SQL injection in the Mobile Builder WordPress plugin (versions through 1.4.2) lets unauthenticated remote attackers read data from the site database, but only on installations that also run the WCFM Delivery add-on, because the vulnerable code path is reachable solely through that plugin combination. Publicly available exploit code exists (reported by WPScan) and no authentication or user interaction is required against a qualifying site; however, the dual-plugin prerequisite sharply limits the attack surface, EPSS is low at 0.19% (8th percentile), and CISA's SSVC framework rates exploitation as none with no automatable path, making this a genuine but secondary-priority issue rather than a top-urgency flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect.
Unauthenticated SQL injection in the WX Subscribe (微信支付付费订阅) WordPress plugin through version 1.2.1 allows remote attackers to read arbitrary database contents when the plugin's WeChat payment key has not been configured. Publicly available exploit code exists, but the EPSS score is very low (0.18%, 7th percentile) and the vulnerable code path is unreachable on installs where the payment key is set, limiting the realistic exploitable population. Our assessment rates confidentiality impact as high with no integrity or availability impact, and scope unchanged, yielding a CVSS base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Authenticated SQL injection in the affiliate-toolkit WordPress plugin before version 3.8.9 allows editor-level users to read arbitrary database contents. Publicly available exploit code exists, though EPSS is low (0.17%, 6th percentile) and no active exploitation has been confirmed (not in CISA KEV). The independent assessment rates this as a genuine but moderate-priority issue, not an emergency; on WordPress multisite, a sub-site editor can extract the network-global wp_users table, including the super administrator's password hash, while on single-site installs the attacker needs a valid editor+ account.
WordPress sites running the Subscribe to Comments plugin before 2.3.3 expose subscriber management keys to unauthenticated attackers, who can supply a forged or replayed commenter-identifying cookie that the plugin neither signs nor validates, then read a subscriber's management key and silently alter that subscriber's comment-thread subscriptions. Exploitation requires only that a subscriber exists on the target site and that the vulnerable plugin version is active; no authentication (PR:N) or user interaction (UI:N) is needed, and impact is scoped per targeted subscriber rather than site-wide (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Publicly available exploit code exists, EPSS is 0.14% (3rd percentile), and no confirmed active exploitation has been reported.
Server-side request forgery in bitcoinj 0.17 and earlier allows an attacker who can supply or influence a BIP70-style payment request to force the host to issue outbound HTTP connections to an attacker-chosen endpoint by manipulating the pki_type argument handled by PaymentSession.java. Only applications that actually parse payment requests through the Payment Request Handler are exposed, so deployments that never process BIP70 messages are not affected; remote, unauthenticated exploitation is possible with publicly available exploit code exists, though the impact is bounded to low confidentiality, integrity, and availability loss rather than code execution. The bitcoinj project was notified via an issue report but has not responded, and no vendor-released patch has been identified at time of analysis.
Heap buffer overflow in GPAC MP4Box 2.4's sample-size table write path (stbl_AddSize in isomedia/stbl_write.c) allows a crafted MP4 file to crash the process, causing denial of service. Exploitation is local and requires user interaction to open the crafted file, with no confidentiality or integrity impact; a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.18% (percentile 8%).
Missing authorization in the Squeeze WordPress plugin before 1.8.1 lets any authenticated user with a role as low as Subscriber revert arbitrary media attachments to their stored backup copies and then permanently delete both those backups and the plugin-generated WebP derivatives, regardless of attachment ownership. The flaw is remotely reachable with low privileges (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:N, producing only low integrity and availability impact with no confidentiality impact), and publicly available exploit code exists via a WPScan exploit reference; there is no KEV entry or other confirmation of active exploitation. Practical exposure is confined to sites that permit open registration or otherwise allow untrusted users to hold at least a Subscriber account.
