Prototype pollution in Progress Kendo UI for jQuery versions prior to 2026.3.1015 lets an authenticated, low-privileged attacker who can supply data accepted by a model's Model.accept method - such as a crafted server response or record - inject unsafe keys like __proto__, constructor, or prototype into object prototypes, altering application behavior and potentially compromising the confidentiality and integrity of application data. The vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires some privilege level and user interaction and that real impact is gated on how the application consumes the polluted objects, with server-side JavaScript (Node) scenarios most exposed. The vendor has released a fix in version 2026.3.1015; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Ansible Automation Platform unified UI lets an authenticated user who can publish or upload a collection to Automation Hub embed a link using a script-executing URL scheme (for example javascript:) in that collection's documentation; the Hub documentation renderer (formatPartURL in frontend/hub DocumentationParsers.tsx) writes the URL into a link without validating its protocol, so the script executes in the Hub UI origin when a second authenticated user opens the collection documentation page and clicks the link. Red Hat scores it CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) - low confidentiality and integrity impact with a scope change, since the injected script runs with the privileges of the Hub origin rather than staying inside the published content. The flaw ships in the AAP 2.6 and 2.7 release branches only; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and exploitation requires both a malicious publisher and a victim who actively activates the crafted link.
Broken access control in the WordLift WordPress plugin (all versions through 3.54.15) lets an authenticated low-privilege user - a subscriber or contributor is sufficient - reach functionality that should be reserved for higher-privileged roles, yielding limited data disclosure and modification with a CVSS 3.1 score of 5.4 (C:L/I:L, no availability impact). Exploitation requires only a valid account on a site running the plugin, which makes open-registration, membership, and multi-author sites the most exposed; no user interaction is needed. There is no public exploit code and no confirmed active exploitation (no CISA KEV listing), so this is a moderate, not critical, priority - but it should be remediated promptly because the barrier to entry is a free account.
Stored cross-site scripting in XXL-JOB through 3.5.0-SNAPSHOT allows an authenticated user who holds trigger permission on a target executor job group to inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST /jobinfo/trigger; the payload is persisted and executes when another user loads the /joblog job log list page (CVSS 3.1: 5.4, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Because the vector specifies PR:L, the attacker must already hold a valid XXL-JOB account with the relevant group permission, and because it specifies UI:R, a second user must open the poisoned log page before any script runs, so exploitation is a two-party, permission-gated scenario rather than an anonymous drive-by. No public exploit code has been identified at time of analysis and the CVE is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied with the available data, so the practical risk is driven mainly by whether the admin console is internet-exposed or multi-tenant, where log-viewing by higher-privileged operators is routine.
Stored cross-site scripting in the XXL-JOB GLUE code editor (versions through 3.5.0-SNAPSHOT) lets an authenticated user with permission to create or edit GLUE-mode jobs persist arbitrary JavaScript through the glueSource parameter, which JobCodeController.save() stores without output encoding and the FreeMarker template job.code.ftl renders unescaped. The script is inert until another authenticated user - typically an administrator - opens the affected job's GLUE code view, so exploitation requires an authenticated attacker (PR:L per the assessed vector) plus victim interaction (UI:R), and the resulting impact is confined to the victim's browser session with low confidentiality and integrity effects (C:L/I:L, S:C); no server-side compromise follows from the XSS itself. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV). At CVSS 5.4 this is a genuine but moderate-priority issue rather than a top-tier emergency, and default deployments remain affected because the vulnerable rendering path lacks output encoding regardless of configuration.
Cross-site scripting in Progress Kendo UI for jQuery (versions prior to 2026.3.1015) allows an attacker to execute JavaScript in a victim's browser through the Calendar and MultiViewCalendar month content templates, which render data.url and data.title without URL sanitization or HTML attribute encoding. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) confirms this is an authenticated, low-privilege, user-interaction-dependent issue: the attacker must be able to influence the templated 'url' option value or the culture-derived 'title' values, and a victim must then interact with the affected widget. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is best treated as a conditional, medium-severity stored/DOM XSS risk that is neutralized by upgrading to 2026.3.1015 or later.
