Remote code execution in the Theme-one The Grid WordPress plugin through version 2.8.1 allows network attackers to inject code or commands via the plugin's grid-generation code path, with the supplied CVSS:3.1 vector indicating AV:N/AC:L/PR:N/UI:N (unauthenticated and no user interaction per the vector, though the exact endpoint and authentication prerequisite should be verified in the Patchstack advisory). The provided vector rates this as 10.0 Critical with full confidentiality, integrity, and availability impact, while our independent assessment adjusts scope from Changed to Unchanged but still considers impact High. No public exploit identified at time of analysis, and no KEV or EPSS data was provided.
Privilege escalation in the Theme My Login plugin for WordPress (versions up to and including 7.2.1) allows unauthenticated attackers to change arbitrary user passwords on multisite installations in certain configurations, leading to account takeover and potential full network compromise. The flaw stems from improper validation of user identity before password updates (CWE-269). Exploitation requires a non-default multisite setup, and no public exploit code is identified at time of analysis; the effective attack complexity is higher than the base CVSS 9.8 score implies due to this configuration dependency.
Cross-site request forgery in the Salon Booking System WordPress plugin (versions before 10.31.9) allows unauthenticated attackers to forge REST API requests in a logged-in administrator's browser by tricking the victim into clicking a crafted link, potentially leading to full site takeover via creation of a new administrator account. The flaw (CWE-352) stems from the plugin discarding WordPress core's nonce check for cookie-authenticated sessions across the entire REST API, so no plugin-specific feature toggle is needed beyond having the vulnerable version installed. Publicly available exploit code exists; EPSS is low at 0.11% (1st percentile), and there is no confirmed active exploitation (CISA KEV).
Unauthenticated account takeover in the WordPress plugin OTP Login & Register Woocommerce (versions before 2.7.3) is possible because the plugin counts one-time-password verification attempts against a value supplied by the client, which an attacker can freely change to reset the counter and brute-force the short numeric login code. Affected are WordPress sites running the plugin with its OTP-based login/registration flow enabled; publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been recorded, and the EPSS score is low at 0.15% (4th percentile). Successful brute-force yields full account takeover without knowing the victim's password, but the attack still requires enumerating a valid account identifier and issuing many requests, which is why the assessed severity is moderate (CVSS 7.4) rather than critical.
Unauthenticated remote peers can query and download patient demographics and medical imagery from dcm4chee-arc-light archives left in their default configuration, because the DICOM listener accepts association requests from calling AE titles that were never registered. An attacker who can reach the archive's DICOM service (commonly TCP 11112) can use C-FIND and C-GET to enumerate and retrieve patient records, and C-STORE to file fabricated studies under an existing patient identity, corrupting the clinical record. Exploitation requires no credentials and no user interaction (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N); no public exploit code and no confirmed in-the-wild exploitation are identified at time of analysis, so the high severity is driven by the confidentiality and integrity impact on protected health information rather than by observed attacks.
Remote authentication bypass in EseeCloud devices lets an unauthenticated attacker log in to the device management/login interface using a credential hard-coded into the product, yielding full control of the device (CVSS 4.0 base 9.3; independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Every condition for exploitation is attacker-friendly: no account, no user interaction, no non-default configuration, and no special network position beyond reachability of the management interface, so internet-exposed or cloud-reachable units are effectively open doors while NAT/firewall-isolated devices are shielded. No public exploit code or confirmed active exploitation (CISA KEV) is identified in the available data at time of analysis, and no EPSS score was provided, but the credential is embedded in the firmware rather than guessed, so the barrier to abuse is low wherever the interface is reachable. The flaw was reported to CISA's ICS-CERT program and published as advisory ICSA-26-288-02 under the Authentication Bypass tag.
SQL injection in the Mobile Builder WordPress plugin (versions through 1.4.2) lets unauthenticated remote attackers read data from the site database, but only on installations that also run the WCFM Delivery add-on, because the vulnerable code path is reachable solely through that plugin combination. Publicly available exploit code exists (reported by WPScan) and no authentication or user interaction is required against a qualifying site; however, the dual-plugin prerequisite sharply limits the attack surface, EPSS is low at 0.19% (8th percentile), and CISA's SSVC framework rates exploitation as none with no automatable path, making this a genuine but secondary-priority issue rather than a top-urgency flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect.
