Cross-site request forgery in the Salon Booking System WordPress plugin (versions before 10.31.9) allows unauthenticated attackers to forge REST API requests in a logged-in administrator's browser by tricking the victim into clicking a crafted link, potentially leading to full site takeover via creation of a new administrator account. The flaw (CWE-352) stems from the plugin discarding WordPress core's nonce check for cookie-authenticated sessions across the entire REST API, so no plugin-specific feature toggle is needed beyond having the vulnerable version installed. Publicly available exploit code exists; EPSS is low at 0.11% (1st percentile), and there is no confirmed active exploitation (CISA KEV).
Unauthenticated account takeover in the WordPress plugin OTP Login & Register Woocommerce (versions before 2.7.3) is possible because the plugin counts one-time-password verification attempts against a value supplied by the client, which an attacker can freely change to reset the counter and brute-force the short numeric login code. Affected are WordPress sites running the plugin with its OTP-based login/registration flow enabled; publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been recorded, and the EPSS score is low at 0.15% (4th percentile). Successful brute-force yields full account takeover without knowing the victim's password, but the attack still requires enumerating a valid account identifier and issuing many requests, which is why the assessed severity is moderate (CVSS 7.4) rather than critical.
Unauthenticated remote attackers can irreversibly delete stored DICOM objects in dcm4chee-arc-light by invoking the storage status-change REST service and setting a location record that is still associated with existing DICOM instances to the TO_DELETE state, after which the PurgeStorageScheduler background job removes the referenced object from storage while the corresponding instance record remains in the database. This missing authorization flaw (CWE-862) is rated CVSS 8.8 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VI:H/VA:H, VC:N) and allows an attacker to corrupt the integrity and availability of the clinical archive without credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
Unauthenticated HL7 ADT^A40 patient-merge messages accepted by the dcm4chee-arc-light archive's default listener let a remote sender reassign studies and related workflow records from one patient identity to another. The CPE lists all versions of the product as affected, and the archive's unmerge operation does not reverse the reassignment, so the integrity damage is effectively persistent. No credentials, user interaction, or non-default settings are required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N; vendor CVSS 4.0 8.7); the practical limiting factor is network reachability of the HL7/MLLP port, and no public exploit code or CISA KEV entry was identified at time of analysis.
Remote, unauthenticated attackers can exhaust dcm4chee-arc-light by submitting crafted multipart payloads to its MultipartInputStream parser, which performs inefficient boundary matching and unnecessary buffer copying, driving excessive boundary comparisons and repeated copies that consume CPU and memory until the service slows or becomes unavailable. Every version captured by cpe:2.3:a:j4care:dcm4chee-arc-light:*:*:*:*:*:*:*:* is affected, and the impact is confined to availability (VC:N/VI:N/VA:H) with no confidentiality or integrity effect. No public exploit identified at time of analysis, but exploitation requires only that a multipart-accepting endpoint such as the DICOMweb STOW-RS upload interface be network-reachable to the attacker; the vendor-classified CVSS 4.0 base of 8.7 (High) matches an independent assessment of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Malformed MP4 box-size fields submitted to the MP4Parser component in j4care dcm4chee-arc-light drive the parser into a non-terminating loop that repeatedly reprocesses the same input, consuming CPU and hanging the affected ingestion service. The defect is classified CWE-835 (loop with unreachable exit condition) and is network-reachable and unauthenticated per the CVSS vector (AV:N/AC:L/PR:N/UI:N), so any actor able to reach an archive endpoint that accepts and parses DICOM-encapsulated MP4 media can trigger it; impact is availability-only with no confidentiality or integrity consequence. No public exploit code was identified at time of analysis, and the issue is documented by CISA in ICS medical advisory ICSMA-26-288-02.
