TuxGuitar versions before 2.1.0 will load and instantiate an attacker-supplied Java class contained in a crafted .tg tablature file, executing that class's constructor (and static initializer) with the privileges of the TuxGuitar process when the user opens the file. The document sets the gervil.soundbank.path property to an on-disk archive - the .tg file itself qualifies - whose META-INF/services/javax.sound.midi.Soundbank entry names a class bundled in that same archive, and the bundled Gervill media.sound.JARSoundbankReader loads it through an unverified URLClassLoader. The CVSS 4.0 vector is AV:L/AC:L/AT:N/PR:N/UI:P with a score of 8.5 (unauthenticated, no non-default configuration required), but the payload must be delivered as a document the victim opens, so real-world priority is moderated by that delivery model; no public exploit code has been identified at time of analysis and the issue is fixed in 2.1.0.
SQL injection in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) affects all versions through 8.16.1 and lets an authenticated low-privileged user, such as a subscriber, contributor or customer account, inject arbitrary SQL through the plugin's vulnerable request handling, exposing database contents. The issue is remotely reachable with low attack complexity and needs no victim interaction, but it does require a valid account on a site that both runs the affected plugin and permits untrusted low-privilege registration; sites that do not hand out such accounts face materially lower real-world exposure. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so the practical risk is driven by the population of sites exposing low-privileged authenticated access to the plugin.
Authenticated non-admin users of sshportal's management shell can retrieve decrypted backend SSH private keys through the 'key show' command, allowing them to connect directly to managed hosts and bypass ACLs and session recording. The flaw affects sshportal through version 1.19.5 and requires only a valid non-admin account with management shell access; default deployments are impacted because predictable key names such as 'default' and 'host' are commonly present. No public exploit code or confirmed active exploitation was identified at time of analysis, but the CVSS 4.0 score is 8.3 (High) and our assessment rates it as a medium-to-high priority for shared multi-user bastion deployments.
SQL injection in Frappe HRMS 14.x (before 14.38.2), 15.x (before 15.64.0), and 16.x (before 16.18.0) allows any authenticated user, including a low-privilege account, to extract sensitive information from the database via crafted requests to endpoints that lack input validation. The flaw requires only a valid session (CVSS PR:L) and no user interaction, resulting in high confidentiality impact with scope change. Patched versions 14.38.2, 15.64.0, and 16.18.0 are available, and no public exploit code has been identified at time of analysis.
Missing authentication in the OtterMind Nubase storage-object API (versions through 0.1.4) lets remote attackers download and delete objects held in private buckets without supplying an apikey or JWT. The UnifiedMultiTenancyFilter treats the route /storage/v1/object/{bucketId}/{path} as public for every HTTP method, so any request reaching that endpoint bypasses tenant authorization entirely; per the independent assessment the impact is a high-confidentiality, low-integrity/availability compromise (CVSS:3.1 8.3-equiv, AV:N/AC:H/PR:N/UI:N/C:H/I:L/A:L), gated only by the attacker's prior knowledge of a valid tenant subdomain, bucket id and object path. No public exploit code or CISA KEV entry was identified at time of analysis, and no vendor-released patch is confirmed.
Cross-domain sender spoofing in Mailu allows a domain manager to authenticate as arbitrary senders on other domains hosted on the same instance. The flaw is an improper-authorization issue in which the Postfix sender-login lookup honors the allow_spoofing flag globally rather than scoping it to the requesting user's own domain, so a manager of one hosted domain can enable spoofing and pass DKIM/SPF authentication for domains they do not own. Exploitation requires an existing domain-manager (administrative) role (CVSS PR:H) on a multi-tenant deployment hosting more than one domain; there is no unauthenticated or end-user path, and no public exploit code was identified at time of analysis.
Arbitrary file deletion in the Groundhogg CRM, Newsletters and Marketing Automation plugin for WordPress (all versions up to and including 4.9.3) lets an authenticated user who holds the plugin's import_contacts capability - granted by default to Groundhogg's custom Sales Representative role - name an arbitrary server-side path and have the plugin delete it, with a realistic escalation to remote code execution (for example by removing wp-config.php). The flaw is reachable through the contact-import (CSV), REST API, and webhook paths that call copy_file, and it received a CVSS of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H); there is no CISA KEV listing and no public exploit code identified at time of analysis. The practical risk is bounded by the authentication requirement and by the attacker's need to know or guess the absolute path of a valuable target, but the capability is assigned by default and no user interaction or non-default configuration is needed, making this a credible, actionable priority rather than an inflated high-CVSS issue.