Unauthenticated SQL injection in the WX Subscribe (微信支付付费订阅) WordPress plugin through version 1.2.1 allows remote attackers to read arbitrary database contents when the plugin's WeChat payment key has not been configured. Publicly available exploit code exists, but the EPSS score is very low (0.18%, 7th percentile) and the vulnerable code path is unreachable on installs where the payment key is set, limiting the realistic exploitable population. Our assessment rates confidentiality impact as high with no integrity or availability impact, and scope unchanged, yielding a CVSS base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Authenticated SQL injection in the affiliate-toolkit WordPress plugin before version 3.8.9 allows editor-level users to read arbitrary database contents. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and no active exploitation has been confirmed (not in CISA KEV). The independent assessment rates this as a genuine but moderate-priority issue, not an emergency; on WordPress multisite, a sub-site editor can extract the network-global wp_users table, including the super administrator's password hash, while on single-site installs the attacker needs a valid editor+ account.
Unauthenticated remote attackers can irreversibly delete stored DICOM objects in dcm4chee-arc-light by invoking the storage status-change REST service and setting a location record that is still associated with existing DICOM instances to the TO_DELETE state, after which the PurgeStorageScheduler background job removes the referenced object from storage while the corresponding instance record remains in the database. This missing authorization flaw (CWE-862) is rated CVSS 8.8 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VI:H/VA:H, VC:N) and allows an attacker to corrupt the integrity and availability of the clinical archive without credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
Unauthenticated HL7 ADT^A40 patient-merge messages accepted by the dcm4chee-arc-light archive's default listener let a remote sender reassign studies and related workflow records from one patient identity to another. The CPE lists all versions of the product as affected, and the archive's unmerge operation does not reverse the reassignment, so the integrity damage is effectively persistent. No credentials, user interaction, or non-default settings are required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; vendor CVSS 4.0 8.7); the practical limiting factor is network reachability of the HL7/MLLP port, and no public exploit code or CISA KEV entry was identified at time of analysis.
Remote, unauthenticated attackers can exhaust dcm4chee-arc-light by submitting crafted multipart payloads to its MultipartInputStream parser, which performs inefficient boundary matching and unnecessary buffer copying, driving excessive boundary comparisons and repeated copies that consume CPU and memory until the service slows or becomes unavailable. Every version captured by cpe:2.3:a:j4care:dcm4chee-arc-light:*:*:*:*:*:*:*:* is affected, and the impact is confined to availability (VC:N/VI:N/VA:H) with no confidentiality or integrity effect. No public exploit identified at time of analysis, but exploitation requires only that a multipart-accepting endpoint such as the DICOMweb STOW-RS upload interface be network-reachable to the attacker; the vendor-classified CVSS 4.0 base of 8.7 (High) matches an independent assessment of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Malformed MP4 box-size fields submitted to the MP4Parser component in j4care dcm4chee-arc-light drive the parser into a non-terminating loop that repeatedly reprocesses the same input, consuming CPU and hanging the affected ingestion service. The defect is classified CWE-835 (loop with unreachable exit condition) and is network-reachable and unauthenticated per the CVSS vector (AV:N/AC:L/PR:N/UI:N), so any actor able to reach an archive endpoint that accepts and parses DICOM-encapsulated MP4 media can trigger it; impact is availability-only with no confidentiality or integrity consequence. No public exploit code was identified at time of analysis, and the issue is documented by CISA in ICS medical advisory ICSMA-26-288-02.
JPEGParser in j4care's dcm4chee-arc-light can be driven into an infinite loop by a specially crafted or truncated JPEG-encoded stream delivered to the archive's image/DICOM ingestion path, resulting in a denial-of-service condition (CWE-835). Per the supplied CVSS 4.0 vector the flaw is network-reachable and requires no authentication and no user interaction (AV:N, AC:L, PR:N, UI:N), but the impact is availability-only (VA:H with VC:N/VI:N) - no code execution, data disclosure, or integrity loss is described. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is bounded by network reachability: deployments that expose a JPEG/DICOM parsing endpoint beyond a segmented clinical network are the ones materially at risk.
WordPress sites running the Subscribe to Comments plugin before 2.3.3 expose subscriber management keys to unauthenticated attackers, who can supply a forged or replayed commenter-identifying cookie that the plugin neither signs nor validates, then read a subscriber's management key and silently alter that subscriber's comment-thread subscriptions. Exploitation requires only that a subscriber exists on the target site and that the vulnerable plugin version is active; no authentication (PR:N) or user interaction (UI:N) is needed, and impact is scoped per targeted subscriber rather than site-wide (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists, EPSS is 0.14% (3rd percentile), and no confirmed active exploitation has been reported.