JPEGParser in j4care's dcm4chee-arc-light can be driven into an infinite loop by a specially crafted or truncated JPEG-encoded stream delivered to the archive's image/DICOM ingestion path, resulting in a denial-of-service condition (CWE-835). Per the supplied CVSS 4.0 vector the flaw is network-reachable and requires no authentication and no user interaction (AV:N, AC:L, PR:N, UI:N), but the impact is availability-only (VA:H with VC:N/VI:N) - no code execution, data disclosure, or integrity loss is described. No public exploit code and no confirmed active exploitation were identified at time of analysis, and realistic risk is bounded by network reachability: deployments that expose a JPEG/DICOM parsing endpoint beyond a segmented clinical network are the ones materially at risk.
Authenticated path traversal in Thermo Fisher Torrent Suite Software lets a user who already holds a valid low-privilege session on the Torrent Server web interface read arbitrary files that are accessible to the web service account. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), impact is confidentiality-only - no write, integrity, or code-execution effect - and the readable scope is bounded by the filesystem permissions of the web service account, so it cannot reach files that account cannot access. No public exploit code or confirmed active exploitation was identified at time of analysis, and the authentication prerequisite confines realistic risk to insiders or attackers who have already obtained credentials; this is a moderate-priority information-disclosure issue rather than a critical emergency. CISA published an ICS medical advisory (ICSMA-26-288-01) covering this flaw.
Authenticated OS command injection in the WP Photo Album Plus WordPress plugin (all versions up to and including 9.3.02.002) lets any WordPress user granted the plugin-defined wppa_upload capability execute arbitrary operating-system commands as the web-server user, achieving full server-side code execution where ImageMagick is the active image backend. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is reachable through the update-photo AJAX action's value parameter, and no public exploit code was identified at time of analysis; the bug is not in CISA KEV. Because wppa_upload is a plugin-level privilege that administrators can delegate to lower-privileged roles, the effective attacker pool can extend well beyond site administrators on misconfigured sites.
OS command injection in Apache Kylin 4.0.4 through 5.0.4 lets a remote attacker who holds valid low-privilege credentials (CVSS PR:L, UI:N) execute arbitrary operating system commands on the Kylin host, with high confidentiality, integrity and availability impact under an 8.8 base score. The vendor is explicit that meaningful exposure requires the Kylin service to be directly reachable from the public network, an uncommon configuration, and that typical in-house deployments are mostly unaffected. EPSS is only 1.03% (63rd percentile) and no public exploit code or CISA KEV listing was identified at time of analysis, so the realistic priority is lower than the raw CVSS suggests, and exploitation is not confirmed in the wild.
Remote code execution via arbitrary file upload affects the YaySMTP WordPress plugin in all versions up to and including 2.7.7, where an authenticated subscriber-level user can upload executable files through the putFile function. The plugin relies on sanitize_file_name() without an allow-list, MIME check, or safe-extension rename, and its only server-side guard is a .htaccess file with 'Require all denied' that nginx and Apache with AllowOverride None ignore, so full RCE is achievable on those configurations. No public exploit code was identified at time of analysis and there is no confirmed CISA KEV active exploitation; exploitation requires authentication at subscriber level or above, which is commonly available when open user registration is enabled.
Authenticated low-privileged users on MariaDB Server can hijack any account they can name, because GRANT PROXY mis-evaluates grantor privileges when the statement carries an IDENTIFIED (VIA) clause with an empty password. Under those conditions the server treats the statement as though no authentication clause had been supplied, checks the wrong grantor's rights, and lets the attacker set the target account's password - so an ordinary login can be escalated to full control of a privileged account. All builds from 10.6.1 up to the fixed releases 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2 are affected; no public exploit identified at time of analysis, and no user interaction is required (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Arbitrary file upload in the DoubleScale All-in-One CRM WordPress plugin through version 1.5.1 allows authenticated attackers with subscriber-level access or higher to upload executable PHP files when the Helpdesk module is enabled, which can lead to remote code execution. The flaw is an unrestricted upload issue (CWE-434) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis. The assessed exploitation conditions require both a valid low-privilege WordPress account and an active Helpdesk module, making the risk highest on sites that allow open user registration.
Authenticated OS command injection in ZoneMinder versions prior to 1.38.3 allows a low-privilege user holding View Events or View Snapshots permission to run arbitrary operating system commands as the web server user. The flaw lives in exportEvents() in web/skins/classic/includes/export_functions.php, where the attacker-controlled exportFile request parameter is appended to a tar or zip command executed via exec() without shell escaping, so a crafted value can break out of the trailing directory argument. Exploitation requires a valid session (CVSS PR:L), a valid CSRF token for the export request, and the exportDetail option enabled; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV), though the vendor's own GHSA advisory and fix commits confirm the issue is real and the EPSS-style risk is elevated by the low privilege threshold and high confidentiality, integrity, and availability impact (CVSS 8.8).
Authenticated attackers with Subscriber-level or higher PilotPress membership on WordPress sites can escalate to full Administrator privileges by exploiting a flawed ONTRAPORT synchronization routine in PilotPress versions up to and including 2.0.43. The defect allows an attacker to rename a remote ONTRAPORT contact to an existing Administrator's WordPress login, then leverage the plugin's authentication hook to cause WordPress core to issue an Administrator authentication cookie. This is a genuine high-priority vulnerability (CVSS 8.8), requiring a valid ONTRAPORT contact and the Customer Center nonce, but no victim interaction. No public exploit code was identified at time of analysis.
Authentication bypass in ZKEACMS through 4.4 allows unauthenticated remote attackers to forge their own admin-level REST API JSON Web Tokens, because the HMAC-SHA256 key used to validate bearer tokens is hard-coded in JwtBearerDefaults.cs and is therefore identical on every installation. An attacker who signs a token with the Name claim set to 'admin' can call ApiAuthorize endpoints to modify articles and products and to read submitted form data, producing high integrity impact with limited confidentiality exposure (vendor CVSS 4.0 score 8.8; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, i.e. unauthenticated and network-reachable). Neither CISA KEV nor a packaged exploit was reported in the provided intelligence, but the signing key is published in the project's public source repository and a public write-up describes the technique, so forgery is trivial for anyone who can reach the API; the main practical limiter is whether the REST API is exposed.
Unauthenticated configuration takeover of ChronoFrame 1.0.0 and earlier lets any attacker who can reach the HTTP service POST to the setup-wizard API and repoint instance storage to an attacker-controlled S3 or OpenList backend while overwriting site and map settings. The flaw covers every release through 1.0.0 (CPE cpe:2.3:a:hoshinosuzumi:chronoframe:*:*:*:*:*:*:*:*) and remains exploitable on instances where initial setup is already complete, because the /api/wizard/ handlers enforce neither authentication nor a setup-complete check. No public exploit identified at time of analysis and no CISA KEV entry, though a public technical writeup describes the attack path; the independent assessment (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) rates this high priority for any network-exposed deployment.
Delegated 'users:update' permission in Arcane (getarcaneapp/arcane) 2.5.0 and earlier allows an authenticated holder of that permission to overwrite the global administrator's password via PUT /users/{adminId} and then authenticate as the admin, achieving complete administrator account takeover. The UpdateUser handler (backend/api/handlers/users.go:317-323) and the underlying user service (user_service.go:174) set the target user's PasswordHash from the request body and Save unconditionally, with no comparison of caller privilege against target privilege, even though users:update is deliberately intended to sit below the RequireGlobalAdmin-gated role assignment and role CRUD operations. Exploitation is remote, requires no user interaction, and needs no extra configuration beyond the precondition that an administrator has created a custom role (e.g. 'User Manager') containing users:update and assigned it to the attacker's account; deployments that never delegate that permission are not exposed, and no public exploit was identified at time of analysis (CVSS 8.8, PR:L).
Code injection in Apache Kylin 4.0.0 through 5.0.4 allows an authenticated low-privilege user who can supply or influence a JDBC connection URL to inject a crafted special parameter and execute arbitrary code. The vendor limits practical exposure to Kylin services directly reachable from the public network, noting that in-house deployments are mostly unaffected; no public exploit code has been identified at time of analysis and EPSS is low at roughly 0.23%.
