Unauthenticated remote code execution in Cisco Secure Email Gateway allows attackers to write arbitrary files and execute commands as root by sending a crafted email attachment when the AMP file reputation service is enabled. The flaw, a relative path traversal (CWE-23) in attachment handling, requires no authentication or user interaction, but only gateways with file reputation active are vulnerable. No public exploit or active exploitation has been identified at time of analysis, though the critical CVSS score of 9.8 and the configuration prerequisite make it a priority for defenders to inventory exposed appliances.
Unauthenticated OS command injection in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) before 26.4.303 allows remote attackers to execute arbitrary commands on the Nextcloud host via proxy.php, but only while the bundled CODE server process is not running - the window right after a restart, during startup, or following a crash. The CVSS 4.0 score is 9.2 and the CVE record attributes exploitation during September and October 2026, making this a genuine high-priority issue rather than a paper-tiger high-severity finding; the practical barrier is timing, not authentication, since the CVSS vectors carry PR:N/UI:N and an attacker can simply poll the endpoint until CODE is down. Standalone Collabora Online servers do not ship proxy.php and are explicitly not affected - the exposure is confined to Nextcloud instances with the richdocumentscode app, and the flaw is distinct from CVE-2025-66208.
OS command injection in EG Secure Solutions' SiteGuard Server Edition allows an attacker who already holds a low-privilege account or foothold on the host to execute arbitrary OS commands as root (Apache httpd/nginx on Linux or FreeBSD) or SYSTEM (IIS on Windows), achieving full compromise of the affected server. The CVSS 4.0 base score of 8.5 reflects a local attack vector (AV:L) with low privileges (PR:L), no user interaction (UI:N), low complexity (AC:L), and high confidentiality, integrity, and availability impact confined to the vulnerable system (VC:H/VI:H/VA:H, SC:N/SI:N/SA:N) - it is not remotely exploitable by an anonymous external client. No public exploit code and no confirmed active exploitation were identified at time of analysis; JPCERT/CC reported the issue and EG Secure Solutions and JVN have published advisories.
Authenticated attackers holding high-privilege administrative access to the PAN-OS management interface can execute arbitrary code with root privileges on PA-Series and VM-Series firewalls and on Panorama (virtual and M-Series). The underlying weakness is a code-injection flaw (CWE-94) in the management plane that is network-reachable with low attack complexity, but the realistic attacker population is narrow because CVSS PR:H requires the adversary to already possess an authenticated high-privilege session, and Palo Alto's recommended practice of limiting management access to trusted internal IP addresses largely neutralizes the exposure. Cloud NGFW and Prisma Access are explicitly not impacted, and no CISA KEV entry or public exploit code is identified in the available data at time of analysis.
Unauthenticated remote attackers can delete arbitrary files from WordPress installations running the File Upload to Order plugin before 1.1.4, because the plugin's deletion routine trusts a file path taken from attacker-controlled session data and applies neither validation nor path confinement (CWE-73). The assessed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H) confirms no authentication or user interaction is needed and that impact crosses the plugin's own security scope into the host WordPress installation, where deleting a file such as wp-config.php can escalate to full site compromise. Publicly available exploit code exists, but SSVC records no observed exploitation and EPSS remains low at 0.19% (8th percentile), so this is currently an easy-to-automate, high-impact integrity/availability risk rather than a confirmed active campaign.
Unauthenticated OS command injection in the D-Link DIR-868L router running firmware 2.01b05 lets remote attackers execute arbitrary shell commands on the device by sending a crafted SOAPACTION argument to the HNAP handler exposed through /htdocs/cgibin. The flaw is remotely reachable with no credentials, no user interaction, and no non-default configuration required (CVSS v4.0 base 9.3, assessed v3.1 as AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), so any installation exposing the HNAP management interface is at risk; LAN-only deployments are largely confined to local-network exploitation, while devices with WAN-side remote management enabled are directly attackable from the internet. Publicly available exploit code exists (a detailed advisory and PoC are published on GitHub), which raises the practical urgency, though active exploitation is not confirmed by CISA KEV, and the product is an end-of-life model for which no vendor-released patch has been identified.