An out-of-bounds write in MariaDB Server's spatial WKT serialization allows an authenticated, low-privileged database user who can execute SQL against a GIS function to corrupt server memory by supplying a deeply nested GeometryCollection to ST_AsText/AsText. Affected builds are MariaDB 10.6.1 through the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (the published score of 9.9 assumes a scope change that the independent assessment does not confirm). There is no confirmation of active exploitation (the issue is not in CISA KEV), but the upstream fix commit contains a public regression test that reproduces the crash and constitutes a working proof-of-concept; the reliable standalone outcome is memory corruption and denial of service, with code execution only achievable in combination with a second vulnerability.
Use-after-free in MariaDB Server's SYS_REFCURSOR handling (12.3.1 through 12.3.2, and the 13.0.x branch before 13.0.2) lets an authenticated, low-privileged database user crash the server and corrupt server memory by declaring and opening more than the default 16 SYS_REFCURSORs inside a stored routine and then fetching from one of them. The flaw is a stale-reference bug in the cursor array: when the array is reallocated to grow beyond its initial 16 slots, routine-context references still point at the freed element, and the resulting use-after-free can be leveraged for remote code execution only when chained with a second, separate vulnerability. Authentication is required (CVSS PR:L, AV:N), and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the vendor CVSS of 9.9 is high, but practical impact is bounded by the narrow affected version range and the need for CREATE ROUTINE/EXECUTE privileges plus a second bug to convert memory corruption into code execution.
Arbitrary code execution in DeepSeek Harness (dsh) at commit c291e796 stems from an untrusted search path weakness, letting an attacker plant a crafted executable in a location dsh consults when resolving content, so that the malicious file is run in place of the legitimate one. Exploitation is not automatic: per our independent assessment the attacker first needs write access to a searched directory (or control of a shared/current working directory) and then must induce a victim to open or run the substituted content, so the realistic vector is local with user interaction (AV:L/UI:R), not the network-facing, no-interaction 10.0 score supplied in the source feed. Publicly available exploit code exists (SSVC exploitation status 'poc', with a PoC repository referenced), the issue is rated fully automatable with total technical impact, and no CISA KEV listing was provided - so this is a proof-of-concept-stage risk rather than confirmed active exploitation.
Unauthenticated privilege escalation in the My Calendar - Accessible Event Manager WordPress plugin (all versions up to and including 3.8.7) allows remote attackers to overwrite the credentials of the default Administrator account (user ID 1) and gain full wp-admin access. The flaw arises from unsanitized reflection of the `mcs` GET parameter into post content, enabling injection of a nested `[my_calendar above=...]` shortcode that is processed by `mc_generate_calendar_nav()`, which calls arbitrary PHP functions via `call_user_func()` without authorization or callable allowlisting. No public exploit code has been identified at time of analysis, but the plugin's auto-generated `/my-calendar/` page is publicly accessible by default, making exploitation trivially reachable by an unauthenticated attacker.
Unauthenticated file upload in the WordPress plugin Mang Board (all versions up to and including 2.4.4) lets an anonymous visitor place executable content on the server and reach remote code execution, because the mbw_file_upload handler enforces its extension allowlist only on the file_name parameter while the filename actually saved is derived from the unvalidated image_path parameter. Exploitation fits the assessed CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N), requiring no WordPress account and no user interaction: guest posting is the plugin's default board mode, and the nonce the request must carry is printed on every public board page and therefore readable by any unauthenticated visitor. No public exploit code has been identified at time of analysis; the practical limiting factor is configuration, since an administrator who has disabled guest posting removes the unauthenticated attack surface.
Unauthenticated arbitrary file upload in the ELEX WordPress HelpDesk & Customer Ticketing System plugin (all versions up to and including 3.3.7) lets a remote attacker write attacker-controlled files, including potentially executable ones, into the WordPress installation via email attachments processed by the initMailPart function, enabling remote code execution with a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No WordPress authentication or victim interaction is required; the only prerequisite is that the plugin's email-piping/IMAP mailbox feature is configured and actively polling an inbox, since the attacker reaches the vulnerable code simply by sending a crafted email to that monitored support mailbox. Exploitation is therefore configuration-dependent rather than universal, and sites that do not use IMAP mail fetching are not exposed; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor fix is available in version 3.3.8.