Unauthorized booking creation in the Salon Booking System WordPress plugin before 10.31.9 allows unauthenticated remote attackers to forge bookings attributed to arbitrary users, overwrite those users' stored contact details, and mark bookings as paid or confirmed without any payment being made. The flaw is a missing authorization check (CWE-862) reachable over the network with no authentication or user interaction required (CVSS 3.1 base 5.3 MEDIUM, integrity-only impact). Publicly available exploit code exists, EPSS is low at 0.15% (3rd percentile), and a vendor patch (10.31.9) is available.
Unauthenticated information disclosure in the Document Gallery WordPress plugin through 5.1.1 lets any remote visitor generate a gallery on demand and read back the titles, descriptions, and direct file URLs of media attached to unpublished, private, or trashed posts. Because the on-demand gallery path performs no capability or ownership check, the issue is reachable on default installations with no authentication, no user interaction, and no special configuration (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, score 5.3); publicly available exploit code exists, so scanning and opportunistic abuse are plausible, although no confirmed active exploitation (CISA KEV) has been recorded and EPSS puts likelihood low at roughly 0.14% (3rd percentile). Impact is bounded: the leak is confidentiality-only and data-dependent - sites that keep no sensitive media attached to drafts, private, or trashed content expose little of consequence, which is why our independent assessment rates this as a genuine but moderate-severity flaw rather than a critical priority.
Unauthenticated remote attackers can read the webhook authentication secret exposed by the Coinsnap Bitcoin Crowdfunding WordPress plugin (versions through 1.2.0) and use it to forge payment-confirmation callbacks, recording arbitrary donations as completed with attacker-chosen amounts, donor names and messages. Exploitation requires no authentication, privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3), but it is limited to sites that have this specific crowdfunding plugin installed and active with its Bitcoin payment-gateway webhook in use, and the impact stays within falsified donation records rather than server compromise or sensitive-data theft. Publicly available exploit code exists and WPScan published a dedicated vulnerability entry, while EPSS remains low at 0.14% (3rd percentile) and there is no confirmed active exploitation (CISA KEV).
Unauthenticated information disclosure in the MAIO WordPress plugin before version 7.3.22 allows any remote attacker to retrieve the plugin's stored crawl-analytics log - including each recorded visitor's IP address, user agent, and referer - by presenting a credential value that ships verbatim in the plugin's own publicly distributed source as a valid API key. Because the accepted key is readable by anyone who downloads the plugin, there is effectively no authentication barrier: the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation with no user interaction, and no non-default configuration is required beyond the analytics logging being in use so that records exist. Publicly available exploit code exists via the WPScan advisory; the impact is confined to telemetry disclosure with no integrity or availability effect, giving a moderate CVSS score of 5.3.
Device ownership takeover and serial ID disclosure in the eSeeCloud cloud platform lets unauthenticated remote attackers rebind a target device to their own account even when that device is actively bound to a different owner, exposing the device's full serial ID. The flaw is server-side only: the bind/unbind workflow accepts the rebind request without verifying that the requester currently owns the device, so no credentials, configuration change, or user interaction are required (CVSS 4.0 base 6.9, AV:N/AC:L/PR:N/UI:N, C:L; assessed CVSS 3.1 6.5 with I:L as well). It was reported to CISA by ICS-CERT as advisory ICSA-26-288-02 and is classified as an information disclosure issue; there is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Enumeration of registered surveillance devices in the eSeeCloud platform allows anyone who already holds a valid access token to distinguish live 10-digit device IDs from unassigned ones, because the endpoint returns a distinct error response for nonexistent IDs compared with registered ones and applies no meaningful rate limiting, making discovery of registered devices at scale practical. The reporter rates this CWE-204 observable response discrepancy 6.9 under CVSS 4.0, while our reassessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - authenticated, network-reachable, low-complexity enumeration with confidentiality-only impact, no data content disclosure, no modification and no device control. Published through CISA ICS-CERT as ICSA-26-288-02; no public exploit code identified at time of analysis, no CISA KEV listing, and no EPSS data was supplied.