Unauthenticated remote attackers can retrieve full payment records from Roncoo-pay by exploiting a missing authorization check in the F2FPayController.orderQuery endpoint. The vulnerability (CWE-306) allows access to any merchant's transaction data if the attacker can guess or enumerate a valid transaction number, which follows a predictable format ('7' prefix plus a snowflake ID). No public exploit code is known at this time, and exploitation requires network access to the web gateway and successful guessing of a transaction number, making it a complexity-limited information-disclosure issue.
DNS cache poisoning in Amazon FreeRTOS-Plus-TCP prior to V4.4.2 lets unauthenticated remote attackers insert an attacker-chosen address into a device's DNS cache by supplying a forged DNS reply that the resolver accepts before the legitimate response arrives. The flaw is an integrity-only weakness (CWE-940, improper verification of the source of a communication channel): the resolver does not adequately validate that a reply actually originated from the DNS server it queried, so a successful injection diverts subsequent outbound connections to attacker-controlled endpoints. Exploitation is constrained by high attack complexity - the attacker must match or guess reply-matching attributes such as source address/port and transaction ID and win a timing race - which favors on-path or local-network attackers over arbitrary internet senders; no confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, and the vendor has released a fixed version with a required configuration flag.
Privilege escalation in the Customer Email Verification for WooCommerce WordPress plugin through 3.3.0 allows unauthenticated attackers to gain authentication as any WordPress account that still has an unverified email address, including administrators, by brute-forcing a per-user activation secret that has only about 101 possible values. The weakness is genuine and high impact (full account takeover), but real-world risk is heavily gated by three preconditions: the plugin's 'Encoding method' must be set to the non-default 'hashids' option, the attacker must recover or brute-force the Hashids salt (which defaults to an md5(time()) value fixed at first initialization), and the targeted account's email must remain unverified. An upstream changeset addressing the issue is referenced in the WordPress plugin repository, and no public exploit code was identified at time of analysis; CVSS 3.1 scores it 8.1 (High, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), so despite the High score it should be triaged as lower priority than a default-configuration, unauthenticated account-takeover bug in most deployments.
Vulnity Security, a WordPress plugin maintained by Manuel Galan, can be bypassed to gain administrator access on Nginx-based installations running version 1.4.3 or earlier. The plugin's delegated-login feature writes a pairing credential file and auto-generates an Nginx configuration snippet intended to block web access to it, but the snippet guards the wrong directory path, leaving the credential file reachable by unauthenticated attackers who can then forge signed REST API requests and authenticate as an administrator. No public exploit code or confirmed active exploitation was identified at time of analysis, but the attack requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), with High complexity arising from the dependency on a qualifying Nginx deployment where the delegated-login pairing credential exists and the flawed snippet is active; Apache and other web servers appear unaffected.
Unauthenticated stored-file disclosure in SurveyKing before 1.13.0 lets remote attackers download arbitrary attachments by calling GET /api/public/preview/{attachmentId}, bypassing the shared, owner, and project authorization checks that FileServiceImpl.loadFile is supposed to enforce. No authentication (PR:N), user interaction, or non-default configuration is required - the endpoint is public by design - but there is no file-listing capability, so success depends on knowing or deriving a valid snowflake attachment ID, which is time-ordered and only partially predictable (reflected in the assessed AC:H/AT:P). The result is a genuine but conditionally gated confidentiality risk rather than a mass-exploitation emergency: no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though a vendor patch exists and the exposure is high-severity (CVSS 4.0 8.2; CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Denial of service in mz-automation libIEC61850 before 1.6.2 lets a remote, unauthenticated attacker crash IEC 61850 servers by sending a single defineNamedVariableList MMS request. The bug is a stack out-of-bounds read (CWE-125) in checkDataSetAccess, where source and destination arguments are reversed in a StringUtils_copyStringToBuffer call used to build an MMS_ASSOCIATION_SPECIFIC dataset reference, so an uninitialized 130-byte stack buffer is treated as a source string and strlen walks past its bounds before those bytes are copied into the caller-owned listName buffer. Exposure is conditional: the server must have the dynamic dataset service enabled and a dataset access handler installed, both non-default integration choices, but any network-reachable server configured that way is trivially hit for a full loss of availability; the vulnerability is fixed in release v1.6.2 and no public exploit code was identified at time of analysis. No CISA KEV entry is associated with this CVE, and the tags indicating information disclosure reflect leaked stack bytes rather than a confirmed confidentiality breach, since the assessed impact is availability-only.