Unauthenticated PHP object injection in the WordPress plugin Sunshine Photo Cart (all versions up to and including 3.7.4) allows an attacker to store a crafted serialized payload through the plugin's public favorites page, which is then deserialized when any image in a non-viewable or private gallery is viewed. The plugin ships no usable POP gadget chain of its own, so the flaw has no impact on a site running only this plugin; impact materialises only when a separate plugin or theme on the same installation provides a chain, in which case the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit code or confirmed active exploitation was identified at time of analysis, and while the submitted CVSS is 9.8 the mandatory external gadget-chain precondition means our independent assessment rates it AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact when the precondition is met.
Unauthenticated attackers can take over any WordPress user account, including administrators, on sites running the MailOptin plugin up to version 1.2.78.6 that have a 'WordPress User Registration' opt-in form published. The flaw allows manipulation of the optin_data[form_custom_field_mappings] parameter to override saved mappings, enabling injection of arbitrary wp_users column names (e.g., ID, user_pass) into wp_insert_user(), which then updates the target account's password. No authentication, nonce, or capability check is required, and the only prerequisite is the presence of the registration form; sites using MailOptin solely for mailing-list optins without this connection are not affected. No public exploit identified at time of analysis.
Unauthenticated remote attackers can obtain a valid Mage AI session token without possessing a legitimate OAuth credential, because the platform's session-creation endpoint fails to abort when it encounters an unrecognized OAuth provider. An attacker who supplies an arbitrary token plus an unknown provider string - and knows or guesses a valid user's email address - can impersonate that account, or cause new accounts to be created; the most damaging path is impersonating an already-privileged email. Mage OSS through 0.9.80 (prior to commit 76c4f46) is affected, the flaw carries a 9.8 CVSS rating and is classified as CWE-390 (error condition detected but not acted upon); no public exploit code has been identified at the time of analysis.
Out-of-bounds heap reads in the RIOT OS DHCPv6 client (sys/net/application_layer/dhcpv6/client.c) let an attacker who controls, compromises, or spoofs a DHCPv6 server on the same local link crash an embedded device - and potentially expose or corrupt adjacent heap memory - by sending a REPLY whose IA_PD or IA_NA option body is shorter than the structure it is parsed as. Exploitation requires firmware built with MODULE_DHCPV6_CLIENT_IA_PD enabled and the device operating as a DHCPv6 client; no public exploit code was identified at time of analysis, and the issue is fixed in RIOT 2026.07. The upstream 9.8 score (AV:N/C:H/I:H/A:H) is tempered by DHCPv6's link-local scope and the compile-time gating of the vulnerable code path, consistent with the independent assessment of CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H.
Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 lets a remote network attacker reach a backend cache API that lacks authentication and execute injected SQL against the underlying data store, carrying CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, full confidentiality, integrity and availability impact). Exploitation is primarily gated by exposure rather than by attacker capability: the vendor states the issue mainly threatens Kylin services directly reachable from the public internet, which it describes as uncommon, and in-house deployments kept on internal networks are largely unaffected. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.30% (21st percentile).
Remote code execution in WEINVIEW EasyBuilder Pro build v6.10.01.510_20251022 occurs through a buffer overflow in the UtilityManagerEx.exe component when it processes crafted input. Although the published CVSS is 9.8 with a network vector, the assessed vector requires user interaction (UI:R) and higher attack complexity (AC:H) because UtilityManagerEx.exe is a client-side engineering utility that an operator must launch and direct at attacker-controlled data, such as a malicious HMI device or project file. No public exploit was identified at time of analysis, EPSS is low at 0.29% (20th percentile), and the practical impact is concentrated on engineering workstations in OT environments.
SQL injection in the Wheels CFML framework through 4.1.2 lets remote attackers manipulate SQL statements when an application feeds request data into inline-literal query paths - opt-in parameterize=false queries, IN lists, and developer-written where strings at positions the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. The flaw is reachable unauthenticated over the network (CVSS 3.1 9.8, PR:N) but only materialises on MySQL or MariaDB backends running with the default backslash-escaping behaviour (NO_BACKSLASH_ESCAPES absent), and only where the developer has constructed the vulnerable query form; bound/parameterized queries and whereBetween() as of 4.1.2 are not affected. No public exploit code or confirmed active exploitation was identified at time of analysis. The issue is fixed in Wheels 4.2.0.