Authentication bypass in the Salon Booking System WordPress plugin before 10.31.9 allows unauthenticated attackers to compute valid booking-API tokens for staff or administrator accounts, gaining access to the booking API as those users. The tokens are generated from a hardcoded value and the one-second issuance timestamp instead of a secure random source, so an attacker who can constrain that timestamp can forge a token. Publicly available exploit code exists, but EPSS is only 0.14% and the issue is not in CISA KEV, consistent with the high complexity (AC:H) of bounding the issuance window; the vendor has released version 10.31.9 to fix it.
The Salon Booking System WordPress plugin before 10.31.3 fails to enforce capability checks on several of its booking REST API routes, so any authenticated user - including a low-privilege subscriber - can retrieve the booking records and personal data of every customer on the site. The vulnerability is remotely reachable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 4.3) but requires a valid account, meaning sites that allow self-service registration or that host untrusted low-privilege users are the realistic attack surface. Publicly available exploit code exists via the WPScan disclosure, though EPSS is low (0.15%, 4th percentile) and no active exploitation has been confirmed. This is a genuine but moderate-priority information disclosure issue rather than a top-tier emergency.
The Visual Form Builder WordPress plugin through version 3.1 renders a wp-admin dashboard widget that lists recent form submissions without performing any capability or authorization check, so any authenticated user at Subscriber level or above can read other users' submitted contact information - names, email addresses, form titles and timestamps. Exploitation requires a valid low-privilege WordPress account (CVSS PR:L) and the ability to reach the dashboard where the widget loads, and the impact is confined to read-only disclosure with no data modification or account takeover. Publicly available exploit code exists, but there is no confirmed active exploitation, no CISA KEV listing, and the EPSS score is negligible at 0.15% (4th percentile), so this is a genuinely low-priority issue that is nonetheless a real and easily fixed flaw.
Authenticated users with Subscriber-level access can persistently corrupt the field structure of any form built with Visual Form Builder through 3.1, because the plugin's field-reordering action performs neither an authorization nor a nonce check (CWE-862). Publicly available exploit code exists, but EPSS is just 0.14% (3rd percentile) and CISA KEV does not list this issue, so active exploitation is not confirmed. The impact is limited to integrity-forms break for public visitors-with no data disclosure, and exposure is greatest on sites that permit open user registration.
Missing authorization and CSRF protections in the MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.2 allow any authenticated user - including a low-privileged subscriber - to trigger the plugin's one-way migration routine, which creates unwanted published records and permanently deletes the site's entire post-type and taxonomy configuration. The migration actions perform neither a capability check nor nonce validation (CWE-862 broken access control), so no administrator role or valid token is required; an independent assessment rates the availability impact as High because the configuration loss is irreversible. Publicly available exploit code exists (publicly available exploit code exists), but EPSS is low at 0.14% (3rd percentile) and there is no confirmed active exploitation; the primary practical prerequisite is that the target site accepts self-service/low-privilege registration.
Unauthenticated remote attackers can enumerate sensitive user directory information-including phone numbers, roles, and department structure-from qKnow through version 2.4.3 by directly calling /flyflow workflow integration endpoints that are mistakenly permitted without authentication in the shipped SecurityConfig. The affected endpoints are /flyflow/userById (which accepts sequential userId values), roleAll, and deptListByParentDeptId; exploitation requires only network reachability of the qKnow instance, with no credentials or user interaction. The flaw is rated CVSS 6.9 (CVSS 4.0) and CWE-306, but the impact is limited to read-only information disclosure; no write, modification, or code execution is possible. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated attackers can cancel any member's pending unpaid orders in waynboot-mall through 2.0.0 by calling the /callback/order/unpaid endpoint directly, because that callback handler performs no authentication and accepts the order identifier from attacker-controlled input. Order identifiers (orderSn) are generated from epoch seconds plus a sequential counter, so they are predictable enough to enumerate or guess, allowing an attacker to repeatedly cancel live orders and distort product stock levels. No vendor patch has been identified and no public exploit code was confirmed at time of analysis, although a public technical writeup describing the flaw exists; the impact is bounded to order-state and inventory manipulation rather than data disclosure or account takeover.