Prompt injection in DeepSeek Harness (dsh), at commit c291e796, allows attacker-crafted external content to hijack the harness's context-compaction feature so that malicious instructions are executed when that content is summarized and compacted into the working context. Exploitation requires the victim to run the harness and cause compaction to process the attacker-controlled material (UI:R), but no privileges are needed by the external-content attacker (PR:N), and successful abuse can compromise confidentiality, integrity and availability of the developer's session and its tooling at CVSS 3.1 8.8. Risk is tempered by context: this is an early-stage developer tool identified only at commit level, EPSS is 0.16% (4th percentile), and no public exploit or KEV entry was identified at time of analysis.
OS command injection in ZoneMinder allows an authenticated user holding monitor-create or monitor-edit permission to execute arbitrary commands as the web server user by saving a Local-type monitor whose Device Path field contains shell metacharacters. The malicious stored Device value is later interpolated into shell commands in both Perl (qx()/backticks via zmdc.pl control paths and zmpkg.pl start/restart) and PHP (zmc daemon control helpers that relied on bypassable escapeshellcmd) when the monitor control or startup path runs. The issue is fixed in 1.39.2, 1.38.2, and 1.36.40, which reject any Device value not matching a strict /dev/ path pattern; no public exploit code has been identified at time of analysis, and exploitation is not confirmed actively exploited (KEV).
Privilege escalation in the ELADMIN (eladmin-mp) role management module through version 2.7 lets an authenticated non-admin user whose role has been delegated the `roles:edit` permission rewrite the menu set attached to its own role by calling PUT /api/roles/menu, because the endpoint only compares the target role's level with the caller's minimum level and never verifies that the caller is not editing itself or that the submitted menu ids are legitimate. No user interaction is needed, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) reflects high confidentiality and integrity impact on the application's role and menu authorization model, since the attacker can expand its own access by granting arbitrary menu permissions. The sole prerequisite is possession of the delegated `roles:edit` permission, which is a genuine but limited barrier; no public exploit code or confirmed active exploitation was identified at the time of analysis.
Cross-site request forgery in the aThemeArt Theme Helper WordPress plugin (all versions up to and including 1.0.8) allows a remote attacker with no credentials of their own (CVSS:3.1/AV:N/AC:L/PR:N) to induce a logged-in privileged WordPress user - typically an administrator - to submit a forged request to the site, causing state-changing plugin actions to execute with the victim's authority. The flaw is a missing CSRF token check (CWE-352); the forged action is limited to operations the plugin exposes without nonce validation, and exploitation hinges on the victim having an active authenticated session and being tricked into interacting with attacker-supplied content (UI:R). A Patchstack advisory is the only public reference, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Note that the supplied CVSS 3.1 vector (8.8, C:H/I:H/A:H) is more severe than our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L), which reflects that impact is bounded by the victim's privilege level and by which nonce-less plugin endpoints exist.
Privilege escalation in Rdiffweb lets any authenticated user promote themselves to administrator by sending a crafted POST request to the /api/users/{username_or_id} user-management endpoint with the 'role' parameter altered to an administrative value. The flaw is a missing authorization check (CWE-862) on a state-changing API route, rated CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) because it requires only a valid low-privilege account and no user interaction while yielding full confidentiality, integrity and availability impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exposure is greatest on instances that allow self-registration or loosely provision accounts, since any such account can be turned into full administrative control.
Unauthenticated JDBC URL injection in the AllData data-dts component through version 0.7.1 allows any remote attacker who can reach the /jobJdbcDatasource/test endpoint to force the server to open an arbitrary database connection by supplying attacker-controlled jdbcUrl and jdbcDriverClass values. By pointing that URL at an attacker-hosted MySQL server with allowLoadLocalInfile=true, an attacker can abuse MySQL's LOCAL INFILE handling to read files from the data-dts host, giving high confidentiality impact (VC:H, VI:N, VA:N per our assessment) with no authentication required (PR:N, CWE-306). No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; risk is concentrated in deployments where data-dts is network-exposed, and disclosure is limited to files readable by the data-dts process account.
