Stored cross-site scripting in the Countly Server star-rating plugin allows an authenticated, non-global application administrator to upload attacker-controlled active content (for example an HTML/JS file disguised as an image) through the uploadFeedbackFile endpoint, which pre-patch trusts the client-supplied MIME type. The file is then publicly served from feedback/preview/ with that attacker-influenced Content-Type, so a global administrator who opens the feedback preview executes the payload in the Countly origin and can expose authenticated session material such as auth_token and csrf_token values. Rated CVSS 3.1 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H), exploitation requires app-admin credentials plus the higher-privileged victim actively opening the preview, and no public exploit code has been identified at time of analysis.
Remote command execution in ZoneMinder prior to 1.38.3 allows an authenticated user with monitor-create or monitor-edit rights to store a monitor Name containing shell metacharacters that break out of manual single-quote wrapping when a user with Events View permission exports that monitor's events, executing arbitrary commands as the web server user. Exploitation requires two authenticated roles and victim interaction (CVSS vector PR:L/UI:R), so this is not a default-reachable or mass-exploitable issue; no public exploit identified at time of analysis, and a vendor-released patch is available in 1.38.3.
Apache Kylin 4 through 5.0.4 performs unsafe Java deserialization of data returned by a configured external cache service, enabling remote code execution if an attacker can control or impersonate that cache. The authoritative assessment rates this as network-reachable with high attack complexity and no privileges required, because exploitation depends on the external-cache precondition rather than a default Kylin endpoint. No public exploit identified at time of analysis or CISA KEV entry was available; EPSS is 0.36% (28th percentile), and the vendor-released fix is 5.0.5.
Unauthenticated retrieval of sensitive backend metadata is possible in Apache Kylin 4.x through 5.0.4 because the metadata dump API performs no authorization check and does not confine the requested path to an intended location. The CVSS vector (AV:N/AC:L/PR:N/UI:N) means any party who can reach that API over the network can invoke it without credentials or user interaction; per our assessment the confirmed impact is confidentiality only (C:H/I:N/A:N), even though the NVD-published score of 9.1 also claims integrity impact. Apache explicitly limits the practical risk to installations where the Kylin backend is directly exposed to the public internet - an uncommon posture - so standard internally segmented deployments are largely unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.19% (8th percentile), which reinforces that this is an exposure-dependent issue rather than a broadly exploited one.
Missing authorization checks in Apache Answer through 2.0.2 let an authenticated user perform mutations on non-public content they are not permitted to access, producing limited confidentiality and integrity impact on the affected instance rather than account or host takeover. Assessed severity is moderate (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) and the flaw requires a valid account, making instances that allow open or self-service registration the most exposed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); upgrading to Apache Answer 2.0.3 is the fix.
Unauthenticated access to Apache Kylin's in-house broadcast API combined with polymorphic deserialization of attacker-supplied data exposes Kylin 4.0.0 through 5.0.4 to high-impact compromise of the affected service, assessed as network-reachable without privileges or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vendor classifies the issue as 'moderate' severity but notes that practical risk is concentrated on Kylin instances whose broadcast endpoint is directly reachable from a public network, which Apache describes as 'not common'; typical internal-only deployments are considered largely unimpacted. No CISA KEV entry, EPSS score, or public exploit code was present in the source data, so there is no public exploit identified at time of analysis, and this assessment rests almost entirely on the Apache advisory, which recommends upgrading to Apache Kylin 5.0.5.
Missing authorization on the JDBC source-configuration update function in Apache Kylin 4.0.0 through 5.0.4 allows an authenticated, low-privileged user to modify a project's data-source connection settings, producing a high integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) with only limited confidentiality exposure and no availability impact. The vendor explicitly frames exposure as network-bounded: risk is concentrated on Kylin services directly reachable from the public network, described as uncommon, while in-house deployments behind network controls are mostly not impacted. No public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied with the source data.