Unauthenticated remote code execution as SYSTEM affects Report One MyReport Updater through version 2.1.1, whose updater service exposes a gRPC endpoint on TCP port 9095 without any authentication. Any remote attacker who can route to that port can invoke the UpdateConfigReferent method to redirect the SYSTEM-privileged updater to an attacker-controlled reference server and deliver modified module archives; publicly available exploit code exists (published by Quarkslab), and successful abuse hinges on the attacker operating a malicious reference server whose module archives carry MD5 digests matching what the updater expects, which independent assessment rates as attack complexity High. Independent assessment confirms this as a genuine high-priority issue rather than a CVSS-inflated paper risk, with full confidentiality, integrity and availability impact confined to the vulnerable host.
Arbitrary file access and operating-system command execution in Stirling-PDF prior to 2.13.2 are reachable by an authenticated administrator who uploads a crafted SQL file to POST /api/v1/database/import-database on instances running the default H2 database backend with security mode enabled. DatabaseService.validateSqlContent() splits the normalized input on semicolons and accepts a statement if it merely contains an allowed keyword, so dangerous H2 constructs such as FILE_READ, CSVWRITE and CREATE ALIAS slip past the whitelist and execute when RUNSCRIPT processes the import; the demonstrated chain writes attacker-controlled startup files to a user-site location and triggers the application's Python interpreter to load them, yielding command execution as the JVM service account. The CVSS 3.1 base score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects network reachability with full confidentiality, integrity and availability impact and a scope change, but PR:H means the attacker must already hold administrative privileges and non-H2 deployments are unaffected; no public exploit code identified at time of analysis, and the issue is fixed in version 2.13.2.
Stored cross-site scripting in the WP Booking System WordPress plugin before 2.1.0.1 lets unauthenticated attackers plant a malicious payload through a public-facing booking form; the value is stored without sanitisation or escaping and is later rendered unescaped inside an administration screen, where it executes in the session of any administrator who views the record. Exploitation is gated by that administrator interaction - the payload is inert until an admin opens the affected admin view - and CISA's SSVC assessment rates the issue as not automatable with no observed exploitation, while our own assessment caps the realistic impact at low confidentiality and integrity within a changed scope (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) rather than the 8.8 score reported by NVD. Publicly available exploit code exists and the plugin is widely deployed, but EPSS is only 0.22% (12th percentile) and there is no confirmed in-the-wild activity, so the practical risk hinges on whether an administrator can be induced to open the poisoned admin screen.
Stored cross-site scripting in the Forms WordPress plugin (versions before 3.0.2) allows an unauthenticated attacker to submit a crafted form value that the plugin neither sanitises on storage nor escapes when rendering the form submissions screen, so the injected script executes in the browser of any administrator who later opens that dashboard view. Exploitation depends on the site actually using the plugin's public-facing submission feature and on a privileged user subsequently viewing the submissions list, which makes execution deferred and not attacker-controlled in timing; public exploit code exists, but exploitation is not confirmed active (CISA SSVC: exploitation none) and EPSS is low at 0.21% (10th percentile). Our independent assessment re-scores the issue as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - a genuine but non-urgent risk rather than a widespread emergency.
Unauthenticated SQL injection in the Fast Courier WordPress plugin (versions 5.0.0 through 5.2.3) lets any remote attacker who can reach the plugin's unauthenticated REST route inject arbitrary SQL and read data from the underlying WordPress database. No credentials or user interaction are required (CVSS vector PR:N/UI:N), and the impact is confidentiality-only - data can be read but not modified, and availability is unaffected (I:N/A:N). Publicly available exploit code exists and the finding is documented in a WPScan advisory, though EPSS is only 0.21% (11th percentile) and there is no CISA KEV listing, so this is a genuine but non-emergency, scope-limited issue that chiefly matters to sites running this niche plugin below 5.2.4. Vendor patch: 5.2.4.
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execute SQL injection and forge payment webhooks, marking arbitrary WooCommerce orders as paid. The webhook signature check uses a signing secret that is empty by default, so any default installation is vulnerable; the SQL injection works without authentication or user interaction. Publicly available exploit code exists, but EPSS is low (0.21%, 11th percentile) and CISA SSVC indicates no observed exploitation; the vendor has released patch version 1.8.5.