Unauthenticated account takeover of WordPress sites running miniOrange OTP Login, Verification and SMS Notifications through 5.5.8 is possible because the Delay OTP grace flag is stored per user rather than being bound to the originating session, cookie, IP address, or device. When OTP-only login and Delay OTP Verification are enabled and the target account is inside its grace interval, an attacker can submit a known username with `mo_wp_login_intent=otp` and any non-empty password to inherit that user's verified state and log in as any account, including administrators. No public exploit code or CISA KEV active exploitation was identified at time of analysis, and exploitation is constrained by non-default settings plus a race-window timing precondition (CVSS 8.1, AC:H).
Unauthenticated privilege escalation in the Cozmoslabs User Profile Builder WordPress plugin (all versions up to and including 4.0.3) allows an attacker to obtain a fully activated administrator account: they submit role=administrator through the public [wppb-register] registration form, then click the activation link emailed to them, and the activation handler applies that role via WP_User::set_role() without any allow-list check. The attack is conditional rather than trivial - the site must already carry a legacy registration form field with meta-name 'role' from before the 4.0.3 upgrade (the 4.0.3 reserved-name block deliberately exempts pre-existing fields), must have email confirmation enabled so the wp_signups path is used, and must allow open user registration. That combination of stable site-state prerequisites is why CVSS 3.1 scores it 8.1 with AC:H despite PR:N/UI:N, and no public exploit code has been identified at the time of analysis.
Broken object-level authorization in the Wheels CFML framework (versions 1.1 through 4.1.2) allows an authenticated low-privileged user to tamper with other users' associated records through nested forms. The nestedProperties() helper resolves nested hasMany, hasOne, and belongsTo records by the primary key posted in the request without verifying that those rows belong to the parent record being saved, so an attacker who can legitimately submit a nested form for their own parent can reassign, edit, or - when allowDelete=true is configured - delete another parent's rows, and can also create new child rows with attacker-chosen identities when the child model uses a composite primary key that is not composed of foreign keys. The issue carries an assessed CVSS of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), requires authentication and actual use of nestedProperties() with nested forms, and is fixed in Wheels 4.2.0; no public exploit identified at time of analysis.
Broken object-level authorization in the Wheels (CFML) framework 4.0.0 through 4.1.2 lets an authenticated low-privilege attacker supply a record key to findByKey(), exists(key=), updateByKey(), or deleteByKey() and have the framework drop the application's scope condition (such as a tenant or owner filter), enabling read, modification, or deletion of another user's or tenant's record. The flaw is remotely exploitable (AV:N, PR:L, no user interaction) with high confidentiality and integrity impact but no availability impact, and the exists(key=) variant additionally leaks record existence by returning true for an out-of-scope key when the application runs in production mode with error information disabled. No public exploit code or CISA KEV entry is identified at time of analysis, and exploitation requires an application that relies on Wheels scopes for ownership or tenant authorization and passes request-supplied keys into the affected methods.
PHP object injection in the Gravity Forms WordPress plugin (all versions before 3.1.1) allows unauthenticated, network-reachable attackers to feed crafted serialized data into a PHP unserialize() call, which can lead to object injection and, if a suitable gadget chain is present in the running PHP stack, to full compromise of confidentiality, integrity, and availability. The flaw is rated CVSS 8.1 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning no credentials and no user interaction are needed, but the high attack-complexity component reflects that exploitation depends on a usable POP gadget chain existing in the plugin, WordPress core, or another installed plugin or theme. At time of analysis there is no public exploit identified (no CISA KEV listing and no published proof-of-concept in the supplied intelligence), and the vulnerability was reported through Patchstack to the vendor, with version 3.1.1 identified as the fixed release.