Unauthenticated SQL injection in IceCMS (Thecosy IceCMS) through 4.1.5 lets any remote attacker who can reach the /WebResource/findresourcebynum endpoint read arbitrary data from the backend database by supplying a crafted 'num' path parameter. The parameter is concatenated after the SQL LIMIT clause via MyBatis-Plus QueryWrapper.last() with no parameterization, so union-based or blind injection can be used to exfiltrate table contents. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) - no data modification, denial of service, or code execution - and no authentication, user interaction, or non-default configuration is required. The issue is not listed in CISA KEV and no confirmed active exploitation has been reported, but a detailed public write-up of the injection point exists, making the flaw straightforward to reproduce against network-reachable instances.
Denial of service in mz-automation libIEC61850 prior to 1.6.2 allows an unauthenticated remote peer to exhaust CPU indefinitely by sending a malformed ACSE AARE PDU during association establishment. The bug is an out-of-bounds read (CWE-125) in parseUserInformation when a truncated long-form BER length makes BerDecoder_decodeLength return a negative position that is not validated, leading to a buffer[-1] access and a parse-reset loop; a process abort is possible only when the preceding byte lies on an inaccessible memory page, making that outcome memory-layout dependent. No public exploit code or active exploitation was identified at time of analysis, and the assessed impact is availability only (CVSS 3.1 7.5), not code execution or data disclosure.
Unauthenticated memory exhaustion in the FreeRDP server-side component (3.0.0 through 3.31.x) allows a remote attacker to drive the process toward out-of-memory failure by completing a TLS handshake and then streaming bytes that do not begin with the DER SEQUENCE tag 0x30, which causes parse_nla_mode_pdu to grow the receive buffer without bound before NLA authentication ever completes. No credentials, user interaction, or non-default feature flag are required, but the attack surface is limited to hosts running a FreeRDP-based server with TLS reachable on its listening port; the far more common client role is not affected. Impact is availability-only (no code execution, no data disclosure), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Heap out-of-bounds write in FreeRDP before 3.32.0 allows a malicious RDP server to corrupt a connecting client's memory by sending crafted RDPGFX AVC444 or AVC444v2 frames, potentially enabling code execution through heap corruption. The flaw is in general_LumaToYUV444 and general_ChromaV2ToYUV444 and triggers when an odd-height region rectangle ends exactly at the surface height, causing writes past the U/V planes. Exploitation requires the victim's client to initiate or accept an RDP session with an attacker-controlled or compromised server and negotiate the affected H.264 YUV444 codec; no public exploit identified at time of analysis, and clients limited to trusted RDP hosts face substantially lower realistic risk.
Unauthenticated attackers with network reachability to the Boa-based web management interface of a Netcore NR256CN router (firmware through 1.5.140116) can crash the device's main Boa process by sending a Basic Authorization header whose base64-decoded value contains no colon separator - for example a value that decodes to a single character - to an auth-protected CGI route such as /router/get_user_type.cgi. The outcome is a denial of service that terminates the management interface until the web server process is restarted; per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) there is no confidentiality or integrity impact and no code execution, and real-world risk is bounded by whether the management interface is reachable outside the LAN. No vendor patch is identified in the available data and no public exploit code is confirmed at time of analysis, though the trigger itself is trivially crafted once the interface is reachable.
Remote unauthenticated denial of service in rust-libp2p Gossipsub affects versions prior to 0.49.5 and allows any peer that can reach a Gossipsub listener to repeatedly send novel GRAFT topic hashes. The handler unconditionally records those attacker-supplied topics in the per-peer connected_peer.topics map, so memory grows cumulatively without being bounded by subscription filters, peer scoring, or per-message size limits, eventually exhausting process memory and taking the node down. No public exploit identified at time of analysis; the issue is availability-only (CVSS 4.0 8.7 / assessed CVSS 3.1 7.5), and reachability of the Gossipsub listener is the practical prerequisite.