Unauthenticated local file inclusion in the Ultimate Multisite WordPress plugin before 2.17.2 allows remote attackers to traverse the filesystem and read arbitrary local files, including wp-config.php with its database credentials and authentication salts. The plugin passes a user-supplied file-selection value directly into an include operation without validation, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) confirms no authentication and no user interaction are required. Publicly available exploit code exists, but EPSS is low at 0.20% (10th percentile) and CISA SSVC records no known exploitation, so real-world risk is concentrated in internet-reachable WordPress sites that have the plugin active.
Local privilege escalation in MyReport Updater through 2.1.1 allows authenticated low-privileged local users to gain SYSTEM rights by abusing the updater service's gRPC interface (UpdaterManager.exe) to set a malicious reference server and arbitrary installLocation, then planting a DLL such as HID.dll that is loaded by osk.exe. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). With a CVSS 4.0 score of 8.5 and assessed CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this is a genuine, actionable local privilege escalation rather than an inflated high-CVSS score, though it is not a mass-exploitation emergency.
TurboDocx html-to-docx through 1.23.1 is vulnerable to server-side request forgery (CWE-918): when an application converts attacker-supplied HTML to DOCX with remote image handling enabled, the library dereferences <img src> URLs server-side, and a loose isValidUrl() check allows loopback, RFC1918 private, and cloud metadata addresses (e.g. 169.254.169.254) to be requested and their responses embedded into the generated document's word/media folder. The flaw is remotely reachable without authentication or user interaction (CVSS:4.0 PR:N/UI:N, 8.2; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), and publicly available exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing) and no vendor-released patch identified at time of analysis. Real-world risk is conditional rather than universal: the attacker must supply a live, responsive internal target, the fetched response must be readable from the returned DOCX, and deployments that disable remote image fetching, filter outbound traffic, or restrict HTML input are not exploitable.
Use-after-free in curl's HTTP/2 client code (curl 8.12.0 through 8.22.0) can corrupt memory when a server answers an in-progress upload with an HTTP/2 RST_STREAM frame carrying the HTTP_1_1_REQUIRED or REFUSED_STREAM reason code, freeing the internal struct Curl_easy object while it is still referenced by the transfer state machine. The flaw is remote and requires no authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but exploitation is conditional: the victim must be uploading over a negotiated HTTP/2 connection to an endpoint the attacker controls or influences, and the RST_STREAM must land at the right point in the transfer lifecycle, which is why the assessed complexity is High. Publicly available exploit code exists (SSVC Exploitation: poc) and CISA's framework rates technical impact as total, yet there is no confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.23% (12th percentile); a vendor patch is available. The same flaw affects libcurl and therefore every downstream application and distribution shipping an affected build.
Remote code execution in the affiliate-toolkit WordPress plugin (versions before 3.9.1) lets an authenticated user holding the Contributor role or higher submit a template body that the plugin's bundled templating engine compiles and runs as PHP, giving full server-side code execution with high confidentiality, integrity, and availability impact. Any WordPress site running an affected version is exposed, and because Contributors are unprivileged content authors, sites with open author self-registration or large multi-author teams carry the greatest practical risk; no end-user interaction is required. Publicly available exploit code exists (documented via WPScan) and the EPSS score is low at roughly 0.18% (8th percentile), with no indication of confirmed active exploitation (CISA KEV) and no SSVC exploitation signal, so this rates as a moderate-but-real priority for sites that actually run the plugin.
Malicious SMB servers can crash libsmb2 clients through version 6.2 by returning a crafted SMB2 QUERY_INFO reply that triggers a heap out-of-bounds read during security descriptor decoding. The bug is an integer underflow in decode_acl: an ACL whose AclSize field is smaller than 8 bytes underflows the remaining-buffer counter, bypassing the per-ACE bounds check and producing an availability-only denial of service with no code execution, data disclosure, or integrity loss. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV), and the attacker must either control the SMB server the victim connects to or hold a man-in-the-middle position on an unsigned SMB session (UI:P/UI:R), making this a moderate-priority availability issue rather than an emergency.