Broken object-level authorization in Tandoor Recipes before 2.6.12 lets an authenticated member of the same Space, holding read and write API scope, read and silently alter another member's private recipe instructions and ingredients by supplying those private step or ingredient identifiers to the Step/Ingredient API. The affected sub-resource ViewSets (StepViewSet, IngredientViewSet) filter only on active Space and apply role-level CustomIsUser checks instead of the private-recipe owner/sharing predicate, so a co-tenant is accepted without recipe-level authorization. No public exploit code has been identified at time of analysis, and the flaw requires legitimate write-scoped credentials in the victim's Space; it is fixed in version 2.6.12.
Apache Answer through 2.0.2 writes full API keys into application logs on every authenticated request, so anyone who can read those logs - directly or through downstream SIEM, log aggregation, backup archives, or support bundles - can recover and replay still-valid bearer credentials. The authoritative assessment scores this locally (AV:L, PR:L) rather than over the network, because log-read access is the gating prerequisite; an attacker without that position gains nothing. Recovered tokens must remain unexpired and unrevoked to be replayed, instances on 2.0.3 or later are unaffected, and no public exploit code has been identified at time of analysis (EPSS 0.20%, no CISA KEV listing), which supports a moderate rather than urgent priority.
Session hijacking via cross-site request forgery affects OpenHuman versions before 0.56.0: the unauthenticated loopback callback GET /auth/telegram accepts an attacker-supplied one-time Telegram login token and writes the returned JWT straight into the victim's local session store, switching the victim's active session to the attacker's backend account (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1 High). Because the malicious request is issued by the victim's own browser to 127.0.0.1:7788, the attacker needs only their own OpenHuman account, a valid one-time Telegram token, and a victim who visits a crafted page while their local core is running - no authentication to the victim host is required. Exploitation leaves subsequent agent actions, memory writes, and Telegram messages flowing into the attacker's account; no public exploit code or confirmed active exploitation was identified at time of analysis.
Arbitrary file and directory deletion in Countly Server (versions prior to 24.05.50 and 25.03.44) allows an authenticated user holding data-migration permission to pass a crafted exportid to the migration-deletion route and recursively remove any file or directory tree writable by the Countly server process, resulting in data loss and service disruption. The root issue is a path-traversal flaw (CWE-22) in plugins/data_migration/api/api.js in which the user-controlled exportid reaches clean_up_data in data_migration_helper.js without the sanitizeFilename-based containment checks introduced by the fix. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (base 8.1), confirming a network-reachable, low-complexity attack requiring an authenticated account (PR:L) with no user interaction, with high integrity and availability impact but no confidentiality exposure; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV). Vendor fixes are available in 24.05.50 and 25.03.44.
Privilege escalation to full WordPress site takeover is possible in the Backuply backup/restore plugin (all versions up to and including 1.5.8) via a second-order SQL injection that an authenticated subscriber-level user plants in the profile Biographical Info field and that only fires when an administrator later creates a backup capturing that value and then restores it. During the restore the injected SQL executes blind inside an INSERT into wp_usermeta, allowing the attacker to alter database records - most notably to set the default_role option in wp_options to administrator and enable open registration, so a subsequently registered account is granted Administrator rights. Exploitation cannot be self-triggered by the attacker (UI:R) and requires a valid authenticated account (PR:L, no anonymous path); no public exploit identified at time of analysis.
PHP object injection in the Search Regex WordPress plugin version 3.5 lets an authenticated attacker with subscriber-level access or above pass crafted serialized data into the plugin's replace_all function, which is then deserialized by PHP without validation. When a usable POP gadget chain exists in the installed plugin, WordPress core, or another active plugin, this object injection can be escalated to arbitrary code execution, giving the attacker full control of the site. No public exploit code or confirmed in-the-wild exploitation was identified at the time of analysis, and exploitation is conditional on both an authenticated account and a viable gadget chain.
Command injection (CWE-78) and stored XSS in Wheels CLI 4.0.0 through 4.1.1 allow an attacker who can influence inputs processed by the tool to run arbitrary shell commands as the SSH deploy user on deploy hosts and on the CI runner during builds. Deploy release/version/rollback values, package removal/destroy and extraction paths, and generator names are the primary injection surfaces, with unencoded scaffold 'show' views (since 4.1.0) and generated admin views permitting stored XSS; trigger inputs can come from CI variables, Git branch names, downloaded packages, or an AI agent using the CLI's MCP tools. The flaw is fixed in 4.1.2, and existing affected generated views also require a documented manual edit; no public exploit code has been identified at time of analysis.