Missing authorization in LingGuo-Drama through commit 8a6924a allows any authenticated self-registered user to fully manage all accounts via the /admin/v1/admins API. The API trusts any valid AuthAdminJWT without verifying the caller's authority level, enabling attackers to read every account's bcrypt hash, reset the bootstrap administrator's password, raise their own authority_id, and delete accounts. This is a genuine, high-priority access-control flaw (CVSS 8.7) with no public exploit identified at time of analysis; exploitation requires only that self-registration is enabled and the service is network-accessible.
Heap out-of-bounds write in FreeRDP's Apple audio-input (audin) backends affects macOS and iOS clients running versions 3.29.0 through 3.31.x, where a malicious or compromised RDP server can send an audin Open PDU with FramesPerPacket set to 2^30 to wrap a UINT32 buffer-size calculation and corrupt the heap. The vulnerable server interaction is unauthenticated from the RDP perspective (CVSS PR:N), but exploitation depends on the victim actively initiating an RDP session in which audio-input redirection is negotiated, so there is no drive-by or server-side vector and only Apple builds using audin_mac.m or audin_ios.m are exposed. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (CISA KEV).
Unauthenticated attackers can export all users' chat logs from 99AI 4.3.0 and earlier by sending a POST request to the /api/chatLog/exportExcel endpoint, which lacks any authentication guard (CWE-306). The vulnerability allows remote retrieval of xlsx files containing usernames, emails, prompts, and AI answers without credentials or user interaction, and affects any network-reachable instance with no special configuration. No public exploit code has been identified at time of analysis, but the exposure is high-risk because it leaks sensitive conversation data.
An insecure direct object reference (IDOR) in ChatOllama (sugarforever/chat-ollama) through commit 96c3ce5 lets remote attackers read other users' private knowledge bases by supplying sequential integer identifiers. According to the supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H with no integrity or availability impact, base 8.7), the exposure is a network-reachable, low-complexity, read-only disclosure that requires no privileges or user interaction, although defenders should confirm whether their deployment actually enforces authentication in front of the API. Affected endpoints are GET /api/knowledgebases/{id} and the knowledgebaseId parameter of POST /api/models/chat; the impact is limited to metadata and retrieved document content of other tenants, with no write or denial-of-service component. No public exploit code or confirmed active exploitation was identified at time of analysis; the primary risk driver is the predictable, non-tenant-scoped ID space rather than a remotely weaponized exploit.
Unauthenticated SQL injection in Thecosy IceCMS through 4.1.5 allows remote attackers to read arbitrary database contents by appending crafted SQL after the LIMIT clause that is concatenated into a MyBatis-Plus QueryWrapper for the num path parameter of /WebArticle/findarticlesbynum. Exploitation requires no authentication, no user interaction, and no special conditions beyond network reachability of the endpoint (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5); the supplied CVSS 4.0 vector scores 8.7 with the same confidentiality-only impact. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, though a public technical write-up describing the injection point is referenced, so exposure should be treated as a genuine high-priority data-disclosure risk for internet-facing instances that have not moved past 4.1.5.
Privilege escalation in EFAK (Eagle for Apache Kafka) through 5.1.0 lets any authenticated low-privilege user grant themselves ROLE_ADMIN, create new administrator accounts, or delete existing users by sending POST, PUT, or DELETE requests to the /api/users endpoints, which are handled by UserController but never restricted to administrators by WebSecurityConfig. Exploitation is not pre-authentication and requires a valid low-privilege EFAK account (CVSS PR:L), but there is no user-interaction requirement and standard configurations are affected; no public exploit identified at time of analysis. Success yields full administrative control over the Kafka clusters that EFAK manages, with high confidentiality, integrity, and availability impact, and urgency rises sharply in deployments allowing self-registration or shared low-privilege logins.