Heap out-of-bounds read in libsmb2 through 6.2 allows a malicious or man-in-the-middle SMB server to crash the client by returning crafted QUERY_INFO replies for FileFsVolumeInformation or FileFsAttributeInformation with missing or oversized name-length fields. Affected clients must issue a filesystem-information query against an attacker-controlled endpoint, or an attacker must hold a man-in-the-middle position on an unsigned SMB session, so exploitation is remote and unauthenticated but requires the victim to initiate the connection (user interaction). Publicly available exploit code exists, but there is no confirmed active exploitation and the impact is confined to a client crash, with no demonstrated confidentiality or integrity effect. The vendor has published an upstream fix.
A heap out-of-bounds read in libsmb2 through 6.2 lets a malicious SMB server (or a man-in-the-middle on an unsigned SMB session) crash a connecting client by returning a crafted FileAllInformation reply with an unchecked FileNameLength field. The bug is reached when the client library parses the server's reply inside smb2_decode_file_all_info, which is triggered by calls such as smb2_stat or smb2_fstat on the client side; publicly available exploit code exists, and a vendor fix is available upstream. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), impact is limited to client process availability - there is no code execution or data exposure, and unauthenticated remote attackers need the victim to initiate a connection to the attacker-controlled server.
Heap out-of-bounds read in Sofia-SIP through 1.13.18 allows unauthenticated remote attackers to crash SIP processes by sending INVITE requests with a multipart Content-Type whose MIME boundary exceeds the body length, causing memcmp to read past a heap buffer. Publicly available exploit code exists, and the vulnerability is remotely triggerable without authentication or user interaction, affecting network-reachable SIP endpoints such as FreeSWITCH servers. The primary impact is denial of service (availability), with no confidentiality or integrity impact.
Unauthenticated path traversal in Janus WebRTC Server through 1.4.3 allows attackers to write files outside the configured recordings path via the Record&Play plugin's record request filename when the plugin is loaded and its signaling API is reachable. Exploitation is limited: the attacker can only create or truncate files ending in -audio.mjr, -video.mjr, or -data.mjr where the Janus process has write permissions, yielding low integrity impact (CVSS 6.9). Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) has been reported.
Server-side request forgery in Portkey AI Gateway 1.14.0 through 1.15.2 lets unauthenticated remote attackers make the gateway issue requests to loopback and Docker host services and return the responses to the caller. The flaw exists because the isValidCustomHost check trusts localhost-style hostnames whenever the TRUSTED_CUSTOM_HOSTS environment variable is unset, which is the default configuration; an attacker only needs to send a /v1 request carrying a crafted x-portkey-custom-host header (for example via the ollama provider). Publicly available exploit code exists for this issue and it is not listed in CISA KEV, so exploitation activity is not confirmed; the assessed impact is limited to confidentiality and integrity of services reachable from the gateway host, with no availability or code-execution impact.
Heap out-of-bounds read and write in MuJS 1.3.6 through 1.3.8 allows attackers to corrupt process memory by supplying JavaScript that inflates a simple/dense array's length property and then invokes Array.prototype.sort, driving the internal Ap_sort_cmp and Ap_sort_swap helpers to index slots past the allocated heap buffer; the practical result is memory corruption and a process crash (CVSS 4.0 base 6.9, AV:L/AC:L/PR:N/UI:P with high availability and low integrity impact). Publicly available exploit code exists, including a published proof-of-concept write-up demonstrating the array-length trigger, but the issue is not confirmed as actively exploited (no CISA KEV listing) and exploitation requires a target application embedding MuJS to execute attacker-controlled script that a victim loads or opens. Deployments that only ever run trusted, first-party JavaScript are not exposed, and MuJS 1.3.9 and later contain the fix; this is a genuine but moderate-priority memory-corruption flaw rather than an emergency.
Memory corruption in libzvbi through 0.2.45 can occur when a victim application decodes an attacker-supplied Teletext stream containing X/28/3 DRCS packets with unvalidated pixel-mode values, driving an out-of-bounds write in convert_drcs. Exploitation requires local decoding of the malicious stream and passive user interaction (opening or processing the stream/capture), and publicly available exploit code exists; there is no confirmed active exploitation. The out-of-bounds write (CWE-787) crashes the application and may corrupt memory, making this a moderate-severity, low-urgency issue rather than a top priority.