Unauthenticated access to the administrative /api/ui surface of Misaka Danmu Server through 2.8.9 allows any attacker who can reach the HTTP service to read audit logs containing login IP addresses, server logs and environment paths, and to delete episode rows, clear media-server mappings, and wipe audit history. The audit, diagnostics, data-check, scan-index and health route modules ship without the get_current_user dependency, so a default deployment applies no authentication to them whatsoever (CWE-306). The reported CVSS 4.0 score is 6.9, and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) concurs that this is a genuine but moderate-priority issue rather than an inflated critical one; the realistic limiting factor is exposure, since Misaka Danmu Server is self-hosted and normally confined to a LAN or fronted by a reverse proxy. There is no CISA KEV entry and no public exploit code identified at time of analysis, so exploitation is opportunistic and requires direct network reachability of the affected endpoints.
Unauthenticated attackers can overwrite enterprise profile data in 53AIHub through version 0.5.3 by sending crafted PUT requests to /api/enterprises/:id when the deployment does not have IS_SAAS set to true. This allows modification of logos, display names, and branding, enabling defacement or phishing. The independent assessment rates this as a moderate-severity integrity-only issue with no data disclosure or service disruption; no public exploit identified at time of analysis. Deployments correctly configured with IS_SAAS=true are not vulnerable because authorization checks engage in that mode.
Unauthenticated path traversal in CoAI (Chat Nio) through 4.0.0 lets remote attackers download arbitrary readable .tar.gz or .zip archives, including archives generated by other users, by injecting ../ sequences into the hash query parameter of the generation and article archive download endpoints. The flaw is remotely exploitable without credentials against default configurations (CVSS 4.0 vector PR:N, consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N), but the impact is confidentiality-only: only files readable by the service process and matching an archive extension can be retrieved, and there is no write or code-execution capability. No public exploit identified at time of analysis and no CISA KEV listing; the issue remains a moderate-severity information-disclosure risk on exposed instances.
Unauthenticated order forgery in Waynboot-mall through 2.0.0 allows remote attackers to create fraudulent orders, expose stored shipping details, clear carts, and decrement stock by invoking the internal /callback/order/submit message-queue callback. The endpoint is exposed without authentication by the application's SecurityConfig, so no credentials or user interaction are required; attackers supply arbitrary userId, addressId, and cart IDs in the order JSON. Exploitability hinges on network reachability-an internet-exposed instance is trivially exploitable, whereas an internal-only deployment limits the attack to parties with network access; no public exploit code or active exploitation is identified at time of analysis (CVSS 4.0 base 6.9; independent assessment aligns with CVSS 3.1 base 6.5).
Server-side request forgery in fish-island-backend through commit 7c61b78 allows unauthenticated remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse, potentially reaching internal hosts, loopback services, and cloud metadata endpoints through redirect-following OkHttp requests. Successful exploitation can disclose limited internal data reflected by the parser, such as page titles, meta descriptions, and favicons, so the practical impact is constrained to what the targeted service returns in those fields. No public exploit code or CISA KEV entry is identified in the provided data, and the assessed CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Denial of service in FreeRDP clients before 3.32.0: a NULL pointer dereference in the websocket transport lets a malicious or man-in-the-middle gateway crash the client by sending a zero-length websocket ping frame. Affected are all FreeRDP builds prior to 3.32.0 that connect through the websocket gateway transport; the attacker must occupy the gateway position rather than being an arbitrary remote host, and the outcome is limited to terminating the client process with no code execution, privilege gain, or data disclosure. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, though the low attack complexity and lack of authentication or user interaction keep the practical bar for abuse low for anyone controlling the gateway path.
Missing authorization in the internal /api/v1/secrets/ REST API of Moxa's AIG-302 series industrial computing gateways lets an attacker who already holds a valid low-privileged session on the device read secrets and cryptographic key material directly from that endpoint. Exploitation requires two preconditions: pre-existing valid credentials (PR:L) and adjacent, Layer-2 network access to reach the internal API (AV:A), so the flaw is not reachable from the open internet or by unauthenticated users. Impact is confidentiality-only - high-value disclosure of stored credentials and key material - with no integrity or availability effect, giving a moderate severity rating (CVSS 4.0 base 6.9 / Medium); no public exploit code has been identified at time of analysis, and the issue is published alongside a related flaw, CVE-2026-109813, in Moxa advisory MPSA-262560.