Privilege escalation in FastapiAdmin through version 3.0 allows any remote attacker who can reach the API to self-register a low-privileged account and then forge an HS256 JWT that impersonates the superuser, gaining full administrative control of the application. The flaw stems from a hard-coded JWT signing secret shipped in backend/app/config/setting.py (line 67), which lets an attacker sign arbitrary tokens while retaining their own valid session_id and simply setting user_name to the superuser; token validation in backend/app/core/dependencies.py (lines 72-112) trusts these forged claims. No user interaction, administrative access, or non-default configuration is required - only the ability to reach the registration endpoint and the API, which are present by default - and no public exploit code was identified at time of analysis, though a public technical writeup of the technique exists.
Credential disclosure in netdisk-fast-download through 0.4.8 allows unauthenticated remote attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint and decrypt them using the hard-coded AES key 'nfd_auth_key2026'. This can expose cloud-drive cookies, tokens, or passwords, resulting in high confidentiality impact. Exploitation requires that the target instance has the donation feature enabled and populated with credentials; no public exploit has been identified at time of analysis.
Remote unauthenticated requests to a network-reachable CSAF Provider instance can exhaust CPU resources through unbounded resource allocation, leading to a denial of service. The flaw (CWE-770) affects the gocsaf development community's CSAF Provider, with no specific version constraints identified in the CPE data (all versions appear affected). No public exploit code was identified at time of analysis and there is no CISA KEV entry, though the CVSS 4.0 score of 8.7 reflects high availability impact (VA:H) with no confidentiality or integrity loss.
Account takeover of Google-linked bbs-go users is possible because the /api/login/google_one_tap endpoint accepts any Google-signed ID token without ever validating its audience (aud) claim, so the login handler trusts tokens minted for OAuth clients other than the site's own. An attacker who operates their own Google OAuth client can get a victim to sign in at an attacker-controlled property, capture the resulting Google-signed ID token, and replay it against bbs-go to obtain an authenticated session tied to the victim's Google-linked account (CWE-287). The flaw affects bbs-go through version 4.4.6 on instances where Google One Tap login is enabled and the target account is Google-linked; no public exploit identified at time of analysis, although a public technical writeup of the audience-confusion technique is referenced, and exploitation requires victim interaction to obtain a valid token.
SQL injection in Helical Insight through 7.0.0 allows authenticated users with at least viewer privileges to execute arbitrary SQL queries via crafted Numeric or String placeholder values sent to the /executeDatasource endpoint, bypassing the broken SqlDetect guard. This enables reading unexposed database tables and modifying data within the report's configured data source, with impact limited by the privileges of the database account used by the application. No public exploit code or active exploitation has been identified at time of analysis.
Remote, unauthenticated attackers can access password-less development tools under /wheels/* in Wheels 4.0.0 through 4.1.2 when enablePublicComponent=true (the default in development mode), exposing application settings, environment and datasource details, and routes, and allowing them to start test runs that may write to the real application database. This incorrect authorization flaw (CWE-863) does not affect production-mode deployments by default, and the separately protected migrator and CLI endpoints are not impacted. No public exploit identified at time of analysis.
Cross-workspace authorization bypass in Jpom through 2.11.12 (CWE-639, IDOR) lets any authenticated user who holds SSH file permissions in one workspace read, modify, or delete files on SSH hosts that belong to a different workspace. The flaw resides in SshFileController, where the caller-supplied SSH asset id is used to resolve the target host without verifying that the asset actually belongs to the caller's workspace, so the reachable endpoints (download, upload, read_file_data.json, update_file_data.json, delete.json, rename.json, new_file_folder.json) operate on foreign assets. Exploitation requires a multi-workspace deployment with at least one SSH host asset outside the attacker's workspace and knowledge or enumeration of that host's asset id; no public exploit code is confirmed at time of analysis, though a public technical write-up (linked from the CVE record) explains the technique, and the issue is not listed in CISA KEV, so there is no evidence of active exploitation. Assigned CVSS 4.0 base 8.6 (with our 3.1 assessment at AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects high confidentiality and integrity impact while the CVSS 4.0 vector shows no availability impact.