Stored cross-site scripting in the WordPress plugin Image Photo Gallery Final Tiles Grid (all versions before 3.6.16) lets an authenticated user with contributor-level access or higher inject JavaScript via unescaped gallery lightbox configuration values, which is then printed into an inline script on every page that embeds the affected gallery. The payload is stored and inert until a victim - most critically an administrator - loads such a page, so successful abuse requires victim user interaction and yields code execution in that victim's browser, enabling session/token theft or privileged actions performed as the victim. Publicly available exploit code exists (per WPScan's disclosure), though the EPSS score is low at roughly 0.20 percent (9th percentile) and there is no confirmed active exploitation; risk is moderate and gated on sites granting contributor+ accounts to untrusted users.
Stored cross-site scripting in the Gutenverse Form WordPress plugin before 3.0.11 lets authenticated users with Contributor-level access or higher plant malicious SVG icon markup in a form block, which the plugin decodes and inserts into the page without sanitization so the script executes in the browser session of any user who views or previews the form - typically an administrator reviewing a pending post. Exploitation is conditional: it requires the vulnerable plugin with an SVG-icon form block, an attacker-controlled Contributor account (open self-registration or an otherwise obtained account), and a higher-privileged victim who renders the form, so publicly available exploit code exists but the payload stays inert until a privileged session triggers it. The vendor patch is available in 3.0.11, EPSS is very low at 0.19% (8th percentile), and there is no indication of confirmed active exploitation (no CISA KEV listing), making this a moderate, real-but-conditional risk rather than an urgent emergency.
Stored cross-site scripting in the Donation Thermometer WordPress plugin affects versions 2.2.9 up to but not including 2.3.0, allowing an authenticated user with the Contributor role or higher to inject arbitrary event handlers via an unescaped colour value passed through a shortcode attribute, which then executes in the browser of any higher-privileged user who views or previews the affected page. Publicly available exploit code exists for this flaw per the WPScan advisory, though there is no indication of confirmed active exploitation (not listed in CISA KEV); EPSS is low at roughly 0.18% (8th percentile), reflecting the authenticated and user-interaction prerequisites. Realistic exposure is limited to sites that permit untrusted users to register as Contributors or otherwise accept contributor-authored content, since anonymous visitors cannot trigger the injection.
Stored cross-site scripting in the Pricing Table WordPress plugin (versions 1.0.7 through before 2.1.5) lets an authenticated user with contributor-level access or higher save a link value using a script-bearing scheme such as javascript: inside one of the plugin's blocks; that value is rendered without scheme validation and executes in the browser of another, typically higher-privileged user who views and interacts with the affected pricing table content. Vendor-released patch: 2.1.5, and publicly available exploit code exists, though CISA's SSVC assessment records no active exploitation, the issue is not KEV-listed, and EPSS is low at 0.18% (8th percentile). Practical exposure is limited because the attacker needs a pre-provisioned low-trust account and a second user must interact with the poisoned block, which places this in the moderate tier despite its base score.
Stored cross-site scripting (XSS) in the WordPress plugin PublishPress Future before 4.10.6 allows an authenticated attacker with Contributor or higher privileges to inject JavaScript that executes when a higher-privileged user views the affected content. Publicly available exploit code exists, but no KEV entry is provided, so active exploitation is not confirmed; EPSS is low at 0.18% (8th percentile), and the independent assessment treats this as a moderate-priority issue limited to multi-author sites with untrusted contributors. The required victim interaction and need for a pre-existing low-trust account are the main limiting factors.
Stored cross-site scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (all versions before 3.6.15) allows an authenticated user with contributor-level access or above to persist JavaScript inside gallery configuration values, which the plugin echoes unsanitized into an inline script on every page that embeds the gallery. Any visitor who loads such a page - including an administrator - will execute the injected script in the context of the site, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV; SSVC exploitation: none) and EPSS is low at 0.18% (8th percentile), so this is a moderate-priority issue whose real-world risk depends on whether the site grants posting privileges to untrusted users and whether an administrator can be lured onto a gallery page.
An out-of-bounds heap read in unshield through 1.6.2 lets a crafted InstallShield cabinet file with an out-of-range file_table_offset or an abnormally large file count crash the unshield command-line tool or any application linking libunshield. Exploitation is local and requires the victim or an automated pipeline to actively open the malicious .cab file (CVSS 4.0 base 6.8; assessed 3.1 as AV:L/AC:L/PR:N/UI:R with availability-only impact). Publicly available exploit code exists, but the realistic outcome is denial of service - no code execution or data disclosure has been demonstrated - and there is no evidence of confirmed active exploitation (CISA KEV).
A NULL pointer dereference in ELFIO through 3.12 allows a crafted ELF object file to crash any application that parses it, yielding availability-only denial of service without memory corruption, code execution, or data exposure. The defect lives in relocation_section_accessor::get_entry(), which trusts the sh_link index of a SHT_REL or SHT_RELA section; when that index dangles, find_hash_section() returns null and the subsequent dereference aborts the process. Publicly available exploit code exists, and although the CVSS 4.0 vector is PR:N (no privileges required) it is AV:L with UI:P, so the practical scenario is local tooling or an ingestion pipeline that opens attacker-supplied binaries rather than a remotely reachable service; there is no evidence of confirmed active exploitation in the wild.
Privilege escalation in the Ignition Perspective module (Inductive Automation Ignition) - a genuine high-priority issue in an OT/ICS context - allows an authenticated user with legitimate access to a Vision project to supply their valid Vision session identifier and obtain Designer-level privileges, leading to arbitrary code execution in the context of the Ignition Gateway process. The flaw (CWE-863, CVSS 8.7) affects Gateways where both Vision and Perspective modules are deployed, requires low-privilege Vision credentials and a valid session, and needs network reachability but no user interaction. No public exploit identified at time of analysis.
Unauthenticated attackers can mark arbitrary WooCommerce orders as paid without any payment being made by abusing the hosted-payment return handler in the Trust Payments Gateway for WooCommerce plugin at versions before 3.1.0. Because that callback is not checked for authenticity, not bound to a specific order, and not validated against the amount paid, a single forged request to the public return endpoint is enough to flip an order to paid, and the same path can expose order and customer details. Publicly available exploit code exists (WPScan), but EPSS is low at 0.17% (5th percentile) and CISA's SSVC assessment records no exploitation, so this is a genuine but moderate-priority integrity and data-exposure issue rather than a mass-exploitation event.
Unauthenticated attackers can interfere with SSL certificate provisioning in the WP Encryption WordPress plugin versions before 7.8.8.2 by hitting a handler that performs neither a capability check nor a nonce check. A single request lets an attacker overwrite the site's certificate private key and replace the pending Let's Encrypt order and challenge material; repeated requests keep regenerating that material so the administrator can never complete issuance, resulting in a persistent denial of the certificate-provisioning workflow. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) confirms remote, unauthenticated exploitation with low integrity and availability impact and no confidentiality loss; publicly available exploit code exists according to WPScan, but there is no evidence of active exploitation and EPSS is low at 0.12% (2nd percentile). Exposure is limited to internet-reachable sites running the vulnerable plugin while an administrator is attempting Let's Encrypt issuance through it.
Unauthenticated remote attackers can forge payment gateway return requests in the Visma Pay for WooCommerce WordPress plugin before 1.2.2, marking arbitrary WooCommerce orders as paid and disclosing the customer name, email address, and postal address associated with any order. The flaw is exploitable when the store has not entered a merchant secret, because the plugin validates return requests against that empty secret; fully configured stores with a non-empty secret are not described as exploitable in the same way. Publicly available exploit code exists, and the issue is rated CVSS 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Remote unauthenticated OS command injection in TR7 ASP allows an attacker who can reach the appliance over the network to execute arbitrary operating system commands with the privileges of the vulnerable service, yielding full loss of confidentiality, integrity, and availability. Affected builds are TR7 ASP from 1.0.40.236 before 1.0.1554.2331 and from 1.6.42.239 before 1.6.1554.2331, covering both virtual-appliance and physical-appliance deployments. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) per the assessed vector, meaning no authentication, no user interaction, and low attack complexity; no public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV). The primary limiting factors are version and network exposure: only the specified build ranges are affected and the appliance must be reachable by the attacker.