Local privilege escalation in cifs-utils lets an unprivileged local user obtain root on affected hosts by injecting unauthorized options into a privileged CIFS mount. When a root-owned service mounts a Common Internet File System share using a credentials file whose contents the attacker can control or influence - for example a file that is world-writable or lives in an attacker-owned path - cifs-utils assembles those unsanitized values into the mount option string, so the attacker can slip in extra options that bypass permission checks and cause files to be executed with administrative privileges. The flaw is tracked as CWE-88 (argument/option injection) with a CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); exploitation requires an existing low-privilege local account (authenticated, per PR:L) and a deployment where such a privileged, credentials-file-driven CIFS mount workflow exists, so internet-facing hosts that do not mount attacker-influenced CIFS shares are not at risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and Red Hat has published advisory and Bugzilla tracking pages for RHEL 6 through 10 and OpenShift Container Platform 4.
Incorrect DBus policy in Lomiri Download Manager (lomiri-download-manager on UBports) allows any local user to read arbitrary files as root via the privileged DBus service, resulting in information disclosure. This local privilege escalation vulnerability affects all versions and requires local access to a device running UBports Lomiri/Ubuntu Touch with the service active. No public exploit code or active exploitation has been identified; risk is moderate due to the local-only attack vector.
Local privilege escalation in IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated, low-privileged user to obtain QSECOFR/Root authority, as described in CVE-2026-102917. The vulnerability has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires prior authentication and local access; it is not remotely exploitable. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support advisory.
Opening an attacker-crafted repository in Z.ai ZCode v3.11.2.6792 can lead to arbitrary code execution because the IDE automatically connects to MCP (Model Context Protocol) servers declared in the repository's workspace configuration without requiring user approval. The flaw is rated CVSS 7.8 with a local attack vector and required user interaction - a victim must actively open the malicious repository - and publicly available exploit code exists, though there is no confirmed active exploitation (not in CISA KEV), so the threat is conditional and interaction-dependent rather than a mass-exploitation emergency. Exploitation is unauthenticated from the attacker's perspective and grants high confidentiality, integrity, and availability impact on the affected host.
Improper quoting during SQL serialization in MariaDB Server 10.6.1 through 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2 and 13.0.1 and earlier allows a low-privileged authenticated attacker who can create a foreign-data-wrapper SERVER, USER, UDF, plugin, or trigger with crafted identifiers or option values to inject arbitrary SQL into the output of SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump; the injected statements execute only when a privileged operator later replays that generated SQL, such as during a dump restore. Exploitation requires both a pre-existing low-privileged account (CVSS PR:L) and a victim-initiated action (UI:R), so this is a conditional, stored-injection-style threat rather than an unauthenticated remote compromise. No public exploit code has been identified at time of analysis, and the issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
Authenticated blind server-side request forgery in Tandoor Recipes before 2.6.10 allows a user with privileges to create a Space and configure an AI provider URL to force the server to connect to arbitrary internal addresses. The AI actions behind TARGET/api/ai-import/ and api/ai-step-sort/ pass the attacker-supplied provider URL straight to LiteLLM, bypassing the application's safe_request outbound filtering, and the resulting connection success, refusal, or timeout is surfaced as a reachability oracle that can be used to map internal hosts, ports, and cloud metadata endpoints. Exploitation requires an authenticated account (PR:L) and the AI provider feature to be in use, and exposure is limited to a blind oracle rather than confirmed response-body exfiltration; no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV).
Missing authorization checks in ERPNext versions prior to 15.121.0 and 16.34.0 let any authenticated user with a low-privilege role invoke state-changing whitelisted endpoints - such as Ledger Merge, Process Period Closing Voucher start/pause/cancel, Repost Payment Ledger, Delivery Note sales return, payment order, and bulk transaction processing - without the write, submit, cancel, or role permissions those operations should require, allowing tampering with financial and transactional records beyond the user's assigned role. The flaw is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N), so exploitation requires a valid low-privileged account but no admin rights, no user interaction, and no non-default configuration; integrity impact is high while confidentiality is unaffected. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but the attack surface is standard functionality present in every affected deployment, so multi-user or internet-exposed instances should treat this as high priority. Vendor-released patch: 15.121.0 and 16.34.0.