Hard-coded cryptographic key material embedded in the /usr/bin/sysman binary of Moxa's AIG-302 Series industrial computers enables an unauthenticated attacker who already sits on the same local or logical network segment to recover the static private key and use it to decrypt or tamper with the device's protected communications. The key is identical across all affected units and is trivially extractable by reverse-engineering shipped firmware, so the confidentiality and integrity of those communications are effectively compromised once an attacker reaches the industrial LAN; availability is unaffected and no public exploit code has been identified at time of analysis, with no confirmed active exploitation. The practical barrier is the required adjacent-network position rather than any credential or user interaction, making this a moderately high priority OT/ICS exposure rather than an internet-reachable mass-exploitation issue.
Broken access control in LingGuo-Drama at and through commit 8a6924adf8142678919b4d9a08b9d60c49dcfbed lets any self-registered, low-privilege user read, overwrite, reassign, or delete other users' short-drama projects by iterating numeric IDs against the admin API endpoints GET, PUT, and DELETE /admin/v1/projects/:id. The root cause is CWE-639: the projects.Get helper omits an owner check, so the object identifier supplied by the caller is trusted without verifying that the authenticated principal owns the referenced project. Exploitation requires an authenticated account (CVSS PR:L, obtainable through self-registration where enabled) and network reach to the admin API; no public exploit identified at time of analysis, and there is no KEV entry or EPSS signal to suggest active exploitation in the wild.
An authorization bypass in HestiaCP before 1.10.5 lets an authenticated administrator who is not the protected ROOT_USER impersonate that account through the built-in 'loginas' parameter and then submit write requests, such as a POST to /add/cron/, that the application erroneously executes because the read-only flag is never validated. The practical result is command execution as the protected administrator's system account, since crond runs the injected job, giving high confidentiality, integrity, and availability impact. Exploitation requires a valid admin-level account on an installation with more than one admin and a protected ROOT_USER to shield; the vector is CVSS 4.0 AV:N/AC:L/PR:H/UI:N (vendor 8.6) and the independent assessment concurs, with patch available. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated account takeover in Huly Platform through 0.7.432: the mergeSpecifiedPersons account RPC lacks any authorization or workspace-role check, so any logged-in user - not just a workspace Maintainer - can merge arbitrary person records. An attacker who knows the victim's person UUID and an attacker-controlled person UUID can graft an attacker-owned, unverified but login-capable social id onto the victim person and then complete the takeover through the normal login or password-recovery flow. Vendor patch is available (upstream commit afe11faec1b56f278c0882355a69b08cff1eebd9); no public exploit identified at time of analysis, and real-world risk is bounded by the PR:L prerequisite plus the need to obtain two UUIDs, making instances with open self-service registration the highest-exposure targets.
Improper validation of the reset_url parameter in the Checkmk Setup in-page search lets an unprivileged remote attacker craft a URL that, once opened by an authenticated user holding Setup access, executes arbitrary script in that user's session or redirects the user to an arbitrary external site - but only when the victim clicks the Reset button or submits an empty search, since the payload does not fire on page load. Affected are Checkmk releases before 2.5.0p15, before 2.4.0p38, before 2.3.0p51, and the end-of-life 2.2.0 branch; fully patched instances are not exploitable. No public exploit code has been identified at time of analysis, and exploitation depends on successful social engineering of a privileged Setup user combined with mandatory user interaction.
Arcane versions prior to 2.5.0 disclose stored container-registry credentials to an attacker-controlled host: an authenticated principal holding both the registries:update and registries:test permissions can repoint an existing generic (non-ECR) registry entry to a URL they control without supplying a replacement token, causing the preserved encrypted PAT or password to be decrypted and sent to that host during RegistryLogin/TestRegistry. The issue is rated CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and classified as CWE-200 information exposure, with the scope change and high confidentiality impact reflecting that the leaked credential grants access to, and potential tampering with, the source registry's images. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the flaw is a credible credential-theft primitive for any tenant or operator account that has been granted registry management rights. A vendor fix is available in the 2.5.0 release.