Cross-company record deletion in InvoiceShelf 2.3.3 and earlier allows an authenticated user with membership in any one company to destroy data belonging to other tenants on the same instance. The bulk-delete validators (DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest and DeleteUserRequest) verify that submitted identifiers exist but do not consistently bind them to the caller's company_id, so an attacker who supplies a foreign numeric ID can delete customers, estimates, expenses, invoices, items, payments or user accounts outside their own tenant. Exploitation requires a valid account (PR:L) and a multi-tenant deployment; single-company self-hosted installs have no cross-tenant data to target. No public exploit code or active exploitation was identified at time of analysis, and the vendor released a fix in 2.4.0.
Stored cross-site scripting in the Mang Board WordPress plugin affects every version up to and including 2.4.3, allowing unauthenticated remote attackers to inject arbitrary web scripts through the 'user_name' parameter that execute in the browser of any visitor who later loads a page rendering the stored value. The payload slips past the plugin's mbw_htmlspecialchars2() save-time sanitizer because it relies only on unquoted HTML attribute syntax built from spaces, alphanumerics, and characters such as =, parentheses, and dots, none of which that routine escapes. Impact is confined to client-side script execution in the context of the vulnerable site (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2), and no public exploit identified at time of analysis.
Path-restriction bypass in BusyBox httpd's reverse proxy feature allows unauthenticated remote attackers to reach backend paths outside the configured forwarding prefix. When URL-prefix proxying is configured, only the first request on a TCP connection has its path rewritten; a pipelined second request is relayed verbatim, defeating the intended prefix restriction and exposing arbitrary backend routes. Affects BusyBox httpd deployments, including Red Hat Hardened Images, that enable the non-default reverse proxy directive; no public exploit identified at time of analysis. CVSS 3.1 base score 7.2 (High) reflects network reachability, low complexity, no privileges or user interaction, and changed scope impacting the proxied backend.
Stored cross-site scripting in the 'Record of Consent Extension for Complianz' WordPress plugin (all versions up to and including 2.5) lets unauthenticated attackers persist arbitrary JavaScript into stored consent records via the 'uid' parameter, which then executes in the browser of any user - including an administrator reviewing the consent records admin tab - who later loads the tainted page. The write path is anonymously reachable because the enforcing nonce is emitted through wp_localize_script on wp_enqueue_scripts, making it readable by any frontend visitor, and no capability or role check gates the write path. It carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the NewStatPress WordPress plugin (versions up to and including 1.4.5) lets unauthenticated attackers plant script payloads through the visitor-supplied query string that the plugin automatically logs into its statistics table. The payload is rendered unescaped inside a single-quoted href attribute in the 'Last referrers' meta box on the plugin's Overview admin page, so it executes only when a high-privileged user - typically an administrator - opens that page and hovers the injected link. No public exploit code was identified at time of analysis and there is no CISA KEV listing, so this is assessed as a moderate-priority issue given the mandatory admin interaction and the reliance on an administrator eventually reviewing referrer statistics.