Unauthenticated OS command injection in TR7 Cyber Defense Inc.'s TR7 ASP appliance (both virtual and physical deployments) allows any attacker who can reach the appliance's exposed service to execute operating-system commands without supplying credentials or user interaction. The flaw is rooted in a missing authentication check for a critical function (CWE-306) and carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning full loss of confidentiality, integrity, and availability of the appliance if exploited. All TR7 ASP installations running 1.0.40.236 up to (but not including) 1.0.1554.2331, or 1.6.42.239 up to (but not including) 1.6.1554.2331, are affected; exposure is the primary gating factor, since appliances segmented onto trusted management VLANs are far harder to reach. No public exploit code and no CISA KEV entry have been identified at time of analysis, and no EPSS score was provided with the source data.
Unauthenticated SQL injection in the e107 CMS alt_auth plugin allows a remote attacker to execute arbitrary SQL through a crafted login username whenever the plugin's otherdb or e107db authentication backend is configured against a live external database, affecting all e107 releases prior to 2.3.7. No authentication or user interaction is required once that configuration exists; the assessed impact is high on confidentiality and integrity, bounded by the privileges of the configured external database account, and failed queries can leak the generated SQL through the debug-message path to assist blind injection. No public exploit identified at time of analysis, and default e107 installations - which do not ship alt_auth enabled and do not point a backend at an external DB - are not exposed.
Unauthenticated OS command injection in Juniper Networks Junos OS Evolved's bootzd zero-touch provisioning (ZTP) daemon allows adjacent attackers on the management LAN to execute arbitrary commands as root via a crafted DHCP response. The vulnerability has a CVSS 4.0 base score of 9.3 and requires the target device to be actively in ZTP mode; no public exploit code is identified at time of analysis.
OS command injection in the Samsung QA-Board backend allows unauthenticated remote attackers to execute arbitrary operating-system commands on the host running the service, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity and availability impact. The flaw, classified as CWE-78, affects all versions matched by the wildcard CPE cpe:2.3:a:samsung_open_source:qa-board:*:*:*:*:*:*:*:*, so no release line is known to be exempt. No public exploit code has been identified at time of analysis and the issue is not listed on CISA KEV, but the trivial remote/unauthenticated attack profile makes rapid patching the priority.
Authenticated low-privileged users of Hestia Control Panel 1.9.7 through 1.10.4 who own at least one web domain can escalate to root by injecting a single quote into a custom document-root value, which update_object_value() fails to escape before writing it to the user's web.conf file. The forged PATH field is later loaded by the root-privileged v-search-user-object script via parse_object_kv_list_non_eval() - which allows reserved shell-variable names and replaces PATH globally - and the subsequent invocation of 'column' without an absolute path executes an attacker-supplied binary placed in the injected search path, yielding arbitrary code execution as root with a scope change (S:C) and full confidentiality, integrity and availability impact. The flaw is fixed in Hestia Control Panel 1.10.5; no public exploit code was identified at time of analysis, and the realistic threat model is multi-tenant/shared hosting or a malicious insider rather than an anonymous attacker, since a provisioned panel account with web-domain capability is mandatory.
A privilege escalation in KEDA 2.20.2 and earlier lets a namespace administrator who can create TriggerAuthentication and ScaledObject resources point hashiCorpVault.address at an endpoint they control and select Kubernetes authentication without supplying a credential; KEDA then logs in to that endpoint using the operator pod's projected ServiceAccount token, handing the attacker the operator's cluster-wide permissions including broad Secret reads and workload or admission-related operations. The prior CVE-2025-68476 JWT-shape filter does not block this path because the operator token's subject is a Kubernetes ServiceAccount, so it passes the filter. Exploitation is authenticated (CVSS PR:L) and gated by tenant-level RBAC to create those CRDs, but it is most dangerous in multi-tenant clusters where namespace admins are untrusted relative to the cluster-scoped operator; there is no public exploit code identified at time of analysis, and the issue is fixed in 2.21.0 via audience enforcement plus an outbound Vault-address allowlist.