Authentication bypass in Apache Kylin 4.0.4 through 5.0.4 allows unauthenticated network attackers to reach protected functionality when the Kylin web/REST service is directly exposed, with the 9.8 CVSS vector indicating high confidentiality, integrity, and availability impact. EPSS is just 0.25% (15th percentile) and no public exploit code was identified at time of analysis, while the vendor emphasizes that typical internal-only Kylin deployments are mostly not impacted and that public exposure of Kylin services is uncommon. The practical risk is therefore driven primarily by network exposure rather than by the headline score.
Unauthenticated access control bypass in Apache Kylin 4.0.0 through 5.0.4 allows network-reachable attackers to invoke the platform's normally protected system cleanup actions without any credentials, giving them integrity and availability impact against the Kylin service (CWE-287; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N with I:H/A:H). The vendor emphasizes that only Kylin instances directly exposed to the public internet are materially at risk and that typical in-house/internal deployments are mostly not impacted, so exposure is governed by network reachability rather than by any configuration toggle. EPSS is low at 0.25% (15th percentile) and no public exploit code has been identified at time of analysis; there is no KEV listing.
Text::CSV_XS before 1.65 can inject a spurious 0xFF byte into parsed data when parse() is given a string ending in a field separator followed by a lone CR and the final field is empty, causing corrupted field values or malformed UTF-8. This affects the in-memory string parsing API in the Perl module, and an attacker who controls CSV input could alter application data integrity but cannot achieve code execution, confidentiality loss, or availability impact through this defect alone. No public exploit was identified at time of analysis, EPSS is 0.19% (8th percentile), and the independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
CSV record splitting in Text::CSV_XS before 1.65 allows an attacker-controlled field that has been used in a numeric context to be serialized without quotes, so an embedded newline, carriage return, or delimiter can terminate the record early and turn the remaining fields into a separate row. The flaw is limited to the combine()/print() write path in binary mode (the default) and requires the attacker to control that specific field plus the application to perform a numeric operation on it before serialization; the assessed vector is network-reachable but high-complexity, unauthenticated, with integrity-only impact. No public exploit was identified at time of analysis, and EPSS is 0.19% (8th percentile), indicating low predicted exploitation activity despite the serious record-splitting consequence.
Text::CSV_XS versions before 1.65 for Perl silently corrupt the final record written with print() when a UTF-8 flagged (decoded) field is followed by a field ending in bytes that are not valid UTF-8: the held-back trailing byte, any closing quote, and the line ending are never flushed, yet print() still returns true. The practical result is fused records - the next record lands on the same line, or, in the quoted case, the missing close quote makes downstream readers absorb every following row into that field - an integrity impact on generated CSV rather than code execution. According to CISA KEV no active exploitation is confirmed and no public exploit code was identified at time of analysis; EPSS is 0.19% (8th percentile), and the reported 9.8 AV:N/AC:L vector is not supported by the exploitation prerequisites, which require a specific mixed-encoding data condition.
A use-after-free in the Perl XS module Text::CSV_XS (versions 1.46 through 1.64) lets attacker-supplied CSV content crash the parsing process when an application combines three specific features: bind_columns(), the non-default skip_empty_rows option (or its 'eof' mode), and input containing an empty line. The defect drops a reference from the caller's bound scalar while it is still in use, so subsequent application code touches freed memory and typically aborts - the independent assessment scores this as availability-only impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the headline 9.8, because the vulnerable code path never runs under default configuration. EPSS is low at 0.19% (8th percentile), no public exploit code was identified at time of analysis, and no CISA KEV entry exists; a vendor patch is available in Text::CSV_XS 1.65.
Apache Answer through 2.0.2 fails to enforce content-visibility controls in its reaction API, allowing remote unauthenticated attackers to read reaction metadata from restricted content and to add or remove their own reactions. The assessed impact is limited to reaction confidentiality and integrity-attackers cannot alter the protected content, manipulate other users' reactions, or affect availability-despite the input's 9.8 base score. No public exploit code has been identified at time of analysis, and the vendor recommends upgrading to 2.0.3.