Stored cross-site scripting in the NewStatPress WordPress plugin (all versions through 1.4.5) allows unauthenticated attackers to plant arbitrary JavaScript that later executes in the browsers of visitors viewing a page that renders the plugin's 'Top Pages' output. The injected payload arrives through the QUERY_STRING/REQUEST_URI value of a crafted request, which the plugin records and later reflects without sanitization or output escaping. Exploitation is gated rather than trivial: an administrator must have published the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and the attacker's crafted URL must accumulate enough hits to enter the plugin's top-N ranking before anything is displayed - a condition reflected in the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N), which lowers complexity confidence from the reported 7.2 HIGH to account for those prerequisites. No public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin (all versions up to and including 7.5.54.7212) allows unauthenticated attackers to inject arbitrary JavaScript through the 'synopsis' shortcode attribute, which then executes in the browser of any visitor who opens the affected page. The plugin fails to sanitize the attribute on input and fails to escape it on output; the injection only reaches a vulnerable code path when the plugin's 'Parse Vimeo and YouTube links' (parse_comments) option is enabled and a shortcode uses liststyle="season". Because of that dual, non-default configuration prerequisite, an independent re-assessment rates the attack complexity as High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) rather than the vendor-facing AC:L, though the unauthenticated, no-user-interaction injection vector is unchanged. No public exploit code and no CISA KEV entry were identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Contact Form DB for Enfold (all versions up to and including 2.0.2) lets unauthenticated attackers inject arbitrary JavaScript through public-facing Enfold contact form submissions, which is then rendered unescaped when an administrator opens the plugin's form-entries page at admin/ecf_index.php. The CVSS 3.1 base score is 7.2 (High), driven by AV:N/AC:L/PR:N/UI:N with a scope change and Low confidentiality and integrity impact; the practical prerequisite is that a logged-in privileged user must subsequently view the stored submissions, so exploitation is stored rather than immediate. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV).
Stored cross-site scripting in the Document Gallery plugin for WordPress (all versions up to and including 5.1.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into the plugin's thumber webhook action request body, which is later rendered unsanitized in the plugin's administrative logging view and executes in the browser of any user who opens the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) makes this look like a high-priority unauthenticated XSS, but exploitation has a real prerequisite: logging must be enabled in the plugin's Advanced settings, which is only the default when WP_DEBUG is true, so an administrator on a normal production site must have manually turned logging on - default installations are not affected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch version is confirmed in the available data.
Stored cross-site scripting in the AnyComment WordPress plugin (all versions up to and including 0.3.6) allows unauthenticated attackers to submit a crafted 'email' value to the public /wp-json/anycomment/v1/subscribe REST endpoint, which is then stored and later rendered unescaped into an HTML table cell on the AnyComment Subscriptions admin screen. The payload fires only when an administrator subsequently opens AnyComment → Subscriptions, so the affected audience is limited to authenticated dashboard users rather than the public comment stream; scoped impact per the assessed vector is limited confidentiality and integrity (C:L/I:L) with a scope change (S:C). No public exploit code was identified at time of analysis, and exploitation requires the specific precondition that the stored subscription's user_ID does not resolve to an existing WP_User, which is the code path that bypasses escaping.
An authorization bypass in n8n versions before 1.123.83 allows an authenticated user with editor (write) access to a shared workflow to execute restricted credentials that belong to another user, by embedding those credentials inside nested or tool inline sub-workflow definitions. When the workflow runs, the sub-workflows execute using the credential owner's secret values rather than being rejected against the attacker's own credential scope. This is a conditional privilege/authorization issue rather than a drive-by remote threat: it requires a multi-user instance with shared workflows and scoped credential sharing, an editor-level account, and the presence of at least one restricted credential owned by someone else - single-user instances and deployments without shared workflows are not affected. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation; the issue is reported as an Authentication Bypass and is fixed in n8n 1.123.83.
SQL injection in the Koha integrated library system's Most-circulated items report (reports/cat_issues_top.pl) allows an authenticated staff account holding the reports module permission - explicitly not requiring superlibrarian - to inject arbitrary SQL through the Criteria, Filter, and Limit request parameters and read any table reachable by the Koha database user, including borrower userids, bcrypt password hashes, two-factor secrets, api_keys, and sessions. The flaw is rated CVSS 7.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L) and our independent assessment concurs it is a genuine, well-characterized CWE-89 injection that merits prompt patching but is not a drop-everything emergency, principally because the PR:L staff-authentication-plus-reports-permission gate blocks any unauthenticated path. No public exploit code has been identified at time of analysis: this CVE is not in CISA KEV and there is no confirmed active exploitation. Patched releases are available in Koha 24.11.19, 25.05.14, 25.11.08, and 26.05.03.
A denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by an adjacent, unauthenticated attacker who sends crafted IS-IS traffic to a device where both IS-IS link protection and backup-selection are configured, causing an out-of-bounds write in the routing protocol daemon (rpd) that crashes or destabilizes the device. Only routers running these non-default IS-IS feature combinations are exposed, and the attacker must already hold a Layer 2 segment or IS-IS adjacency position (adjacent network, AV:A) rather than reaching the device over the internet. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed Junos OS and Junos OS Evolved builds.
Stored cross-site scripting in n8n allows an authenticated member-level user to execute arbitrary script in the n8n origin of any higher-privileged user - typically the instance owner - who opens the attacker's crafted upload in the file-preview modal. The modal re-publishes uploaded binary data as an unsandboxed, same-origin blob URL, so the injected payload runs with the victim's session context, enabling theft of session material or privileged actions within the workspace. Exploitation requires a valid member account with upload rights (PR:L) and the victim to actively open the file (UI:A); no public exploit code has been identified at time of analysis, and the flaw is patched in n8n 1.123.83, 2.41.4, and 2.42.1.
Credential exfiltration in n8n versions before 2.41.4 and 2.42.0 before 2.42.1 allows an authenticated editor on a multi-user instance to abuse a shared workflow's 'Message an Agent' node in inline mode, causing the owner's stored credentials to be resolved and sent to an attacker-chosen destination. The flaw is an access-gated authorization bypass (CWE-863) requiring editor rights and a shared workflow that references higher-trust credentials; single-operator self-hosted deployments have limited practical exposure. No public exploit was identified at time of analysis.
Missing authorization checks in VentureDrake Laravel CRM before 2.4.0 allow any authenticated user holding a low-privilege Spatie role - including read-only accounts - to modify deals, quotes, orders and invoices by invoking Livewire action methods such as delete, won, lost or reopen on components like DealIndex, or by reaching the unguarded Activities and Products routes. The flaw is rated CVSS 4.0 7.1 (High) and requires only a valid non-privileged login (PR:L), with no user interaction and no administrative rights; the integrity impact is high while confidentiality and availability are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available in version 2.4.0.
PHP object injection in the Polylang WordPress translation plugin through version 3.8.9 lets an authenticated high-privileged user (CVSS PR:H, typically a WordPress administrator) feed untrusted serialized data into a PHP unserialize() call, which can corrupt application state and, if a usable POP gadget chain exists in WordPress core, Polylang, or another installed component, escalate to code execution or file manipulation. There is no public exploit code identified at time of analysis and no indication of active exploitation (not CISA KEV), so practical risk is currently gated by the administrator-equivalent access requirement rather than by exploitability of the deserialization primitive alone.
Authenticated SQL injection in the Yiuman Citrus Java framework (versions through 0.15.0) allows any user with a valid low-privilege account to inject arbitrary SQL into the ORDER BY clause by tampering with the sortBy request parameter. The flaw lives in the citrus-support generic query helper and is reachable through any generic list route on controllers extending BaseQueryController or BaseQueryRestful, which means every application built on the framework that exposes such a route inherits the exposure. Impact is read-only database disclosure achieved through boolean- or time-based blind inference rather than direct record retrieval, and exploitation requires both valid credentials and a deployed, reachable generic query endpoint; no public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so this should be treated as a moderate-severity, externally exploitable information-disclosure risk rather than an active campaign.
Authenticated SQL injection in Dromara Skyeye (all builds through commit 65d3ddcede70) lets any low-privileged user read arbitrary data from the backend database, including records belonging to other tenants, by sending crafted 'keyword' values to the queryWarehousingDetails and queryOutgoingDetails ERP statistics endpoints. The flaw is reachable over the network with only a valid low-privilege account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor score 7.1 under CVSS 4.0), needs no user interaction, and impacts confidentiality only - there is no evidence of data modification or code execution. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; a detailed public technical writeup exists, and the issue is a genuine but moderate-priority finding whose main limiting factor is the authentication requirement.