Unauthenticated remote code execution affects the AGE-GATE (wp-site-age-gate) plugin for WordPress in all versions up to and including 1.0. Because the plugin ships a standalone admin.php endpoint that never bootstraps WordPress and carries no ABSPATH guard, the capability and nonce arguments registered through the plugin's simulated menu API are purely decorative, and POST parameters such as width and height are written unsanitized into generated PHP source that is subsequently included - letting any remote attacker who can reach admin.php execute arbitrary code on the server. The vendor CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code has been identified at time of analysis; exploitation requires only that the vulnerable plugin be installed and active and that admin.php be directly reachable over HTTP.
Unauthenticated remote code execution in the Snazzy Social Media Feed WordPress plugin (versions up to and including 2.5) allows any network attacker to write and execute arbitrary PHP code via a single GET request to the standalone functions/save-to-cache.php script, which lacks WordPress bootstrap, authentication, capability, and nonce checks and insufficiently sanitizes the pluginURL parameter (FILTER_SANITIZE_URL preserves characters needed for a PHP payload) before writing it verbatim into cached-content/cached-feed.php. CVSS 3.1 base score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial unauthenticated exploitation, and no public exploit has been identified at time of analysis (CISA KEV status not indicated). The vulnerability description's mention of subscriber-level access is contradicted by the CVSS vector and independent assessment, which confirm no authentication is required.
Unauthenticated arbitrary file upload in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, versions up to and including 2.9.1, allows a remote attacker to write a .php file into the web-served wp-content/uploads/nbdesigner/temp/ directory and thereby execute arbitrary code on the server, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the nbdesigner_copy_image_from_url AJAX action, which is exposed to logged-out callers via wp_ajax_nopriv_; its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list used on the other branch, and the required save-design nonce is freely issued to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Exploitation is not conditional on credentials, but does require the attacker to supply a Google Drive file they control plus a valid OAuth token, and it succeeds only where the uploads directory executes PHP - typical on default Apache/mod_php stacks but blocked under hardened upload configurations; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated arbitrary file upload in the JTL-Connector for WooCommerce WordPress plugin (all versions up to and including 2.4.3) lets remote attackers upload executable files and achieve remote code execution with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation is trivial against default configurations: startSession() accepts an empty jtlauth parameter as a valid credential, so no authentication, no user interaction, and no non-default setting is required - only that the plugin is installed and active and the connector endpoint is network-reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, unauthenticated vector, and default-configuration exploitability make this a genuine high-priority vulnerability rather than a high-score/low-risk case.
Unauthenticated SQL injection in Channel Software WebAlliance eCommerce lets remote attackers read and write arbitrary data in the backend Microsoft SQL Server - and potentially execute operating-system commands - by sending a crafted sUserID value containing a single quote and a stacked SQL query to the SOAP GetUser method on /preapproval.asmx. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) confirms that no authentication, user interaction, or special configuration is required, so any internet- or network-reachable deployment of this niche eCommerce platform is exposed; the practical limit on full command execution is whether the MSSQL backend has features such as xp_cmdshell enabled and what privileges the database service account holds. At time of analysis there is no public exploit identified, no CISA KEV listing, and no EPSS score reported, but the combination of an unauthenticated network-facing injection point with full confidentiality and integrity impact justifies treating this as a high-priority exposure to enumerate and mitigate.
OS command injection in the Video-stitch Node.js library (ArsalanDotMe) before 2.0.0-beta.1 allows unauthenticated remote attackers to run arbitrary shell commands with the privileges of the Node.js process by supplying file names containing shell metacharacters to the concat(), cut(), or merge() functions. The vulnerable code interpolated those values unquoted into shell-executed ffmpeg command lines (shelljs.exec) in lib/videoconcat.js and lib/videocut.js, so exposure is realized whenever an embedding application routes untrusted data into the output/clip name or fileName parameters; applications that only pass trusted, internally generated file names are not exploitable. CVSS 4.0 rates this 9.3 (Critical) with PR:N and UI:N, and no public exploit code or confirmed active exploitation was identified at time of analysis; a fix is available in version 2.0.0-beta.1.