Cross-site scripting in Progress Kendo UI for jQuery's Validator affects versions from 2012.2.710 through 2026.3.1015, where validation messages read from data-msg-* attributes are decoded and then parsed as HTML, so text that was correctly escaped in the page attribute becomes active markup and event handlers when validation runs. An attacker with low privileges who can influence the content of a validation message, combined with a victim triggering the Validator, can execute JavaScript in the victim's browser and compromise the confidentiality and integrity of data accessible to the application. The vendor rates this CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis.
Cross-site scripting (DOM/stored) in Progress Kendo UI for jQuery prior to v2026.3.1015 allows an attacker who can influence Menu dataSource fields to inject JavaScript event-handler attributes that execute in a victim's browser when the affected Menu is interacted with. The flaw requires low privileges (PR:L) to write the attacker-controlled bound fields and user interaction (UI:R) to trigger execution, with a scope change (S:C) since the injected script runs in the host application's page context, affecting confidentiality and integrity of browser-accessible data. Progress has released a vendor patch in v2026.3.1015; no confirmed active exploitation or public exploit code was identified at time of analysis, and the issue is assessed as moderate severity rather than a mass-exploitation threat.
Cross-site scripting in Progress Kendo UI for jQuery prior to 2026.3.1015 allows an authenticated attacker with low privileges (CVSS PR:L) to inject extra HTML attributes and event handlers by modifying an imageUrl value consumed by the TabStrip, Menu, or PanelBar components. The vulnerable components insert the imageUrl into a single-quoted image src attribute without escaping, so a crafted value can break out of the attribute and execute JavaScript when a victim interacts with a page that renders the affected component (UI:R); successful exploitation can affect the confidentiality and integrity of data accessible to the application. No public exploit code or CISA KEV active exploitation was identified at time of analysis, and the vendor fix is version 2026.3.1015.
Stored cross-site scripting in the Progress Kendo UI for jQuery ListBox widget allows an attacker who can modify the data bound to a list item to execute JavaScript in a victim's browser whenever the affected item is rendered. The default item template outputs the bound dataTextField value as raw HTML without encoding, and every release from R1 2020 up to (but not including) 2026.3.1015 is exposed; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. Exploitation is not unauthenticated: it requires write access to the persisted field feeding dataTextField (consistent with the CVSS PR:L rating) plus a victim loading the view that renders the poisoned item (UI:R), which keeps this at medium severity (CVSS 3.1 base 5.4) and limits realistic impact to applications that bind the ListBox to user-influenced data.
Cross-site scripting in Progress Kendo UI for jQuery (releases from v2020.1.114 through 2026.3.1015) lets an attacker who can influence data bound to a Badge widget inject HTML with event handlers that execute JavaScript in a victim's browser when the Badge renders that value. Because the Badge text method outputs string values as raw HTML rather than encoded text, the injected script runs in the origin of the hosting application, compromising the confidentiality and integrity of data that application can reach on the victim's behalf. Exploitation requires both write access to the bound data source (CVSS PR:L) and a victim subsequently loading the affected page (UI:R), giving a vendor score of 5.4; no public exploit code or confirmed active exploitation was identified at time of analysis, and version 2026.3.1015 fixes the issue.
Denial of service in MessagePack-CSharp occurs when an application deserializes attacker-controlled MessagePack data into System.Object through PrimitiveObjectFormatter: the formatter allocates an object[] sized from each declared array length before the configured object-graph depth limit is applied, and nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation, so a small payload (reported ~31.5 KiB) can hold roughly 114.7 MiB of reference storage live at once and, with repeated submissions, cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Affected releases are all MessagePack-CSharp versions before 2.5.303 and 3.x versions from 3.0.0 up to but excluding 3.1.9 (2.5.302 is confirmed vulnerable), with the named concrete exposure being an ASP.NET Core SignalR application that has AddMessagePackProtocol() enabled and a reachable hub method taking an object parameter. The CVSS vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (C:N/I:N/A:L), so publicly reachable endpoints need no credentials while protected endpoints keep their existing authorization; exploitation requires repeated attacker-controlled submissions rather than a single request, and no public exploit code was identified at time of analysis.
