of active exploitation (no CISA KEV listing was provided). Because the project follows a rolling-release model, no version-tagged release can be pinned as affected or fixed: the observable snapshot is up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5, the maintainer was informed via GitHub issue #11, and no response or fix has been published. Multiple signals converge on this being a genuine but low-tier remote risk rather than an emergency, since the product is a niche open-source project with minimal production deployment and exposure - not a configuration prerequisite - is the principal limiting factor.
Improper authentication in AdithyaYelloju Restaurant-Management-System (pinned to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c) allows unauthenticated remote attackers to bypass the login form via crafted email and passwd parameters in User/login.php. Publicly available exploit code exists (referenced in GitHub issue #11), but no confirmed active exploitation (CISA KEV) has been observed. Despite a CVSS 4.0 score of 6.9, real-world risk is moderate-to-low because the project has no versioned releases and essentially no production installations; a successful bypass yields only low confidentiality, integrity, and availability impact.
Unrestricted file upload in SourceCodester Contact Tracing System 1.0 allows remote attackers to send a crafted file through the save handler at /classes/Users.php?f=save so that move_uploaded_file places attacker-controlled content into a web-accessible location, potentially yielding PHP code execution if the upload directory is executable. The provided CVSS 4.0 vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P, indicating no privileges or user interaction in the assessed scenario, though the endpoint's Users save context warrants source-level confirmation of pre-auth reachability, and impact is limited to version 1.0. Publicly available exploit code exists, but the supplied data does not confirm CISA KEV active exploitation.
Incorrect comparison in the session handler of itsmeravitejak Online-Examination-System (Session::checkLogin in include/session.php) allows remote, unauthenticated attackers to subvert login validation by submitting crafted cookname and cookid cookie values, producing low confidentiality, integrity, and availability impact. Publicly available exploit code exists, and the project follows a rolling release with no version pinning and has not responded to the early issue report; no KEV listing or EPSS data is available, and the practical exposure is limited by the small production footprint of this open-source examination application.
Authenticated remote attackers can exploit a SQL injection vulnerability in SourceCodester Performance Indicator System 1.0 by manipulating the 'pqty' parameter in the /opils/staff/edit_quantity.php endpoint. A public exploit has been disclosed, but the product's limited production use and the requirement for valid staff credentials (as indicated by the /staff/ path) make this a moderate, low-priority issue. No active exploitation has been confirmed.
SQL injection in code-projects Online Reviewer System 1.0 allows unauthenticated remote attackers to manipulate database queries via the User Update Handler at /reviewer/system/system/admins/manage/users/btn_functions.php, potentially leading to unauthorized data access or modification. The flaw has publicly available exploit code (Proof-of-Concept) and requires only network access to a deployed instance; no authentication or user interaction is needed per the CVSS vector (PR:N/UI:N). Rated moderate with a CVSS 4.0 base score of 5.5, exploitation could compromise the confidentiality, integrity, and availability of the application's data.
Cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, and SIMATIC Drive Controller CPU families allows an attacker to have malicious JavaScript run in the browser session of a plant engineer who imports a booby-trapped CSV trace file. The flaw is CWE-79: visual-marker data inside imported CSV trace files is not validated or sanitized before it is rendered on the controller's Trace page, so script embedded in that field executes in the web-server origin once the file is opened. Exploitation is not autonomous - per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) it is unauthenticated at the network layer but requires user interaction (UI:R) and a victim holding the 'Read diagnostics' function right, and the resulting script can perform PLC operations through the web server limited to that user's authorization; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). The severity is high (CVSS 4.0 base 9.4; assessed 3.1 10.0 with scope change) because a successful script can reach high-integrity PLC operations from the controller's own trusted web session.
Stored cross-site scripting in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows a remote attacker to place persistent JavaScript into a vulnerable form field, which then executes in the browser of any user who browses to the page rendering that field - per the vendor vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3), the injection step is unauthenticated, but the victim must subsequently visit the affected page, so this cannot fire fully automatically. Because the scope is changed (S:C) and confidentiality and integrity impacts are both High, a successful exploit can cross a trust boundary and yield session or account control over the victim rather than merely degrading the page, though availability is unaffected. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit identified at time of analysis; no EPSS score was supplied with this dataset, so that signal is unavailable.
Incorrect privilege assignment in Docker Hub's account-to-organization conversion feature lets an authenticated user bind a personal access token they control to a different Docker Hub account without the token secret ever being rotated or revoked. The unchanged PAT then continues to authenticate successfully - now as the recipient user - granting pull, push, and delete operations, within its existing scopes, across every repository that user can access, including organization repositories. Docker rates this 9.4 under CVSS 4.0 and our independent assessment characterizes it as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, but exploitation is not unauthenticated: the attacker must already hold a valid Docker Hub account and a PAT, and the damage is bounded by that token's scopes; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the integrated web server of Siemens SIMATIC S7-1500, ET 200SP, Drive Controller and S7-1500 Software Controller CPUs lets attacker-controlled JavaScript execute in a privileged operator's browser session after that user is social-engineered into importing a crafted trace file and its unsanitized comment fields are rendered on the Trace page (reported CVSS 4.0 base 9.4; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the script runs inside the victim's authenticated session, it can perform PLC operations through the same web server within the scope of that user's authorization, so impact is bounded by the victim's privileges rather than by the attacker's. Exploitation is gated by user interaction and by a reachable/enabled CPU web server, and the victim must already hold the 'Read diagnostics' function right; no public exploit code or CISA KEV entry is associated with this CVE in the available data (no public exploit identified at time of analysis).
Importing a maliciously crafted trace file into the integrated web server of a Siemens SIMATIC S7-1500 (and closely related ET 200SP, Drive Controller, Open Controller and S7-1500 Software Controller) CPU causes attacker-supplied JavaScript to execute inside the victim engineer's authenticated browser session and can issue PLC operations within that user's own authorization scope. Exploitation is not automated and not a mass-exploitation threat: it requires the CPU web server to be enabled, a victim who holds the 'Read diagnostics' function right, and successful social engineering into a manual file import (UI:A per the CVSS vector, which also carries PR:N, meaning the attacker needs no credentials of their own). The severity is high (CVSS 9.4 in the vendor's CVSS 4.0 assessment; our independent 3.1 assessment scores it AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), but this is a genuine high-severity issue rather than an imminent mass-exploitation threat - no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was provided in the source data.