Path traversal in F´ (F Prime) prior to 4.3.0 lets an authenticated peer on the file-uplink channel write or overwrite files at attacker-chosen writable filesystem locations by supplying a crafted destination path in a Fw::FilePacket::StartPacket. The flaw yields high integrity impact and limited availability impact (overwriting or damaging critical files), with no confidentiality impact, and CVSS reflects PR:L because the attacker must already be able to send file-uplink packets to Svc::FileUplink. The issue requires no non-default feature toggle once uplink access is obtained, and no public exploit code has been identified at time of analysis; vendor-released patch: 4.3.0.
Missing authorization in jshERP through 3.6 lets any authenticated low-privilege user hit POST /user/batchSetStatus and mass-change account status for other users in the same tenant, disabling every non-owner account - including administrator accounts - or re-enabling previously disabled ones. Exploitation requires only a valid low-privilege account and network reachability to the endpoint (CVSS PR:L, no user interaction), which confines realistic risk to insiders or anyone who can obtain low-privilege credentials. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 4.0 score of 7.1 (HIGH) and the independent 3.1 assessment (7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) are driven almost entirely by availability impact, with confidentiality untouched and integrity only partially affected.
youlai-mall through commit 9f62de8 fails to enforce member-level ownership on its app order-list endpoint, allowing any authenticated member to enumerate and read every customer's order records-including order IDs, order serial numbers, member IDs, payment amounts, and order statuses. The flaw is a missing authorization check (CWE-639) exploitable with a self-registered low-privilege account; no public exploit code or active exploitation is confirmed at time of analysis. The independent assessment rates this as a high-confidentiality, read-only disclosure with no integrity or availability impact, and exploitation requires the affected instance to expose the app order endpoint to authenticated users.
Denial of service in Juniper Networks Junos OS arises from improper handling of highly compressed data (CWE-409) in the gRPC library used by the na-grpcd daemon, letting an attacker who can reach that interface crash or exhaust it with a crafted compressed gRPC request. Exploitation requires network reachability to na-grpcd plus valid low-level credentials (CVSS 4.0 scores this 7.1; independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is not reachable by fully unauthenticated attackers under default posture. Affected are Junos OS trains below the vendor's fixed maintenance releases (for example 23.2R2-S7.7, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2); no public exploit identified at time of analysis, and impact is confined to availability of the targeted service with no confidentiality or integrity loss.
Authenticated SQL injection in InvoiceShelf before 2.4.0 allows any logged-in user to inject arbitrary SQL expressions into the ORDER BY clause of invoice and other list endpoints, enabling boolean-based blind extraction of database contents. The flaw stems from the orderByField query parameter being passed unfiltered into Laravel Eloquent orderBy() calls across multiple model scopes, including Invoice::scopeApplyFilters; an attacker with a valid low-privilege account - potentially an untrusted outsider on deployments that permit self-registration or multi-tenancy - can therefore read data beyond their authorization. Exploitation is confirmed to require authentication, is limited to confidentiality impact (no writes or denial of service), and proceeds slowly through blind inference. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the vendor has released a fix in version 2.4.0.
Malformed 802.1Q Ethernet frames can panic or corrupt the network receive path in Zephyr RTOS builds that have CONFIG_NET_VLAN=y and a VLAN enabled on the receiving Ethernet interface. ethernet_recv() checks only that the first buffer holds a 14-byte plain Ethernet header, then reinterprets that same buffer as an 18-byte VLAN header when the ethertype is 0x8100, reading the TCI and inner ethertype from offsets 14-17 beyond the buffer's length and raising hdr_len to 18 so net_buf_pull() removes more bytes than exist. A single unauthenticated 14-17 byte broadcast frame with ethertype 0x8100 and TCI 0x0000 suffices, reachable by an adjacent/link-local attacker or a malicious USB host through the CDC ECM/NCM gadget classes; assertion-enabled builds panic (denial of service), while production builds with assertions and CONFIG_NET_BUF_HARDENING disabled suffer a uint16_t length underflow to 65534 that leaves later parsers reading far outside the fragment, giving out-of-bounds access with information-disclosure and corruption potential. No public exploit identified at time of analysis; exploitation is gated by the non-default VLAN configuration and hardware VLAN tag stripping absent.