Cross-origin request forgery in Erudika Scoold prior to 1.69.1 lets any attacker-controlled website issue credentialed API calls against an authenticated user's session, exposing user data, questions, and server configuration, and allowing state-changing actions on the victim's behalf. The CORS filter combines a wildcard origin pattern with credential support, so any requesting origin is reflected back with Access-Control-Allow-Credentials, meaning the only barriers are that the victim must have a live Scoold session in the same browser and must be lured to the attacker's page (CVSS 3.1 5.4, AV:N/AC:L/PR:N/UI:R, CWE-346). No public exploit code has been identified and the issue is not in CISA KEV; the vendor-released patch is version 1.69.1, which replaces the wildcard with a same-origin default or an explicit allowlist via the new cors_allowed_origins setting.
Authenticated remote attackers with a valid Qsync Central user account can exploit a unix symbolic link (symlink) following vulnerability (CWE-61) in QNAP Qsync Central to compromise system security, potentially leading to low impact on confidentiality, integrity, and availability. Affected versions are Qsync Central prior to 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2. This medium-severity issue (CVSS 4.0 base 5.3) has no public exploit identified at time of analysis and requires the attacker to first obtain a valid account on the NAS.
Open redirect in Scoold, Erudika's Java-based Q&A and knowledge-sharing platform, affects every release prior to 1.69.1, where the backto and returnto parameters handled by HttpUtils.getBackToUrl() are validated with a case-insensitive prefix match against the configured server URL. An unauthenticated attacker can craft a sign-in link whose backto value is an absolute URL on a look-alike host such as example.com.evil.com; URI.resolve() retains the attacker URL, the prefix check passes, and the victim is redirected to the attacker's domain after completing authentication. The result is phishing and possible credential or token theft on the malicious site, but exploitation hinges on the victim following the crafted link and signing in (UI:R); no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Authenticated attackers holding only low-privilege WordPress accounts can abuse improperly enforced access controls in the WP Chill Strong Testimonials plugin (all versions through 3.3.12) to perform testimonial-management actions they are not authorized to carry out, producing limited integrity and availability impact without disclosure of sensitive data. The flaw is a CWE-862 missing authorization condition rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L): network-reachable and requiring no user interaction, but gated behind an existing account at PR:L, so sites that disable open registration or tightly control subscriber-level accounts are materially less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the sole public reference is the Patchstack advisory, and no vendor fix version is specified in the available data.
Authorization bypass through user-controlled key (CWE-639 / IDOR) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin, affecting versions through 1.5.3, lets an authenticated low-privilege user supply or alter object identifiers in bulk-edit requests so the plugin acts on products, prices or attributes that user is not authorized to change, producing limited integrity and availability impact. Authentication is mandatory (CVSS PR:L) so anonymous visitors cannot trigger it, and there is no data disclosure (C:N) per the assessed vector. At time of analysis no public exploit code exists and the issue is not listed in CISA KEV, so practical risk depends on an attacker obtaining a valid low-privileged account on an affected WordPress/WooCommerce site.
Stored cross-site scripting in the NTP GPS configuration page of OPNsense (FreeBSD-based firewall/router platform) lets an authenticated user who holds the page-services-ntp-gps privilege persist a malicious initcmd value that closes the GPS textarea and injects script into the page. The payload executes in the browser session of any user - including an administrator - who later opens that page, letting the script read CSRF material and perform authenticated actions with the victim's privileges, which is why the CVSS vector assigns a changed scope (S:C). Affected are OPNsense core builds prior to 26.1.11; the flaw is fixed in 26.1.11, no public exploit was identified at time of analysis, and exploitation requires both a privileged operator account and a second user (UI:R) visiting the page.
Cross-site scripting in Progress Kendo UI for jQuery (all versions prior to 2026.3.1015) allows an authenticated low-privileged actor who controls the URL value passed to iframe-backed Splitter, Window, or Tooltip components - or the title of a Window iframe - to inject HTML attributes and JavaScript event handlers into the generated iframe markup, executing script in a victim's browser context when that user interacts with the affected widget (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Splitter and Window have been affected since 2011.2.804 and Tooltip since 2013.1.319, so any application on an older Kendo UI for jQuery release that renders untrusted input into these components is exposed. Exploitation requires pre-existing privileges to set the component value plus a separate victim's interaction, making this a real but non-urgent issue; there is no public exploit identified at time of analysis and the CVE is not confirmed actively exploited (CISA KEV).
The WholesaleX B2B/wholesale plugin for WooCommerce (up to and including 3.0.8) fails to validate the 'wholesalex_registration_role' parameter handled by 'process_registration', letting an attacker submit a registration with a role of their choosing and thereby self-assign any already-existing WholesaleX wholesale/B2B role. Impact is bounded - the escalation is limited to the plugin's own role tiers and does not reach arbitrary WordPress roles such as administrator - and the independent assessment rates it a moderate, not top-tier, priority (reassessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Authentication requirements are not fully resolved from the available data: the vendor description and the independent reassessment treat the attacker as unauthenticated, while the originally published CVSS vector carries PR:L. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Server-side request forgery in QNAP Download Station allows a low-privileged authenticated user to make the NAS application issue requests to internal or arbitrary destinations, resulting in limited disclosure of application data rather than any modification or denial of service. The flaw affects Download Station builds before 5.10.1.312 and the 5.11.x line before 5.11.2.321, and QNAP has published fixed versions for each branch. The issue is authentication-gated (CVSS 4.0 base 5.3, PR:L, confidentiality-only; independent assessment restricts impact to VC:L/VI:N/VA:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Path traversal in QNAP Qsync Central allows an authenticated remote attacker to read the contents of unexpected files or system data. Exploitation requires a valid Qsync Central user account and results in low confidentiality impact with no integrity or availability loss. No public exploit identified at time of analysis, and the vendor has released patches in versions 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2 and later.
Authorization bypass (IDOR, CWE-639) in zhontai Admin.Core through 10.1.0 allows any authenticated user who holds user- or organization-module permissions configured with a Dept or Self DataScope to read, modify, disable, and delete users and organizations belonging to other departments by simply supplying out-of-scope record ids to the UserService and OrgService by-id methods. Exploitation requires valid credentials with those specific module permissions (CVSS:4.0 5.3 Medium; assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so it is network-reachable but not unauthenticated, and it needs no user interaction. Exploitation is confirmed to work against otherwise default DataScope-restricted configurations because the by-id code path omits the scope check; no public exploit code was identified at time of analysis and there is no CISA KEV listing or vendor patch version identified in the available data.
Denial of service in QNAP File Station 5 (versions prior to 5.5.6.5243) allows any authenticated user to trigger a NULL pointer dereference via a network request, causing availability impact only. Exploitation requires a valid File Station 5 account, is network-reachable with low complexity and no user interaction, and no public exploit has been identified at time of analysis. The vendor has released a patch in version 5.5.6.5243 and later.
Denial of service in QNAP File Station 5 affects installations running versions before 5.5.6.5243; an authenticated remote attacker with a valid NAS user account can send a crafted request that dereferences a NULL pointer and disrupts the File Station service. The issue is limited to availability (C:N/I:N/A:L), requires low privileges but no user interaction, and all available signals indicate low real-world priority; no public exploit code or confirmed active exploitation was identified at time of analysis, and QNAP has released File Station 5 5.5.6.5243 as the fixed version.
Authenticated denial of service in QNAP File Station 5 allows a remote attacker who already holds a valid low-privileged QNAP NAS user account to crash the File Station application by sending a crafted request that triggers a NULL pointer dereference (CWE-476); impact is confined to availability of that application, with no confidentiality or integrity loss. The affected code is the network-facing File Station service on NAS devices running versions before 5.5.6.5243, and the authentication prerequisite (PR:L in both the CNA and independently assessed vectors) confines realistic exploitation to malicious insiders or to attackers who have separately compromised a user login. No public exploit or proof-of-concept has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided; the independent assessment confirms this is a genuinely low-priority issue despite being network-reachable.
Authorization bypass in Trudesk through 1.2.11 lets any authenticated user read private conversations they do not belong to by supplying another conversation's ID to GET /api/v1/messages/conversation/:id, exposing full message history along with participants' usernames, full names and email addresses. Exploitation requires a valid low-privileged account (CVSS vector PR:L, confirmed by the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with risk rising sharply where self-service registration is enabled, and the attacker must know or enumerate valid conversation IDs. No public exploit identified at time of analysis, and no confirmed CISA KEV active exploitation; the issue is a genuine but moderate-severity confidentiality problem rather than a critical priority, since impact is confined to read-only disclosure of message content and participant PII with no write or availability effect.
Cross-space information disclosure in APITable through 1.14.0-beta lets any authenticated, low-privileged user read node descriptions from other spaces by sending GET /node/{nodeId}/description with a user-controlled nodeId that skips space-membership and node-permission checks (CWE-639). The flaw has the greatest effect on multi-tenant or shared deployments, where descriptions can expose datasheet, folder, and form metadata belonging to another organization. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating a bounded, confidentiality-only issue; no public exploit identified at time of analysis, and no vendor-released patch version was identified at time of analysis, although a technical write-up and a VulnCheck advisory are available.
Cross-organization port management in Dokploy 0.30.8 and earlier lets an authenticated owner or admin of any tenant on a shared instance read, add, modify, or delete port mappings belonging to other organizations, hijacking how victim services are published. Exploitation requires a privileged (owner/admin) account on a multi-tenant Dokploy installation plus knowledge or enumeration of a valid portId or applicationId owned by another tenant, which is then passed to the port.create, port.one, port.update, or port.delete tRPC procedures; single-organization deployments are not effectively affected. This is a moderate-severity CWE-639 IDOR (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L; CVSS 4.0 5.3) rather than an emergency: no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, although a public technical writeup of the flaw is referenced in the advisory.
Authenticated workspace members in SendPortal Core through 4.0.1 can attach subscribers to tags owned by other workspaces by supplying unvalidated tag IDs through the web subscriber form or CSV import, allowing limited exposure of victim campaign content and skewing victim reports. This is a medium-severity authorization bypass (CVSS 4.0 5.3, CVSS:3.1 5.3) rather than an authentication flaw; it requires a valid account and a multi-tenant deployment with a victim workspace, and single-tenant installations have no cross-workspace target. No public exploit identified at time of analysis.
Information disclosure in pig (pig-mesh) through 4.1.1 allows any authenticated user to read arbitrary users' profile data via the GET /admin/user/details/{id} endpoint, which lacks per-object authorization checks (CWE-862). Attackers can enumerate sequential user IDs to harvest usernames, real names, phone numbers, emails, third-party account links, and role assignments; the issue requires a valid low-privilege account (PR:L) and has no write, privilege-escalation, or availability impact. No public exploit identified at time of analysis; no vendor-released patch is identified in the available data.
Unauthenticated page-content disclosure in ApostropheCMS versions prior to 4.33.0 lets remote attackers read page documents that should have been filtered by the platform's authorization and visibility rules. The bypass is exercised through the content REST API by requesting /api/v1/@apostrophecms/page with the all=1 query parameter, matching the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector (score 5.3): network reachable, requiring no credentials and no user interaction, with low confidentiality impact and no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine but moderate-priority exposure; the vendor has released 4.33.0 to correct the authorization logic.
Missing authorization in Peppermint through 0.5.5 allows any authenticated user to create time entries and upload attachments under another user's identity by supplying a target user id in the request body. The flaw affects the POST /api/v1/time/new and POST /api/v1/storage/ticket/:id/upload/single endpoints, which accept a caller-controlled user id without performing any ownership or permission check. Exploitation requires a valid Peppermint account (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N vector), needs no user interaction or non-default configuration, and is limited to integrity tampering - no data disclosure or denial of service is achievable. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Authenticated users can exploit an authorization bypass in ZenTao PMS through 22.6 to read and overwrite other users' comments by iterating sequential action IDs. This IDOR (CWE-639) in action::editComment allows low-privileged users to modify comments on bugs, stories, tasks, and documents in projects and products they cannot access, and view associated content and attachments. No public exploit code or active exploitation has been identified; the assessed CVSS 3.1 base score is 5.3 (moderate), requiring a valid authenticated session.
Missing authorization in the WPdreams Ajax Search Lite WordPress plugin (versions through 4.14.5) allows unauthenticated remote attackers to read access-controlled data, resulting in low confidentiality impact. The vulnerability has a CVSS score of 5.3 and requires no authentication or user interaction; no public exploit identified at time of analysis. Site administrators should update the plugin as soon as a fixed version is available.
Broken object-level authorization (IDOR) in Likeshop through 3.5.1 lets any user who self-registers on the storefront read and modify other customers' after-sale and refund records through the AfterSale API. Supplying another customer's after-sale record id to the detail, goodsInfo, cancel, express, and again actions in server/application/api/controller/AfterSale.php allows an attacker to view refund and order data, cancel pending refunds, overwrite return shipment details, or re-open refused refunds. The only prerequisite is a valid low-privileged authenticated session (PR:L), which the platform effectively hands out via open customer self-registration; no public exploit code has been identified at time of analysis, so this is a genuine but moderate-severity authorization defect rather than a drop-everything emergency.
TaskingAI deployments up to and including version 0.3.0 let an authenticated attacker who holds a valid project API key or console admin login coerce the backend into sending arbitrary HTTP requests by planting an unvalidated OpenAPI servers[0].url in a user-defined action and then executing it with POST /actions/{action_id}/run, which returns up to 64 KiB of the target's response. Rated CVSS:3.1 5.3 (CWE-918 server-side request forgery), the flaw enables reads of loopback services, internal hosts, and cloud metadata endpoints such as 169.254.169.254, so it is best treated as a credentialed-insider or stolen-key risk rather than an unauthenticated internet attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical blast radius is bounded by the prerequisite credentials, the backend's network reachability to the target, and the 64 KiB read-back cap.
Missing authorization in the PlanetStudio Payment Gateway WordPress plugin (versions through 1.3.3) allows unauthenticated remote attackers to reach plugin functionality that should be gated behind an access-control or capability check, resulting in limited unauthorized modification of site state rather than data theft or takeover. Because the CVSS vector is PR:N/UI:N with C:N/I:L/A:N, exploitation requires only that the plugin be installed and active on an internet-reachable WordPress site and that the affected endpoint be reachable - no credentials and no victim interaction are needed, though the impact ceiling is low and integrity-only. The plugin has a small deployment footprint, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a genuine but moderate-priority issue rather than a critical emergency, so remediation should be scheduled rather than treated as an emergency outage.
A timing side-channel in QNAP QuRouter allows attackers on an adjacent network segment to extract limited sensitive data by measuring response-time discrepancies, without authentication and without user interaction. The issue is fixed in QuRouter 2.7.2.113 and later; the vendor advisory confirms a patched release is available. No public exploit code or active exploitation has been identified at time of analysis, and the scored risk is low (CVSS 4.0 base 1.3; independently assessed as CVSS 3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), with the relevant confidentiality impact only and no integrity or availability effect.
Missing authorization in the WPExperts WP EasyPay plugin (versions through 4.5.4) leaves a plugin-provided endpoint or action reachable by unauthenticated remote requests, so an attacker with network access to a WordPress site running the vulnerable plugin can invoke restricted functionality and read data they should not be able to reach. The reported CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, meaning no credentials, no user interaction, and no non-default configuration are required, but the impact is confined to limited confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis, there is no CISA KEV entry, and no EPSS score was provided in the available intelligence, so exploitation risk currently rests on the ease of reaching the unauthenticated endpoint rather than on confirmed active abuse.
Denial of service in HPE NonStop TCP/IP Utilities (T8602L01^BAA and earlier) can be triggered when the traceroute utility is executed under specific, non-default conditions, allowing a remote attacker to render the affected utility unavailable. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.3) confirms the attacker needs no authentication and can act remotely, but exploitation depends on a narrow precondition (high attack complexity) and on a traceroute invocation or operator action occurring (required user interaction), so the attacker cannot trigger the condition unilaterally. Impact is restricted to availability - there is no confidentiality or integrity loss and no code execution - and no public exploit has been identified at time of analysis.
Improper authentication handling in ZoneMinder 1.34.0 through 1.36.38 lets remote unauthenticated attackers bypass the login redirect and read monitor and zone metadata through the zones view by submitting a malformed or invalidly signed token. The impact is limited to information disclosure-privileged and state-changing operations remain blocked because permission helpers reject the boolean false user value-and no public exploit code has been identified at time of analysis. Exploitation requires ZM_OPT_USE_AUTH to be enabled, token-based authentication in use, and the web interface to be network-reachable; vendor-released patch: 1.36.63.
Missing authorization in the WebberZone Knowledge Base plugin for WordPress (versions through 3.2.0) allows unauthenticated remote attackers to reach knowledge base content that the plugin's access-control settings were intended to restrict. Because the CVSS vector is PR:N/UI:N, no account or victim interaction is needed; the exposure is limited to confidentiality (C:L, CVSS 5.3), with no write or availability impact. No public exploit code has been identified at time of analysis, and there is no confirmed CISA KEV entry, so real-world exploitation is not established from the available data.
Unauthenticated remote attackers can exploit missing authorization in the WP Desk Flexible Quantity (Measurement Price Calculator for WooCommerce) plugin, versions up to and including 2.3.23, to modify a constrained set of data with low integrity impact. The flaw, tracked as CWE-862 and rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), requires no authentication or user interaction, but the exact affected feature is unspecified. No public exploit code or active exploitation has been identified at time of analysis.
Sunshine Photo Cart (WordPress plugin) versions up to 3.7.4 are affected by a missing authorization vulnerability (CWE-862) that allows unauthenticated remote attackers to bypass access controls and read limited sensitive data from the plugin, such as cart or customer information. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required, but impact is confined to partial confidentiality loss (C:L) with no integrity or availability effect. No public exploit code has been identified at time of analysis.
Missing authorization controls in the WP E-Signature 'Ninja Forms Signature Contract Add-On' for WordPress (all versions from the initial release through 3.2.5) let remote, unauthenticated attackers reach a function that should be restricted and read data they are not entitled to see. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3) confirms no credentials, no user interaction, and no special configuration are required against a default installation, but impact is limited to confidentiality - no data modification or denial of service is possible. No public exploit code was identified at time of analysis and no EPSS or CISA KEV data was provided, so there is no confirmed active exploitation; risk is driven by the plugin's narrow deployment footprint and the low-sensitivity, read-only nature of the exposure.
Unauthenticated attackers can tamper with booking quantities in the Booking and Rental Manager WordPress plugin (versions through 2.8.0) due to improper validation of specified quantity input (CWE-1284), potentially removing important client functionality. The CVSS 5.3 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms network-exploitable, low-complexity, unauthenticated access with integrity-only, partial impact and no confidentiality or availability effect. No public exploit or active exploitation has been identified at time of analysis.
Missing authorization (CWE-862) in the WPExperts APIExperts Square for WooCommerce (WooSquare) WordPress plugin allows unauthenticated remote attackers to invoke plugin functionality that lacks a capability/permission check, affecting all versions through 4.7.5. The assessed CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms the attack needs no login, credentials, or user interaction, but the integrity-only, low-impact rating bounds the outcome to a limited set of unauthorized operations rather than full site compromise, and only stores running this Square-for-WooCommerce integration are exposed. No public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis.
A low-severity denial-of-service condition affects the Go library kin-openapi in versions 0.145.0 through 0.146.0 (exclusive). When an application uses openapi3filter.ValidateRequest and its OpenAPI schema defines at least one query parameter with the deepObject serialization style, an unauthenticated remote client can send a request containing a large number of unrelated query keys, causing the urlValuesDecoder.DecodeObject routine to recompile the same parameter-name regular expression once per key and consume CPU and memory proportional to the attacker-controlled key count. The vulnerability scores CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), and no public exploit code was identified at time of analysis; the issue is fixed in release 0.146.0.
Unsupported or non-canonical HTTP methods sent to Go services built on kin-openapi's openapi3filter.ValidationHandler with the legacy router reach a panic in PathItem.GetOperation before authentication runs, letting an unauthenticated remote client repeatedly abort connections and inflate stack-trace logs in all versions prior to 0.145.0. The access vector is network-only with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), but the effect is bounded: Go recovers per-request panics by default, so the worst case is per-connection denial of service and log growth rather than a full process crash, and the panic requires an exactly-matched static path (a path served only by a templated route does not reach the same sink). No public exploit code was identified at time of analysis, and CISA KEV does not list this issue as confirmed actively exploited.