Unauthenticated attackers who can reach the management interface of a Netcore NR256CN router can bypass authentication and invoke protected management CGI handlers simply by prefixing the request URI with a recognized public route such as l7_web_auth.cgi or an .ico path. The defect affects NR256CN firmware through 1.5.140116 and is rated medium severity (CVSS 4.0 base 6.9; independent assessment CVSS 3.1 6.9, AV:N/AC:L/PR:N/UI:N), with limited confidentiality and integrity impact on router management functions and no availability impact. No public exploit code identified at time of analysis, but exploitation is a single crafted HTTP request with no credentials or user interaction required, so the practical limiting factor is whether the management interface is reachable from an untrusted network rather than any exploitation complexity.
99AI through version 4.3.0 allows unauthenticated attackers to read other users' private chat messages and task data, because the querySingleChat handler in the chatLog service performs no ownership check on the requested chat identifier. A remote attacker simply supplies a fingerprint header to be issued a low-privilege visitor JWT, then enumerates sequential integer chatId values to harvest message content belonging to other users. The source CVSS 4.0 vector rates this 6.9 (Medium) with PR:N/UI:N and low confidentiality impact, and our independent assessment agrees it is trivially and reliably exploitable, though it is read-only, grants no write or administrative access, and is not confirmed actively exploited (no CISA KEV listing) or accompanied by packaged exploit code; a public technical writeup describing the attack path is referenced.
Server-side request forgery in Chaskiq through 2.0.3 allows unauthenticated remote attackers to make the server fetch arbitrary URLs via the url parameter of the /oembed endpoint. The FetchLinkCardService follows redirects and skips TLS verification, enabling access to loopback, private, or cloud metadata addresses; the impact is limited because only the fetched page's title and description are returned, not full response bodies. No public exploit identified at time of analysis; CVSS 4.0 score 6.9 (Medium) reflects unauthenticated network access with low confidentiality impact.
Unauthenticated email relay in waynboot-mall 2.0.0 and earlier lets anyone who can reach the application POST a caller-chosen subject, body, and recipient to the anonymously mapped /callback/email endpoint (EmailController.sendEmail), causing messages to be sent from the operator's own configured SMTP account. Because that path is permitted without authentication in the default Spring Security configuration, a default, network-reachable deployment with working SMTP credentials is directly abusable for phishing, spam, and mail-quota exhaustion, while the independent assessment rates it moderate severity since impact is confined to outbound mail integrity (I:L) with no confidentiality or availability loss. No public exploit identified at time of analysis, although a public technical writeup of the callback abuse is referenced, and the CVE is not listed in CISA KEV.
Engineercms through version 2.0.5 allows unauthenticated attackers to download project image and video attachments by directly requesting known or derivable /attachment/* paths for .jpg, .png, .bmp, or .mp4 files. The files are served before any casbin, owner, or admin authorization checks are applied, resulting in a limited confidentiality exposure. The independent assessment rates this as low impact (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and no public exploit code has been identified at time of analysis; the vulnerability is not listed in CISA KEV.
Unauthenticated remote attackers can read accounting transaction records from NexoPOS through 6.2.4 by requesting GET /api/fields/{resource}/{identifier}, because the endpoint does not enforce the nexopos.read.transactions permission. By enumerating sequential identifiers for transaction field classes such as ns.entity-transaction, an attacker can retrieve transaction field names, values, account IDs, and descriptions; the independent assessment rates this as limited read-only information disclosure (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), and no public exploit identified at time of analysis. This is a genuine but moderate-severity exposure rather than a top-tier emergency, with no integrity or availability impact confirmed.
Unauthenticated WebSocket access in WHartTest through 2.8.1 lets remote attackers connect to the /ws/ui/web/ and /ws/ui/actuator/ endpoints without credentials, register an actuator under a client-supplied id, and thereby intercept other users' test-case payloads while spoofing step results and screen frames into victim UI-automation sessions. Exploitation is practical only where the Django Channels endpoints are network-reachable and concurrent test traffic exists, since the flaw yields limited confidentiality and integrity impact with no availability effect (independent assessment CVSS 3.1 5.3 medium; vendor-published v4.0 score 6.9). No public exploit code has been identified at time of analysis, no confirmed active exploitation (CISA KEV) has been reported, and no vendor-released patch is currently documented in the available data.
Oqtane Framework through 10.2.6 exposes one tenant's stored private settings to the administrator of another tenant, allowing an authenticated site administrator to retrieve SMTPPassword and SMTPClientSecret values by requesting a foreign site's entityId through their own site alias. The flaw is an authorization bypass in SettingController (CWE-639, user-controlled key), scored 6.9 Medium under CVSS 4.0 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N) and assessed as CVSS 3.1 6.0-style confidentiality-only impact (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). Exploitation requires a multi-tenant Oqtane deployment hosting more than one site plus the attacker already holding the Administrators role on at least one tenant site; single-site installations are unaffected, no public exploit identified at time of analysis, and the impact is limited to credential disclosure with no integrity, availability, or code-execution effect (vendor advisory: https://www.vulncheck.com/advisories/oqtane-framework-through-10.2.6-cross-site-settings-disclosure-via-setting-api).
An authorization bypass in the Photo Engine (Media Organizer & Lightroom) plugin for WordPress, affecting all versions up to and including 6.5.6, allows a lower-privileged account to permanently delete arbitrary media attachments and upload new ones without holding the required upload_files or edit_others_posts capabilities. The root problem is that the admin-screen guard in Meow_WPLR_Sync_Admin::__construct() is commented out, so wp_localize_script leaks the wplr_auth_token into every admin page view; a Subscriber can read their own token straight from the profile.php page source and replay it in a cookie-less HTTP session against the /?wplr-sync-api endpoint. No public exploit code has been identified at time of analysis, and although the published vector is PR:N, exploitation realistically depends on either open self-registration or an existing low-trust account, which constrains fully anonymous abuse; EPSS and KEV signals are absent, so this is a moderate, situational risk rather than an emergency.
Parsing a crafted Word 8 (.doc) file with Antiword 0.37 and earlier can crash the process through a heap out-of-bounds read in vGet8LstInfo (prop8.c), where an inverted bounds check trusts a PlcfLst record count claiming up to 0xffff list entries against a much smaller heap buffer. The vector is local and file-driven: the file itself is unauthenticated input, but the target must actually invoke antiword on the attacker-supplied document (a user or an automated conversion pipeline opening it), so exploitation requires the victim side to feed the file to the tool. Impact per the assessed vector is availability-only (CVSS 3.1 AV:L/AC:L/PR:N/UI:R/C:N/I:N/A:L) - a crash of the antiword process with no code execution or data disclosure demonstrated - and no public exploit or vendor patch has been identified at time of analysis, though the CVSS 4.0 vector supplied by the reporter scores it 6.8 with high availability impact.
Incorrect authorization in the NordVPN for Windows client before version 8.12 lets a low-privileged local user impersonate a trusted process and drive privileged service-control operations through the named pipe \\.\pipe\nord-security\v1\NordVpnService\Server. By invoking the ISettingsGrpc.StopService and ISettingsGrpc.ChangeServiceStartType methods with an arbitrary service name, the attacker can halt unprotected Windows services and reset their startup type to Manual, producing denial of service against critical system components. Exploitation requires an existing local foothold on a host where NordVPN is installed and running - it cannot be triggered remotely - and is bounded because services protected by Windows (PPL processes and Tamper Protection, such as Windows Defender) are not affected; the assessed CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H with a supplied CVSS 4.0 base of 6.8 (MEDIUM), and no CISA KEV listing or public exploit code has been identified at time of analysis.
A deterministic 3-byte heap-based buffer overflow in ssldump's FAN/1 X.509 fingerprinting routine (fanx_fingerprint in ssl/sslxprint.c) corrupts the heap on every call that processes a valid certificate. Exploitation requires the victim to run ssldump with FAN/1 fingerprinting enabled (the -j and -N options) against an attacker-supplied pcap containing a TLS handshake with a valid X.509 server certificate; the attack vector is local and depends on the user actively choosing to parse the malicious capture with non-default options. The most likely outcome is a crash/denial of service, with arbitrary code execution in the context of the ssldump user remaining a worst-case possibility; no public exploit code has been identified at time of analysis, and the overflow content is largely fixed, which makes code execution substantially harder than a denial of service.
Path traversal in the document-import feature of Open Zaak (1.13.0 through 1.27.1, 1.28.x before 1.28.2, and 1.29.x before 1.29.0) lets a client holding an all-authorizations application token supply an absolute or parent-traversal bestandspad value in an import CSV, causing the Celery worker to copy an arbitrary file readable by its service account into document storage, where it can then be fetched through the normal document download API and leak server secrets. Exploitation is authenticated with a highly privileged token (CVSS PR:H), requires the document-import feature to be active, and is a straightforward information-disclosure issue (CWE-200); no public exploit code was identified at time of analysis, and the privileged-token prerequisite keeps practical risk below the raw network/low-complexity score. Fixes are available in 1.27.2, 1.28.2, and 1.29.0.
Arbitrary file deletion in GNOME Nautilus (GNOME Files) affects desktop users on Red Hat Enterprise Linux 6 through 10 and other distributions shipping the file manager: when a removable drive or disk image is unmounted or ejected, Nautilus offers to empty the trash without verifying that the volume's trash directory paths are symbolic links. An attacker who persuades a local, authenticated user to mount a crafted storage volume and then confirm that prompt can have files the victim has permission to delete removed through the symlinked path. The issue carries a moderate CVSS 3.1 score of 6.6 (AV:L/PR:L/UI:R, integrity and availability High, confidentiality None), and no public exploit identified at time of analysis; successful abuse requires a local desktop session, attacker-supplied media, and explicit user confirmation of the dialog.
Authenticated file disclosure in the Tainacan WordPress plugin (all versions up to and including 1.3.0) allows any logged-in user with subscriber-level access or above to read the contents of arbitrary files on the web server, including sensitive files such as wp-config.php. The flaw is conditional and only exploitable when the uploads/tainacan directory does not exist on the target server; on any installation where Tainacan has previously run and created that directory, the path-containment check holds and the attack fails. Impact is limited to read-only information disclosure (no write or code execution), no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the assessed severity is moderate given the authentication requirement and the narrow environmental prerequisite.
Stack exhaustion in pupnp (libupnp) before 2.0.0 allows an unauthenticated attacker on the local or adjacent network to crash a UPnP service thread by delivering a SOAP request whose XML body is nested deeply enough to exhaust the stack inside the library's recursive ixml DOM traversal functions. The issue is rated CVSS 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and affects availability only, with no confidentiality or integrity impact; hosts running 2.0.0 or later are not affected. This is an incomplete-fix case for CVE-2021-28302, and no public exploit code was identified at time of analysis.
Authenticated users with Subscriber-level access or above can read the titles, URLs, authors, categories, tags, and 40-word excerpts of every unpublished draft, pending, or scheduled post on WordPress sites running the WSP MCP AI Agents Connector plugin through version 2.9.5. The wsp_get_posts MCP tool is registered with an empty capability requirement, the MCP endpoint's authenticate() method accepts any logged-in user, and the tool's callback honors a caller-supplied status=all argument that expands the underlying WP_Query without an author or ownership filter. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the vendor-assigned CVSS of 6.5 is higher than this assessment's estimate (4.3, C:L) because disclosure is bounded to post metadata and short excerpts rather than full post content.