Unauthenticated remote command execution inside containers managed by Dockhand (Finsys) affects all versions prior to 1.0.34: the WebSocket upgrade request for the in-browser terminal endpoint /api/containers/<id>/exec is served without any authentication check, so an attacker who can reach the instance and knows a running container ID can open a raw terminal session and run commands inside that container. No authentication is required (CVSS:3.1/PR:N, CWE-306), and the S:C/C:H/I:H/A:H scoring reflects realistic container-to-host escalation when the target container is privileged or exposes sensitive host mounts such as the Docker socket; exploitation is constrained in practice because the attacker must know or enumerate a specific container ID and the target must have an interactive shell. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the pre-auth nature and high EPSS-relevant profile make the issue high priority; a vendor-released patch exists in version 1.0.34.
Stored cross-site scripting in the Audit Logs component of Crafty Controller (the crafty-4 project by Arcadia Technology, LLC) allows an unauthenticated remote attacker to plant script payloads through attacker-influenced HTTP header values that the panel writes into its audit entries, with the payload executing in the browser of a privileged administrator who later opens the Audit Logs view. Per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), the planting step requires no authentication, but realistic impact depends on the web interface being reachable from the attacker's network path and on an administrator actually viewing the poisoned log entry, which is the primary limiting factor. No public exploit identified at time of analysis, no CISA KEV listing is present in the supplied data, and no EPSS score was provided; exact affected and fixed versions are not stated in the available data.
Memory corruption in RIOT OS (versions prior to 2026.04) with the ATWINC15x0 Wi-Fi driver and MODULE_ATWINC15X0_DYNAMIC_CONNECT enabled allows an adjacent unauthenticated attacker to trigger a buffer overflow by advertising a malformed or oversized SSID, potentially leading to a hard fault, denial of service, or code execution. Exploitation requires the device to perform a Wi-Fi scan and the attacker to be within radio range. No public exploit code has been identified at time of analysis, and the vendor has released a patch in version 2026.04.
Server-side request forgery in bitcoinj 0.17 and earlier allows an attacker who can supply or influence a BIP70-style payment request to force the host to issue outbound HTTP connections to an attacker-chosen endpoint by manipulating the pki_type argument handled by PaymentSession.java. Only applications that actually parse payment requests through the Payment Request Handler are exposed, so deployments that never process BIP70 messages are not affected; remote, unauthenticated exploitation is possible with publicly available exploit code exists, though the impact is bounded to low confidentiality, integrity, and availability loss rather than code execution. The bitcoinj project was notified via an issue report but has not responded, and no vendor-released patch has been identified at time of analysis.
Heap buffer overflow in GPAC MP4Box 2.4's sample-size table write path (stbl_AddSize in isomedia/stbl_write.c) allows a crafted MP4 file to crash the process, causing denial of service. Exploitation is local and requires user interaction to open the crafted file, with no confidentiality or integrity impact; a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.18% (percentile 8%).
Missing authentication in LangChat lets unauthenticated remote attackers reach the application's REST controllers, because a default deployment up to commit 2a6285a never registers a Sa-Token interceptor. Calling endpoints such as /api/v1/auth/users returns user records containing plaintext passwords, and the same absent authorization check lets an attacker read LLM provider API keys, create super-admin accounts, and modify or delete stored data. The independent assessment scores this 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) with no special conditions beyond network reachability; the technical detail is publicly documented, but no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status.
Missing authorization in the Squeeze WordPress plugin before 1.8.1 lets any authenticated user with a role as low as Subscriber revert arbitrary media attachments to their stored backup copies and then permanently delete both those backups and the plugin-generated WebP derivatives, regardless of attachment ownership. The flaw is remotely reachable with low privileges (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:N, producing only low integrity and availability impact with no confidentiality impact), and publicly available exploit code exists via a WPScan exploit reference; there is no KEV entry or other confirmation of active exploitation. Practical exposure is confined to sites that permit open registration or otherwise allow untrusted users to hold at least a Subscriber account.
Unauthenticated configuration write in Misaka Danmu Server 2.8.9 and earlier allows remote attackers to bypass authentication entirely and gain administrative access by abusing the unprotected POST /api/ui/config-history/rollback endpoint. An attacker can write arbitrary configuration keys, such as setting ipWhitelist to their own /32 address, modifying trustedProxies, or altering webhookApiKey, which then grants access to every protected endpoint as the administrator. The flaw carries a critical severity rating (CVSS 4.0 base score 9.3; independent assessment confirms a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and requires only network reachability of the web API - no authentication, user interaction, or non-default configuration is needed. No public exploit identified at time of analysis.