Malformed firewall-authentication synchronization traffic delivered over a chassis-cluster fabric link can trip a reachable assertion in the srxpfe process on Juniper Networks SRX Series devices running Junos OS, aborting the packet forwarding engine and causing a denial of service of the data plane for traffic traversing the cluster. Exposure is limited to SRX platforms deployed in chassis-cluster high-availability configurations where firewall-authentication synchronization is in use; standalone SRX devices and clusters that do not use that synchronization mechanism are unaffected, and the attacker must already have a position on the normally dedicated point-to-point fabric interconnect (logically adjacent, with no authentication or user interaction required per the assessed vectors). At the time of analysis no public exploit code and no confirmed active exploitation were identified; the CVSS 4.0 base score is 7.1 with availability-only impact (VC:N/VI:N/VA:H), and the vendor advisory is Juniper JSA112186.
Authenticated RDP clients can force unbounded server-side memory allocation in FreeRDP 2.0.0 through 3.31.x by sending a seven-byte DATA_FIRST message on an already-opened dynamic virtual channel (DVC) that declares a large 32-bit length, driving zeroed resident-memory growth until the server's resources are exhausted and service is denied. The flaw is availability-only (CWE-400 resource exhaustion; CVSS 4.0 base 7.1, assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) with no code execution or data disclosure impact, and every action requires a valid authenticated session plus a successfully opened DVC - so real exposure depends on who can authenticate to the RDP service, and it is not remotely exploitable without credentials. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Memory exhaustion in the l2ald (Layer 2 address learning) daemon of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a denial of service against the device by sending crafted packets, but only when the non-default static MAC-IP EVPN feature is configured. The flaw is tracked as CWE-401 (Missing Release of Memory after Effective Lifetime), meaning the daemon fails to free memory it has allocated, so repeated crafted traffic can drain resources and disrupt the l2ald process; per the assessed vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) impact is availability-only and the attacker must sit on the same Layer-2 segment as the target. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is limited because the static MAC-IP feature is not enabled by default and routed/remote attackers cannot reach the vulnerable path.
Authenticated buyers on BizSpring Shop and BizSpring Java Mall (BizSpring Shop through commit cf22d39daaf1; Java Mall through commit 369e88c5) can mark orders as paid without any real payment by first generating a payment log via /member/payment/load and then invoking the test/debug handler /member/payment/test_post_pay_{paymentLogSn} (PaymentController.testPostPay). The handler performs no authenticity verification of the payment (CWE-345), so an attacker can obtain goods for free, and by supplying another member's paymentLogSn can also settle other users' orders through an IDOR variant. The flaw is rated CVSS 4.0 base 7.1 (AV:N/AC:L/PR:L/UI:N, high integrity impact) and CVSS 3.1 7.1; it is not listed as confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis, although the underlying technique is documented in public HackMD writeups.
Cross-tenant IDOR in InvoiceShelf before 2.4.0 lets an authenticated user with the create-invoice ability convert an estimate belonging to a different company by calling POST /api/v1/estimates/{estimate}/convert-to-invoice. Because route-model binding resolves the estimate without a company check, the attacker can copy another tenant's line items, prices, taxes, totals, notes, currency and customer data into an invoice in their own company, and the victim's configured conversion action may also modify or delete the source estimate - an exposed-data and integrity impact scored CVSS 7.1 with PR:L, requiring an authenticated account. Exploitation is only meaningful on multi-company (multi-tenant) deployments and no public exploit code has been identified at time of analysis; the vendor-released fix is version 2.4.0.
Crashing the Junos OS routing protocol daemon (rpd) on MX Series routers is possible for unauthenticated attackers on an adjacent network who can deliver a crafted eBGP route update, but only when hierarchical fast reroute (HFRR) link protection is configured inside a VRF or routing instance. Impact is confined to availability - rpd hits a reachable assertion and aborts, producing a routing-level denial of service - with no confidentiality or integrity exposure, and the adjacent-network vector plus the non-default HFRR-in-VRF prerequisite and MX-only scope bound the overall risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available from Juniper.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a network-adjacent, unauthenticated attacker to crash the rpd routing daemon by sending a crafted RSVP Path message, disrupting routing on the affected device (CVSS 7.1; assessed CVSS:3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, availability-only impact). Exploitation is bounded: the target must have RSVP signaling enabled (typically for MPLS traffic engineering / LSP setup) and the attacker must be reachable at Layer 2 or act as a directly-connected routing neighbor able to inject RSVP control traffic, so arbitrary internet-based attackers are excluded. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the low attack complexity and the unauthenticated nature of the vector make the flaw attractive to anyone already inside the adjacency or peering domain.
Denial of service in the Juniper Junos OS rpd routing process is possible when the non-default Auto-RP mapping feature is enabled, allowing an unauthenticated attacker on an adjacent network segment to send crafted Auto-RP mapping announcements that trigger an out-of-bounds write (CWE-787) and crash the routing plane. Juniper rates this CVSS 4.0 7.1, and our independent assessment concurs it is a moderate-priority availability issue rather than a critical emergency; no public exploit code or CISA KEV entry was identified at time of analysis. The attacker must be within the PIM multicast domain and cannot reach the device from the general internet.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved results from a reachable assertion (CWE-617) in the rpd routing process that can be triggered by adjacent unauthenticated attackers sending LDP control traffic. Devices with Label Distribution Protocol (LDP) configured and active are exposed; the attacker must be on the same Layer 2 segment or directly connected link, but no authentication or user interaction is required. No public exploit code has been identified, and CISA KEV does not list this vulnerability as actively exploited.
An integer underflow in the srxpfe forwarding-plane daemon of Junos OS and Junos OS Evolved on SRX Series firewalls allows an unauthenticated attacker on an adjacent network segment to trigger a denial of service by sending an ICMP message tied to an SVR (Secure Vector Routing) carrier session. Affected deployments are those running SVR/carrier-session functionality on SRX platforms, where successful exploitation degrades or halts packet forwarding; the CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss (assessed CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). There is no public exploit code and no confirmed active exploitation (no CISA KEV listing) at time of analysis, but the attack requires only Layer 2 adjacency and no credentials or user interaction, so any SRX device with SVR sessions reachable from an untrusted adjacent segment should be treated as exposed.
Malformed ICCP messages sent to the l2ald daemon in Juniper Networks Junos OS and Junos OS Evolved can disclose process heap memory or crash the daemon, producing a denial-of-service condition. Only devices configured for MC-LAG with ICCP between chassis are exposed, and the attacker must already control or impersonate a configured ICCP peer, i.e. occupy or spoof a trusted position on the inter-chassis control link (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, 7.1). Exploitation is not possible against a default configuration or from the general internet, and no public exploit identified at time of analysis.
Denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to disrupt or crash RSVP processing by sending a malformed RSVP packet to an interface where RSVP is explicitly enabled. Exploitation is conditional: RSVP is not enabled by default and is only present in MPLS traffic-engineering/signaling deployments, and the attacker must have Layer-2 or directly-reachable adjacency to the affected interface (CVSS AV:A, PR:N, UI:N), so routers without RSVP configured are not exposed. Impact is availability-only with no confidentiality or integrity exposure; vendor CVSS is 7.1, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved stems from an integer overflow/wraparound in the routing protocol daemon (rpd) OSPFv2 handling, allowing an unauthenticated adjacent attacker to disrupt or crash rpd by sending specifically crafted OSPFv2 packets onto an OSPF-enabled interface. Only devices with OSPFv2 configured and reachable at Layer 2 on the attacker's segment are exposed, which is the primary limiting factor; devices without OSPFv2 running are not affected. Scoring is CVSS 4.0 7.1 and CVSS 3.1 7.1 (AV:A/AC:L/PR:N/UI:N, availability-only impact), no public exploit code has been identified at time of analysis, and vendor patches are available for the affected release trains.
A crafted MVRP Ethernet frame sent to an MVRP-enabled interface can crash or disrupt the l2cpd Layer 2 control-protocol daemon in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service for associated Layer 2 control protocols. Only devices with MVRP (Multiple VLAN Registration Protocol) explicitly enabled on at least one interface, and reachable from the same Layer 2 broadcast domain, are exposed - MVRP is not enabled by default, so the vast majority of deployments are not at risk. No authentication or user interaction is required, but the attacker must have Layer 2 adjacency; the frame cannot be delivered across a Layer 3 boundary or over the internet. Scoring is AV:A with high availability impact only (C:N/I:N per the independent CVSS 3.1 assessment); there is no public exploit identified at time of analysis.
An out-of-bounds write (CWE-787) in the lacpd daemon of Juniper Networks Junos OS Evolved allows a Layer-2-adjacent attacker to crash the device - a denial of service - by sending a crafted frame to an aggregated-Ethernet member port that has LACP enabled. The attacker needs no authentication or user interaction (PR:N/UI:N) and must be positioned on the same local broadcast domain or directly attached to the member port (AV:A), so this is not an internet-reachable flaw; impact is availability-only (VC:N/VI:N/VA:H, with low subsequent-system availability impact SA:L in the CVSS 4.0 vector, assessed as CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The independent assessment rates this as a genuine but bounded operational risk rather than an emergency: exposure depends entirely on LACP being configured on an AE member port, and no public exploit has been identified at time of analysis (the CVE is not listed in CISA KEV, and no POC is referenced in the available intelligence).
An adjacent attacker positioned on the MPLS-TE signaling plane can crash the rpd routing process on Juniper Networks Junos OS and Junos OS Evolved by way of a numeric truncation error (CWE-197) triggered during MPLS-TE fast-reroute signaling, producing a denial of service against the affected router's control plane. Juniper scores this 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L); our independent assessment maps it to CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, i.e. a high-availability-only impact. Exploitation requires MPLS-TE with fast-reroute (FRR) signaling configured and an attacker able to source or influence that signaling from an adjacent network position - no authentication or user interaction is needed, but default configurations without MPLS-TE FRR are not exposed. No public exploit code and no confirmed active exploitation have been identified at time of analysis, and the adjacency plus feature-configuration prerequisites confine realistic exposure largely to service-provider and large-enterprise MPLS cores.
Adjacent, unauthenticated attackers can crash the routing process (rpd) in Juniper Networks Junos OS and Junos OS Evolved by sending crafted RSVP-TE associated-bidirectional LSP signaling messages, resulting in a denial-of-service condition. This reachable assertion (CWE-617) requires the target device to be configured for RSVP-TE with associated-bidirectional LSP signaling and the attacker to be network-adjacent, meaning they must have an RSVP-TE signaling relationship or adjacency to the device. No public exploit identified at time of analysis, and the impact is limited to availability with automatic recovery, not code execution or data exposure.
Malformed RSVP signaling can trip a reachable assertion inside the rpd routing daemon on Juniper Networks Junos OS and Junos OS Evolved, terminating the daemon and causing a denial of service on the affected device. The flaw is exploitable without authentication or user interaction by an attacker positioned on an adjacent network segment (CVSS 4.0 base 7.1; AV:A/PR:N/UI:N with high availability impact), but only when RSVP signaling is actually enabled - typically MPLS traffic-engineering deployments - so devices without RSVP configured are not exposed. At time of analysis there is no public exploit identified and no CISA KEV listing; the practical risk is a bounded availability issue against the control plane rather than a confidentiality or integrity compromise, with JSA112187 as the sole authoritative vendor source.
A malformed RSVP Path message sent over an EVPL LMP control channel can dereference a NULL pointer in the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd), crashing the process and causing a denial of service. Network-adjacent attackers with Layer 2 reachability to the control channel can trigger the crash without authentication or user interaction, though only devices explicitly configured for EVPL service with an LMP control channel are exposed - a non-default configuration. No public exploit has been identified at time of analysis, and the independent assessment characterizes this as a moderate-severity, targeted availability issue rather than a top-tier emergency.
Adjacent unauthenticated attackers can cause a denial of service in Juniper Junos OS and Junos OS Evolved by sending a crafted ICCP peer message to the l2ald process, provided MC-LAG IRB MAC synchronization is enabled. The reachable assertion (CWE-617) crashes the l2ald daemon, affecting availability; this is a conditional DoS requiring a non-default MC-LAG configuration and adjacency to the inter-chassis control link. No public exploit identified at time of analysis; EPSS data not provided.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by a malformed MC-LAG message sent to the l2ald daemon, causing a reachable assertion failure and daemon crash. Only devices explicitly configured for MC-LAG with ICCP peering enabled are affected, and the attacker must hold the network position of a configured ICCP peer (adjacent Layer 2 access). No public exploit code or active exploitation has been identified; the issue is availability-only with no confidentiality or integrity impact.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered by an adjacent attacker sending a crafted ICCP MC-LAG message to l2ald, causing the daemon to mishandle a specified quantity field. The flaw only affects devices configured for MC-LAG with ICCP active and the attacker must be on the Layer-2 adjacency or ICCP peering path; no authentication or user interaction is required once that adjacency is achieved, and impact is availability-only (no data exposure or code execution). No public exploit identified at time of analysis, and the independent assessment rates this as a genuine but situational priority rather than a top-tier emergency because the non-default MC-LAG/ICCP prerequisite and adjacency constraint sharply reduce the realistic attacker population.
A NULL pointer dereference in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker on an adjacent network to terminate the daemon and disrupt routing protocol sessions by sending a crafted RSVP packet when MPLS-TE RSVP processing is enabled; the flaw carries a CVSS v4.0 base score of 7.1 (CVSS:3.1 equivalent AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects availability only, with no confidentiality or integrity impact. Exposure is bounded by two prerequisites - the device must actually be configured for RSVP-TE/MPLS-TE signaling, and the attacker must sit on the same L2 segment, directly connected link, or adjacent routing/peering domain rather than being reachable from the open internet. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (not listed in CISA KEV); EPSS data was not provided in the available intelligence.
Malformed RIPv2 messages delivered to the routing protocol daemon (rpd) can crash or otherwise disrupt routing on Juniper Networks Junos OS and Junos Evolved, producing a denial-of-service condition. Exploitation requires the attacker to be network-adjacent (same link or broadcast domain) and requires that RIPv2 be actively configured and enabled on the target; no authentication or user interaction is needed, and the impact is availability-only, with no confidentiality or integrity effect. The issue is rated CVSS 7.1 (CVSS 4.0 basis) and CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, making this a moderate-risk availability issue rather than a top-tier emergency.
A NULL pointer dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker positioned on an adjacent Layer 2 segment or as a multicast/routing peer to crash the routing protocol process by sending a malformed PIM Bidirectional (Bidir) message, producing a denial-of-service condition (CVSS 7.1). Exposure is gated by configuration: the target device must be running PIM Bidir, a non-default multicast feature, which means only networks actively deploying bidirectional PIM are at risk, and the attacker must be able to deliver a PIM packet directly to rpd rather than across arbitrary routed networks. Impact is confined to availability of the routing control plane - no code execution, data disclosure, or configuration integrity impact - and there is no public exploit identified at time of analysis.