SQL injection in the Mail Mint plugin for WordPress (versions up to and including 1.31.4) allows an authenticated attacker with the plugin-specific 'mint_read_contacts' capability to read sensitive database contents through the /wp-json/mrm/v1/segments/contacts REST endpoint. The issue is a genuine but moderate-priority SQL injection rather than a top-tier emergency because the capability is granted only to Administrators by default, although sites that have delegated it to lower-privileged roles via Mail Mint's role manager face greater risk. No public exploit identified at time of analysis; no KEV or EPSS data was provided.
Memory exhaustion in Mattermost (versions 11.10.x through 11.10.0, 11.7.x through 11.7.9, 11.8.x through 11.8.5, and 11.9.x through 11.9.1) allows an authenticated, low-privilege user to drive the server to buffer an arbitrarily large remote image response in memory by making the local image proxy perform a direct fetch from an attacker-controlled endpoint, degrading or crashing the instance. The defect is a missing size limit on the buffered response (CWE-770), and impact is confined to availability - there is no confidentiality or integrity loss, and no data disclosure or modification occurs. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); exploitation requires a valid low-privilege account and a configuration in which the local image proxy performs direct remote image fetches, and no public exploit identified at time of analysis, though a structured advisory (MMSA-2026-00726) is published.
Unauthenticated arbitrary shortcode execution in the WordPress plugin Forminator Forms (Contact Form, Payment Form & Custom Form Builder) affects all versions up to and including 1.58.1, allowing remote attackers to run any WordPress shortcode registered on the target site by submitting a quiz form. Exploitation is gated by a non-default configuration: a published quiz whose email/notification template contains the {quiz_result} merge tag, after which attacker bytes injected via the User-Agent header or the referer_url POST parameter (neither of which is stripped of the '[' and ']' shortcode delimiters by sanitize_text_field()/esc_html()) are fed to do_shortcode(). The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (Attack Complexity High, unauthenticated) because the quiz-result template precondition must be met; no public exploit code and no CISA KEV active-exploitation entry were identified at time of analysis, and real-world impact scales with which dangerous shortcodes other installed plugins or themes expose.
Arbitrary shortcode execution in the WordPress Broken Link Checker plugin (all versions up to and including 2.4.14.1) allows an unauthenticated commenter to embed a shortcode payload in a comment's href or src attribute; once that comment is approved through the site's normal moderation workflow, the plugin's link parser passes the value to do_shortcode during a scheduled WP-Cron scan, executing the shortcode with no further attacker interaction. The published CVSS v3.1 base score is 6.5 (AV:N/AC:L/PR:N/UI:N), but the practical vector carries a user-interaction precondition (UI:R) because moderator approval is required, and impact is bounded by which shortcodes are registered on the target site. No public exploit code has been identified at time of analysis.
Blind SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce plugin, affecting all versions up to and including 3.6.1, lets an authenticated attacker with vendor-level access or higher inject arbitrary SQL through the src_by[].val.start and src_by[].val.end parameters when the 'bt' (BETWEEN) operator is used, allowing extraction of sensitive data from the WordPress database. The defect is an incomplete fix for a SQL injection patched in 3.6.0, which hardened only the gt/lt/le/ge operator branches and left the BETWEEN branch unescaped. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) reflects high confidentiality impact with no integrity or availability effect, and no public exploit identified at time of analysis; this is a moderate-priority issue rather than an emergency, since exploitation requires a privileged vendor account and the blind nature of the injection makes data extraction slower and noisier.
Unauthenticated shortcode injection in the Forminator Forms WordPress plugin (≤1.58.1) allows remote attackers to execute arbitrary registered shortcodes by sending a GET request to the search results page on any block-theme install, or by submitting an anonymous comment on any post with comments enabled. With a CVSS score of 6.5 and no public exploit identified at time of analysis, the practical impact is bounded by which shortcodes are present on the target site, but the exceptionally low exploitation barrier-no authentication, no user interaction, and no Forminator-specific configuration-makes this an elevated-priority issue.