Authentication bypass in Simple Admin Core through v1.8.7 lets unauthenticated remote attackers forge a valid super-administrator JWT by signing it with the hard-coded Auth.AccessSecret (jS6VKDtsJf3z1n2VKDtsJf3z1n2) shipped in api/etc/core.yaml, then set roleId 001 to obtain full administrative control over users, roles, menus, API authorities, configuration and token issuance. Exploitation requires only network reach to the core API (default port 9100) against a deployment that still runs the vendor's default secret - no credentials and no user interaction - and the CVSS 4.0 base score is 9.3, corroborated by the independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (unauthenticated, network-exploitable, full confidentiality/integrity/availability impact). No public exploit identified at time of analysis, although a public technical writeup detailing the bypass exists, and deployments that rotated AccessSecret to a private value before deployment are not exploitable via forged signatures.
DataBuff ai-apm-web through 0.1.10 ships with a hard-coded administrator account (admin / Databuff@123), allowing unauthenticated remote attackers to POST those credentials to /webapi/api/v1/auth/login and receive an administrator token. That token grants access to all protected /webapi routes, yielding full confidentiality, integrity, and availability impact on affected deployments. No public exploit identified at time of analysis, but exploitation is trivial if the built-in admin password remains default and the login endpoint is network-reachable; independent assessment finds this a genuine high-priority issue, not an inflated-CVSS artifact.
Blind SQL injection in the halfdata Green Popups WordPress plugin before 7.6.3 lets a remote attacker inject crafted SQL through an HTTP request and extract data from the site's database one inferred bit at a time. The vendor (Patchstack) rates this 9.3 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, indicating network reachability, low complexity, a scope change, and high confidentiality impact, while our independent assessment scores it 9.3 as well but with PR:L instead of PR:N - meaning the true privilege prerequisite is not confirmed from the available data and pre-authentication exploitability cannot be assumed. There is no CISA KEV entry and no public exploit code identified at time of analysis, so this should be treated as a serious but not confirmed actively exploited issue; because it is blind, extraction is inference-based and slower than direct-output injection but still permits theft of user, configuration, and credential-adjacent data.
Unauthenticated SQL injection in TSG Profleet allows remote attackers to fully compromise the application's database via a crafted GET request to the '/cgi-bin/index.php' endpoint using the 'Identificación' parameter. The flaw requires no authentication, user interaction, or special configuration, and affects all versions of the product according to the CPE. No public exploit code or active exploitation has been observed at time of analysis, but the high CVSS score (9.3) and potential for data theft, modification, or deletion make it a critical risk for exposed instances.
Unauthorized booking creation in the Salon Booking System WordPress plugin before 10.31.9 allows unauthenticated remote attackers to forge bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment being made. The flaw is a missing authorization check (CWE-862) reachable over the network with no authentication or user interaction required (CVSS 3.1 base 5.3 MEDIUM, integrity-only impact). Publicly available exploit code exists, EPSS is low at 0.15% (3rd percentile), and a vendor patch (10.31.9) is available.
Unauthenticated information disclosure in the Document Gallery WordPress plugin through 5.1.1 lets any remote visitor generate a gallery on demand and read back the titles, descriptions, and direct file URLs of media attached to unpublished, private, or trashed posts. Because the on-demand gallery path performs no capability or ownership check, the issue is reachable on default installations with no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3); publicly available exploit code exists, so scanning and opportunistic abuse are plausible, although no confirmed active exploitation (CISA KEV) has been recorded and EPSS puts likelihood low at roughly 0.14% (3rd percentile). Impact is bounded: the leak is confidentiality-only and data-dependent - sites that keep no sensitive media attached to drafts, private, or trashed content expose little of consequence, which is why our independent assessment rates this as a genuine but moderate-severity flaw rather than a critical priority.
Unauthenticated remote attackers can read the webhook authentication secret exposed by the Coinsnap Bitcoin Crowdfunding WordPress plugin (versions through 1.2.0) and use it to forge payment-confirmation callbacks, recording arbitrary donations as completed with attacker-chosen amounts, donor names and messages. Exploitation requires no authentication, privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3), but it is limited to sites that have this specific crowdfunding plugin installed and active with its Bitcoin payment-gateway webhook in use, and the impact stays within falsified donation records rather than server compromise or sensitive-data theft. Publicly available exploit code exists and WPScan published a dedicated vulnerability entry, while EPSS remains low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV).