Local information disclosure and symlink-following file overwrite in AsyncHttpClient versions 2.0.0 through 2.16.0 and 3.x before 3.0.12 let an authenticated local user on a shared multi-user host read resumable download URLs - including embedded credentials and query tokens - from a predictably named store at $java.io.tmpdir/ahc/ResumableAsyncHandler.properties, or plant a symbolic link that the client follows when saving state, truncating and overwriting any file writable by the client process. Only applications that decorate another AsyncHandler with ResumableAsyncHandler backed by PropertiesBasedResumableProcessor are exposed; the no-argument constructors use a no-op processor and are unaffected. Exploitation requires local access, control of the shared $java.io.tmpdir/ahc directory, and timing against a state save; no public exploit code was identified at time of analysis and there is no KEV confirmation of active exploitation. The issue is fixed in 2.16.1 and 3.0.12.
Out-of-bounds memory write in HPE NonStop RDMA Services NSK can corrupt memory, and the 5.8 CVSS score reflects a local attack path that also requires high privileges, user interaction, and high attack complexity. Only HPE NonStop systems using the RDMA Services NSK component are affected based on the supplied CPE, and no public exploit code or CISA KEV entry is present in the data. Realistic exploitation is limited to a privileged local user who can induce a separate user to interact under race/condition-dependent circumstances, making this a moderate-severity, low-priority issue in practice.
Stored cross-site scripting in Lychee photo-management software (all versions prior to 7.6.0) allows an authenticated user holding album-edit permissions to embed a javascript: URI inside an album or photo Markdown description, which is then converted to HTML server-side and rendered client-side via v-html in the gallery components. Because the payload is stored in album/photo metadata, any visitor who clicks the rendered link - including an unauthenticated visitor to a public album - executes attacker-controlled JavaScript in the Lychee origin, which can expose session data or let the attacker issue authenticated requests in the victim's context; exploitation requires the victim's click and therefore is not triggered by passive page views. The issue is fixed in Lychee 7.6.0 and no public exploit was identified at time of analysis.
An out-of-bounds memory read in HPE NonStop EXPAND can be triggered by an authenticated, highly privileged local operator on the NonStop platform, potentially leaking memory contents or destabilizing the EXPAND networking subsystem. Exploitation requires local access (AV:L), pre-existing high privileges (PR:H), and a hard-to-control memory or timing condition (AC:H), so it is neither remotely nor anonymously reachable; no user interaction is required. No public exploit code has been identified at time of analysis, and the vendor security bulletin (hpesbns05148en_us) is the authoritative source for affected releases and fixes.
An out-of-bounds read in zziplib through 0.13.80 allows attackers to crash applications that open a specially crafted ZIP archive via zzip_dir_open() when the library is compiled in mmap mode. The vulnerability triggers a 28-byte ZIP64 extra field over-read when an entry name ends exactly at the end of the mapped central directory. Exploitation requires a local attack vector, high complexity, and user interaction to open the crafted archive; there is no confidentiality or integrity impact, only availability loss (crash). No public exploit identified at time of analysis.
Plaintext credential disclosure in Eclipse Jetty occurs when a SessionAuthentication object holding a credential that contains a plaintext password is serialized into a persisted session data store, causing the password to be written to database, file, or cache storage in cleartext (CWE-312). The weakness is only exploitable in a specific deployment: session persistence must be enabled via a SessionDataStore, authentication must produce credentials containing a plaintext password, and the attacker must already hold sufficient privileges to read the persisted session data - database access, filesystem or backup access, or cache access. No public exploit identified at time of analysis, and CISA KEV does not list this issue; the independent assessment rates it a genuine but modest-priority flaw (CVSS 3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N, vendor CVSS 4.0 5.6) with confidentiality-only impact and no integrity or availability effect.
Intent redirection and improper access control in the AgentWeb Android WebView library (agentweb-core through 5.1.6-androidx) lets attacker-influenced web content loaded inside a host app's WebView launch that host app's own non-exported components and coerce URI permission grants for the host's ContentProviders by supplying crafted intent:// URLs that DefaultWebClient parses and fires under the host Activity's identity. The vulnerability is exploitable unauthenticated and remotely with no user interaction beyond the app rendering untrusted content (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), although real impact is bounded by the host app's own component and provider surface and by the host exposing sensitive non-exported components or providers; components belonging to other applications remain gated by the OS exported check. No public exploit identified at time of analysis, and the project has released a fixed version, 5.1.7-androidx, via commit 9efb1519.
Local privilege escalation in FreeBSD's sound(4) driver stems from a time-of-check/time-of-use race in audio-buffer resizing: a local, authenticated user with sound-device access can race an mmap(2) call against a buffer reallocation to cause a kernel use-after-free. Affected releases are FreeBSD 15.1-RELEASE before p5, 14.4-RELEASE before p11, and 14.5-RELEASE before p2; the independent assessment rates exploitation as local, authenticated, high-complexity, and requiring a non-deterministic timing win, with high confidentiality, integrity, and availability impact if successful. EPSS is 0.11% (1st percentile) and no public exploit identified at time of analysis, making this a genuine but lower-tier priority compared with remotely exploitable or actively exploited issues.
Arbitrary code execution is possible on a broad set of Lenovo consumer tablets - including the Idea Tab Pro TB373FU, Idea Tab / Lenovo Tab K11 Gen 2 TB336FU and TB336ZU, Legion Tab TB321FU, Tab M11 TB330FU and TB330XU, Tab Extreme TB570FU and TB570ZU, and Tab K11 TB330FUP, with additional models enumerated in vendor tagging (Tab K11 Plus, Tab K9, Tab One, Tab P12, Tab Plus, Yoga Tab, Yoga Tab Plus, and the TB311FU/TB311XU folio and clear-case variants) - by an attacker who has physical possession of the tablet while it is already unlocked. The CVSS 4.0 base score is 5.4 (MEDIUM), with vector AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, meaning exploitation requires the attacker to be physically at the device (AV:P), no prior privileges are needed (PR:N), no victim interaction is required beyond the device already being unlocked (UI:N), and attack requirements are present (AT:P) in the form of physical custody plus an unlocked state; the flaw affects a device's own confidentiality, integrity and availability but does not propagate to subsequent systems. No CISA KEV listing is associated with this CVE and no public exploit code has been identified at time of analysis, so real-world risk is bounded by the physical and unlocked-device preconditions - a locked, powered-off, or patched unit is not exploitable via this issue.
Stored cross-site scripting in OPNsense core before 26.1.11 allows a user holding Firewall Categories or Firewall Alias Edit privileges to plant script that executes in the browser session of an administrator or other operator who opens the Firewall Rules or NAT page. The injected code runs with the victim's context, can read CSRF tokens, and can therefore perform authenticated actions on the firewall as that victim. Exploitation is not anonymous - it requires the attacker to already possess category or alias editing rights (PR:L, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4), and the malicious category must be attached to a rule or the alias referenced as a rule source/destination and saved so the tooltip renders; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited in CISA KEV. Fixed in OPNsense 26.1.11.
Stored cross-site scripting (XSS) in JetBrains TeamCity's classic build log allows an authenticated user with permission to inject content into build output to execute arbitrary JavaScript in the browser of another user who views the affected log. The flaw affects TeamCity versions before 2026.2, 2026.1.4, and 2025.11.8, and exploitation requires both authentication and victim interaction, making it a moderate-severity risk (vendor CVSS 6.7). No public exploit code has been identified at time of analysis.
Stored cross-site scripting (XSS) in JetBrains TeamCity versions before 2026.2, 2026.1.4, and 2025.11.8 allows an authenticated low-privilege attacker to inject malicious scripts into the classic project overview page, which execute in the context of any user-including higher-privileged administrators-who navigates to that view. The vulnerability requires the attacker to have a valid TeamCity account with rights to store content that renders in the classic overview, and a privileged victim must actively open that legacy view; no public exploit code has been identified at time of analysis. The independent assessment rates the overall risk as conditional rather than critical, noting that instances not exposing the classic overview to low-privilege contributors are not realistically exploitable.
Prototype pollution in Progress Kendo UI for jQuery versions prior to 2026.3.1015 lets an authenticated, low-privileged attacker who can supply data accepted by a model's Model.accept method - such as a crafted server response or record - inject unsafe keys like __proto__, constructor, or prototype into object prototypes, altering application behavior and potentially compromising the confidentiality and integrity of application data. The vendor-assigned CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires some privilege level and user interaction and that real impact is gated on how the application consumes the polluted objects, with server-side JavaScript (Node) scenarios most exposed. The vendor has released a fix in version 2026.3.1015; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Ansible Automation Platform unified UI lets an authenticated user who can publish or upload a collection to Automation Hub embed a link using a script-executing URL scheme (for example javascript:) in that collection's documentation; the Hub documentation renderer (formatPartURL in frontend/hub DocumentationParsers.tsx) writes the URL into a link without validating its protocol, so the script executes in the Hub UI origin when a second authenticated user opens the collection documentation page and clicks the link. Red Hat scores it CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) - low confidentiality and integrity impact with a scope change, since the injected script runs with the privileges of the Hub origin rather than staying inside the published content. The flaw ships in the AAP 2.6 and 2.7 release branches only; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and exploitation requires both a malicious publisher and a victim who actively activates the crafted link.
Broken access control in the WordLift WordPress plugin (all versions through 3.54.15) lets an authenticated low-privilege user - a subscriber or contributor is sufficient - reach functionality that should be reserved for higher-privileged roles, yielding limited data disclosure and modification with a CVSS 3.1 score of 5.4 (C:L/I:L, no availability impact). Exploitation requires only a valid account on a site running the plugin, which makes open-registration, membership, and multi-author sites the most exposed; no user interaction is needed. There is no public exploit code and no confirmed active exploitation (no CISA KEV listing), so this is a moderate, not critical, priority - but it should be remediated promptly because the barrier to entry is a free account.
Stored cross-site scripting in the XXL-JOB GLUE code editor (versions through 3.5.0-SNAPSHOT) lets an authenticated user with permission to create or edit GLUE-mode jobs persist arbitrary JavaScript through the glueSource parameter, which JobCodeController.save() stores without output encoding and the FreeMarker template job.code.ftl renders unescaped. The script is inert until another authenticated user - typically an administrator - opens the affected job's GLUE code view, so exploitation requires an authenticated attacker (PR:L per the assessed vector) plus victim interaction (UI:R), and the resulting impact is confined to the victim's browser session with low confidentiality and integrity effects (C:L/I:L, S:C); no server-side compromise follows from the XSS itself. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV). At CVSS 5.4 this is a genuine but moderate-priority issue rather than a top-tier emergency, and default deployments remain affected because the vulnerable rendering path lacks output encoding regardless of configuration.
Stored cross-site scripting in XXL-JOB through 3.5.0-SNAPSHOT allows an authenticated user who holds trigger permission on a target executor job group to inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST /jobinfo/trigger; the payload is persisted and executes when another user loads the /joblog job log list page (CVSS 3.1: 5.4, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Because the vector specifies PR:L, the attacker must already hold a valid XXL-JOB account with the relevant group permission, and because it specifies UI:R, a second user must open the poisoned log page before any script runs, so exploitation is a two-party, permission-gated scenario rather than an anonymous drive-by. No public exploit code has been identified at time of analysis and the CVE is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied with the available data, so the practical risk is driven mainly by whether the admin console is internet-exposed or multi-tenant, where log-viewing by higher-privileged operators is routine.
Cross-site scripting in Progress Kendo UI for jQuery (versions prior to 2026.3.1015) allows an attacker to execute JavaScript in a victim's browser through the Calendar and MultiViewCalendar month content templates, which render data.url and data.title without URL sanitization or HTML attribute encoding. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) confirms this is an authenticated, low-privilege, user-interaction-dependent issue: the attacker must be able to influence the templated 'url' option value or the culture-derived 'title' values, and a victim must then interact with the affected widget. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), so this is best treated as a conditional, medium-severity stored/DOM XSS risk that is neutralized by upgrading to 2026.3.1015 or later.
Cross-site scripting in Progress Kendo UI for jQuery's Validator affects versions from 2012.2.710 through 2026.3.1015, where validation messages read from data-msg-* attributes are decoded and then parsed as HTML, so text that was correctly escaped in the page attribute becomes active markup and event handlers when validation runs. An attacker with low privileges who can influence the content of a validation message, combined with a victim triggering the Validator, can execute JavaScript in the victim's browser and compromise the confidentiality and integrity of data accessible to the application. The vendor rates this CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); no public exploit identified at time of analysis.
Cross-site scripting (DOM/stored) in Progress Kendo UI for jQuery prior to v2026.3.1015 allows an attacker who can influence Menu dataSource fields to inject JavaScript event-handler attributes that execute in a victim's browser when the affected Menu is interacted with. The flaw requires low privileges (PR:L) to write the attacker-controlled bound fields and user interaction (UI:R) to trigger execution, with a scope change (S:C) since the injected script runs in the host application's page context, affecting confidentiality and integrity of browser-accessible data. Progress has released a vendor patch in v2026.3.1015; no confirmed active exploitation or public exploit code was identified at time of analysis, and the issue is assessed as moderate severity rather than a mass-exploitation threat.
Cross-site scripting in Progress Kendo UI for jQuery prior to 2026.3.1015 allows an authenticated attacker with low privileges (CVSS PR:L) to inject extra HTML attributes and event handlers by modifying an imageUrl value consumed by the TabStrip, Menu, or PanelBar components. The vulnerable components insert the imageUrl into a single-quoted image src attribute without escaping, so a crafted value can break out of the attribute and execute JavaScript when a victim interacts with a page that renders the affected component (UI:R); successful exploitation can affect the confidentiality and integrity of data accessible to the application. No public exploit code or CISA KEV active exploitation was identified at time of analysis, and the vendor fix is version 2026.3.1015.
Stored cross-site scripting in the Progress Kendo UI for jQuery ListBox widget allows an attacker who can modify the data bound to a list item to execute JavaScript in a victim's browser whenever the affected item is rendered. The default item template outputs the bound dataTextField value as raw HTML without encoding, and every release from R1 2020 up to (but not including) 2026.3.1015 is exposed; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. Exploitation is not unauthenticated: it requires write access to the persisted field feeding dataTextField (consistent with the CVSS PR:L rating) plus a victim loading the view that renders the poisoned item (UI:R), which keeps this at medium severity (CVSS 3.1 base 5.4) and limits realistic impact to applications that bind the ListBox to user-influenced data.
Cross-site scripting in Progress Kendo UI for jQuery (releases from v2020.1.114 through 2026.3.1015) lets an attacker who can influence data bound to a Badge widget inject HTML with event handlers that execute JavaScript in a victim's browser when the Badge renders that value. Because the Badge text method outputs string values as raw HTML rather than encoded text, the injected script runs in the origin of the hosting application, compromising the confidentiality and integrity of data that application can reach on the victim's behalf. Exploitation requires both write access to the bound data source (CVSS PR:L) and a victim subsequently loading the affected page (UI:R), giving a vendor score of 5.4; no public exploit code or confirmed active exploitation was identified at time of analysis, and version 2026.3.1015 fixes the issue.
Denial of service in MessagePack-CSharp occurs when an application deserializes attacker-controlled MessagePack data into System.Object through PrimitiveObjectFormatter: the formatter allocates an object[] sized from each declared array length before the configured object-graph depth limit is applied, and nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation, so a small payload (reported ~31.5 KiB) can hold roughly 114.7 MiB of reference storage live at once and, with repeated submissions, cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Affected releases are all MessagePack-CSharp versions before 2.5.303 and 3.x versions from 3.0.0 up to but excluding 3.1.9 (2.5.302 is confirmed vulnerable), with the named concrete exposure being an ASP.NET Core SignalR application that has AddMessagePackProtocol() enabled and a reachable hub method taking an object parameter. The CVSS vector is AV:N/AC:L/PR:N/UI:N with availability-only impact (C:N/I:N/A:L), so publicly reachable endpoints need no credentials while protected endpoints keep their existing authorization; exploitation requires repeated attacker-controlled submissions rather than a single request, and no public exploit code was identified at time of analysis.
Cross-origin request forgery in Erudika Scoold prior to 1.69.1 lets any attacker-controlled website issue credentialed API calls against an authenticated user's session, exposing user data, questions, and server configuration, and allowing state-changing actions on the victim's behalf. The CORS filter combines a wildcard origin pattern with credential support, so any requesting origin is reflected back with Access-Control-Allow-Credentials, meaning the only barriers are that the victim must have a live Scoold session in the same browser and must be lured to the attacker's page (CVSS 3.1 5.4, AV:N/AC:L/PR:N/UI:R, CWE-346). No public exploit code has been identified and the issue is not in CISA KEV; the vendor-released patch is version 1.69.1, which replaces the wildcard with a same-origin default or an explicit allowlist via the new cors_allowed_origins setting.
Authenticated remote attackers with a valid Qsync Central user account can exploit a unix symbolic link (symlink) following vulnerability (CWE-61) in QNAP Qsync Central to compromise system security, potentially leading to low impact on confidentiality, integrity, and availability. Affected versions are Qsync Central prior to 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2. This medium-severity issue (CVSS 4.0 base 5.3) has no public exploit identified at time of analysis and requires the attacker to first obtain a valid account on the NAS.
Open redirect in Scoold, Erudika's Java-based Q&A and knowledge-sharing platform, affects every release prior to 1.69.1, where the backto and returnto parameters handled by HttpUtils.getBackToUrl() are validated with a case-insensitive prefix match against the configured server URL. An unauthenticated attacker can craft a sign-in link whose backto value is an absolute URL on a look-alike host such as example.com.evil.com; URI.resolve() retains the attacker URL, the prefix check passes, and the victim is redirected to the attacker's domain after completing authentication. The result is phishing and possible credential or token theft on the malicious site, but exploitation hinges on the victim following the crafted link and signing in (UI:R); no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Authenticated attackers holding only low-privilege WordPress accounts can abuse improperly enforced access controls in the WP Chill Strong Testimonials plugin (all versions through 3.3.12) to perform testimonial-management actions they are not authorized to carry out, producing limited integrity and availability impact without disclosure of sensitive data. The flaw is a CWE-862 missing authorization condition rated CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L): network-reachable and requiring no user interaction, but gated behind an existing account at PR:L, so sites that disable open registration or tightly control subscriber-level accounts are materially less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the sole public reference is the Patchstack advisory, and no vendor fix version is specified in the available data.
Authorization bypass through user-controlled key (CWE-639 / IDOR) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin, affecting versions through 1.5.3, lets an authenticated low-privilege user supply or alter object identifiers in bulk-edit requests so the plugin acts on products, prices or attributes that user is not authorized to change, producing limited integrity and availability impact. Authentication is mandatory (CVSS PR:L) so anonymous visitors cannot trigger it, and there is no data disclosure (C:N) per the assessed vector. At time of analysis no public exploit code exists and the issue is not listed in CISA KEV, so practical risk depends on an attacker obtaining a valid low-privileged account on an affected WordPress/WooCommerce site.
Stored cross-site scripting in the NTP GPS configuration page of OPNsense (FreeBSD-based firewall/router platform) lets an authenticated user who holds the page-services-ntp-gps privilege persist a malicious initcmd value that closes the GPS textarea and injects script into the page. The payload executes in the browser session of any user - including an administrator - who later opens that page, letting the script read CSRF material and perform authenticated actions with the victim's privileges, which is why the CVSS vector assigns a changed scope (S:C). Affected are OPNsense core builds prior to 26.1.11; the flaw is fixed in 26.1.11, no public exploit was identified at time of analysis, and exploitation requires both a privileged operator account and a second user (UI:R) visiting the page.
Cross-site scripting in Progress Kendo UI for jQuery (all versions prior to 2026.3.1015) allows an authenticated low-privileged actor who controls the URL value passed to iframe-backed Splitter, Window, or Tooltip components - or the title of a Window iframe - to inject HTML attributes and JavaScript event handlers into the generated iframe markup, executing script in a victim's browser context when that user interacts with the affected widget (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Splitter and Window have been affected since 2011.2.804 and Tooltip since 2013.1.319, so any application on an older Kendo UI for jQuery release that renders untrusted input into these components is exposed. Exploitation requires pre-existing privileges to set the component value plus a separate victim's interaction, making this a real but non-urgent issue; there is no public exploit identified at time of analysis and the CVE is not confirmed actively exploited (CISA KEV).
The WholesaleX B2B/wholesale plugin for WooCommerce (up to and including 3.0.8) fails to validate the 'wholesalex_registration_role' parameter handled by 'process_registration', letting an attacker submit a registration with a role of their choosing and thereby self-assign any already-existing WholesaleX wholesale/B2B role. Impact is bounded - the escalation is limited to the plugin's own role tiers and does not reach arbitrary WordPress roles such as administrator - and the independent assessment rates it a moderate, not top-tier, priority (reassessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Authentication requirements are not fully resolved from the available data: the vendor description and the independent reassessment treat the attacker as unauthenticated, while the originally published CVSS vector carries PR:L. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Server-side request forgery in QNAP Download Station allows a low-privileged authenticated user to make the NAS application issue requests to internal or arbitrary destinations, resulting in limited disclosure of application data rather than any modification or denial of service. The flaw affects Download Station builds before 5.10.1.312 and the 5.11.x line before 5.11.2.321, and QNAP has published fixed versions for each branch. The issue is authentication-gated (CVSS 4.0 base 5.3, PR:L, confidentiality-only; independent assessment restricts impact to VC:L/VI:N/VA:N), and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Path traversal in QNAP Qsync Central allows an authenticated remote attacker to read the contents of unexpected files or system data. Exploitation requires a valid Qsync Central user account and results in low confidentiality impact with no integrity or availability loss. No public exploit identified at time of analysis, and the vendor has released patches in versions 5.0.0.7, 5.1.0.3, 5.2.0.5, and 5.3.0.2 and later.
Authorization bypass (IDOR, CWE-639) in zhontai Admin.Core through 10.1.0 allows any authenticated user who holds user- or organization-module permissions configured with a Dept or Self DataScope to read, modify, disable, and delete users and organizations belonging to other departments by simply supplying out-of-scope record ids to the UserService and OrgService by-id methods. Exploitation requires valid credentials with those specific module permissions (CVSS:4.0 5.3 Medium; assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), so it is network-reachable but not unauthenticated, and it needs no user interaction. Exploitation is confirmed to work against otherwise default DataScope-restricted configurations because the by-id code path omits the scope check; no public exploit code was identified at time of analysis and there is no CISA KEV listing or vendor patch version identified in the available data.
Denial of service in QNAP File Station 5 (versions prior to 5.5.6.5243) allows any authenticated user to trigger a NULL pointer dereference via a network request, causing availability impact only. Exploitation requires a valid File Station 5 account, is network-reachable with low complexity and no user interaction, and no public exploit has been identified at time of analysis. The vendor has released a patch in version 5.5.6.5243 and later.
Denial of service in QNAP File Station 5 affects installations running versions before 5.5.6.5243; an authenticated remote attacker with a valid NAS user account can send a crafted request that dereferences a NULL pointer and disrupts the File Station service. The issue is limited to availability (C:N/I:N/A:L), requires low privileges but no user interaction, and all available signals indicate low real-world priority; no public exploit code or confirmed active exploitation was identified at time of analysis, and QNAP has released File Station 5 5.5.6.5243 as the fixed version.
Authenticated denial of service in QNAP File Station 5 allows a remote attacker who already holds a valid low-privileged QNAP NAS user account to crash the File Station application by sending a crafted request that triggers a NULL pointer dereference (CWE-476); impact is confined to availability of that application, with no confidentiality or integrity loss. The affected code is the network-facing File Station service on NAS devices running versions before 5.5.6.5243, and the authentication prerequisite (PR:L in both the CNA and independently assessed vectors) confines realistic exploitation to malicious insiders or to attackers who have separately compromised a user login. No public exploit or proof-of-concept has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided; the independent assessment confirms this is a genuinely low-priority issue despite being network-reachable.
Authorization bypass in Trudesk through 1.2.11 lets any authenticated user read private conversations they do not belong to by supplying another conversation's ID to GET /api/v1/messages/conversation/:id, exposing full message history along with participants' usernames, full names and email addresses. Exploitation requires a valid low-privileged account (CVSS vector PR:L, confirmed by the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), with risk rising sharply where self-service registration is enabled, and the attacker must know or enumerate valid conversation IDs. No public exploit identified at time of analysis, and no confirmed CISA KEV active exploitation; the issue is a genuine but moderate-severity confidentiality problem rather than a critical priority, since impact is confined to read-only disclosure of message content and participant PII with no write or availability effect.
Cross-space information disclosure in APITable through 1.14.0-beta lets any authenticated, low-privileged user read node descriptions from other spaces by sending GET /node/{nodeId}/description with a user-controlled nodeId that skips space-membership and node-permission checks (CWE-639). The flaw has the greatest effect on multi-tenant or shared deployments, where descriptions can expose datasheet, folder, and form metadata belonging to another organization. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating a bounded, confidentiality-only issue; no public exploit identified at time of analysis, and no vendor-released patch version was identified at time of analysis, although a technical write-up and a VulnCheck advisory are available.
Cross-organization port management in Dokploy 0.30.8 and earlier lets an authenticated owner or admin of any tenant on a shared instance read, add, modify, or delete port mappings belonging to other organizations, hijacking how victim services are published. Exploitation requires a privileged (owner/admin) account on a multi-tenant Dokploy installation plus knowledge or enumeration of a valid portId or applicationId owned by another tenant, which is then passed to the port.create, port.one, port.update, or port.delete tRPC procedures; single-organization deployments are not effectively affected. This is a moderate-severity CWE-639 IDOR (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L; CVSS 4.0 5.3) rather than an emergency: no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis, although a public technical writeup of the flaw is referenced in the advisory.
Authenticated workspace members in SendPortal Core through 4.0.1 can attach subscribers to tags owned by other workspaces by supplying unvalidated tag IDs through the web subscriber form or CSV import, allowing limited exposure of victim campaign content and skewing victim reports. This is a medium-severity authorization bypass (CVSS 4.0 5.3, CVSS:3.1 5.3) rather than an authentication flaw; it requires a valid account and a multi-tenant deployment with a victim workspace, and single-tenant installations have no cross-workspace target. No public exploit identified at time of analysis.
Information disclosure in pig (pig-mesh) through 4.1.1 allows any authenticated user to read arbitrary users' profile data via the GET /admin/user/details/{id} endpoint, which lacks per-object authorization checks (CWE-862). Attackers can enumerate sequential user IDs to harvest usernames, real names, phone numbers, emails, third-party account links, and role assignments; the issue requires a valid low-privilege account (PR:L) and has no write, privilege-escalation, or availability impact. No public exploit identified at time of analysis; no vendor-released patch is identified in the available data.
Unauthenticated page-content disclosure in ApostropheCMS versions prior to 4.33.0 lets remote attackers read page documents that should have been filtered by the platform's authorization and visibility rules. The bypass is exercised through the content REST API by requesting /api/v1/@apostrophecms/page with the all=1 query parameter, matching the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector (score 5.3): network reachable, requiring no credentials and no user interaction, with low confidentiality impact and no integrity or availability impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine but moderate-priority exposure; the vendor has released 4.33.0 to correct the authorization logic.
Missing authorization in Peppermint through 0.5.5 allows any authenticated user to create time entries and upload attachments under another user's identity by supplying a target user id in the request body. The flaw affects the POST /api/v1/time/new and POST /api/v1/storage/ticket/:id/upload/single endpoints, which accept a caller-controlled user id without performing any ownership or permission check. Exploitation requires a valid Peppermint account (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N vector), needs no user interaction or non-default configuration, and is limited to integrity tampering - no data disclosure or denial of service is achievable. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Authenticated users can exploit an authorization bypass in ZenTao PMS through 22.6 to read and overwrite other users' comments by iterating sequential action IDs. This IDOR (CWE-639) in action::editComment allows low-privileged users to modify comments on bugs, stories, tasks, and documents in projects and products they cannot access, and view associated content and attachments. No public exploit code or active exploitation has been identified; the assessed CVSS 3.1 base score is 5.3 (moderate), requiring a valid authenticated session.
Missing authorization in the WPdreams Ajax Search Lite WordPress plugin (versions through 4.14.5) allows unauthenticated remote attackers to read access-controlled data, resulting in low confidentiality impact. The vulnerability has a CVSS score of 5.3 and requires no authentication or user interaction; no public exploit identified at time of analysis. Site administrators should update the plugin as soon as a fixed version is available.
Broken object-level authorization (IDOR) in Likeshop through 3.5.1 lets any user who self-registers on the storefront read and modify other customers' after-sale and refund records through the AfterSale API. Supplying another customer's after-sale record id to the detail, goodsInfo, cancel, express, and again actions in server/application/api/controller/AfterSale.php allows an attacker to view refund and order data, cancel pending refunds, overwrite return shipment details, or re-open refused refunds. The only prerequisite is a valid low-privileged authenticated session (PR:L), which the platform effectively hands out via open customer self-registration; no public exploit code has been identified at time of analysis, so this is a genuine but moderate-severity authorization defect rather than a drop-everything emergency.
TaskingAI deployments up to and including version 0.3.0 let an authenticated attacker who holds a valid project API key or console admin login coerce the backend into sending arbitrary HTTP requests by planting an unvalidated OpenAPI servers[0].url in a user-defined action and then executing it with POST /actions/{action_id}/run, which returns up to 64 KiB of the target's response. Rated CVSS:3.1 5.3 (CWE-918 server-side request forgery), the flaw enables reads of loopback services, internal hosts, and cloud metadata endpoints such as 169.254.169.254, so it is best treated as a credentialed-insider or stolen-key risk rather than an unauthenticated internet attack. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical blast radius is bounded by the prerequisite credentials, the backend's network reachability to the target, and the 64 KiB read-back cap.
Missing authorization in the PlanetStudio Payment Gateway WordPress plugin (versions through 1.3.3) allows unauthenticated remote attackers to reach plugin functionality that should be gated behind an access-control or capability check, resulting in limited unauthorized modification of site state rather than data theft or takeover. Because the CVSS vector is PR:N/UI:N with C:N/I:L/A:N, exploitation requires only that the plugin be installed and active on an internet-reachable WordPress site and that the affected endpoint be reachable - no credentials and no victim interaction are needed, though the impact ceiling is low and integrity-only. The plugin has a small deployment footprint, and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a genuine but moderate-priority issue rather than a critical emergency, so remediation should be scheduled rather than treated as an emergency outage.