Heap exhaustion denial of service in FasterXML jackson-core 2.16.0 and later allows an unauthenticated remote attacker to force allocation of roughly 100 MB or more per oversized JSON property name whenever untrusted JSON is parsed from a character-based source (String, Reader, or char[]), which is the normal path for a request body already read into a String. Because the maxNameLength bound (default 50,000 characters, ~100 KB) is only validated after the entire name has been buffered, the much larger maxStringLength bound (default 100,000,000 characters, roughly 200 MB with segment bookkeeping overhead) governs first, and repeating this across concurrent requests can exhaust the heap and crash the process. The impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available.
A previously paired Moonlight client that still holds its private key can bypass Sunshine's 'Disable' control and regain GameStream access by presenting an alternate certificate derived from its stored paired certificate. Affected builds (2026.329.165800 through pre-2026.906.222525) validated only that the presented certificate chained to a stored paired-client anchor and compared certificate text without canonicalizing equivalent PEM encodings, so the server never confirmed the connection came from the exact enabled paired identity. This is CWE-863 (Incorrect Authorization) and carries CVSS 3.1 base 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L); the vector's PR:L aligns with the requirement for a previously paired client identity, no public exploit code was identified at time of analysis, and removing (rather than merely disabling) the paired client severs the trust relationship.
Unauthenticated remote attackers can steal OAuth2 authorization codes from smart-sso deployments running version 2.1.1 or earlier by abusing an unvalidated redirectUri parameter in the /login handler (CWE-601). A victim who already holds an active SSO session must be induced into opening a crafted /login link, after which the attacker - who must additionally hold any valid OAuth2 client credentials - redeems the leaked code at /oauth2/access_token to obtain the victim's access token, giving both high confidentiality and integrity impact (CVSS 7.6 v4.0: AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). Exploitation is conditional rather than trivial: it fails if the victim has no active session, does not click the link, or if the attacker lacks valid client credentials, though no authentication to the SSO server itself is required (PR:N). No public exploit identified at time of analysis, although a public technical writeup describing the authorization-code leak path has been published; this is a genuine but conditional risk rather than a drop-everything emergency.
Unauthenticated path traversal in the 10Web Booster WordPress plugin (versions up to and including 2.34.5) lets remote attackers create arbitrary directories outside the plugin's cache root, with 0777 permissions applied recursively, and plant a cached page inside them by feeding unsanitized GET parameter names and values into the cache path. The write primitive is strictly limited - the filename is hard-coded to source.html and the body is the server-rendered page buffer rather than attacker-supplied content, so no executable file can be planted and code execution is not achievable, with the realistic outcomes being cache poisoning and stray directory creation (published CVSS 7.5 with I:H; the independent assessment revises integrity impact to Low), and no public exploit identified at time of analysis.
Remote MMS Read requests can crash libIEC61850 MMS servers running versions prior to 1.6.2 when the server's data model contains array-typed variables. An unauthenticated attacker (CVSS vector PR:N, AV:N) sends an alternate-array-access read with numberOfElements greater than zero and a sub-array range that exceeds the array bounds; the resulting out-of-range MmsValue_getElement call returns NULL, which is then passed to MmsValue_isDeletable and dereferenced, producing a NULL pointer dereference and process crash. Impact is availability-only (CVSS 7.5, C:N/I:N/A:H) and scoped to the array sub-access code path, since the single-element error path handles the same invalid index safely; no public exploit identified at time of analysis.
Unauthenticated path traversal in Countly Server before 24.05.50 and 25.03.44 lets remote attackers read arbitrary files that are readable by the server process, by abusing wildcard routes that serve public images and screenshots. The flaw affects deployments configured with the local filesystem backend of countlyFs (api/utils/countlyFs.js) - installs using the GridFS/database backend cannot be reached through these routes - and carries a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), so no credentials, privileges, or user interaction are required. Impact is limited to file disclosure (no integrity or availability effect); vendor-released patches exist in 24.05.50 and 25.03.44, and no public exploit identified at time of analysis.
Denial of service in pupnp (portable UPnP SDK) versions prior to 2.0.2 affects remote, unauthenticated deployments whose applications parse attacker-controlled XML and invoke ixmlElement_removeAttributeNode, causing the process to crash when ixmlNode_compare passes NULL nodeValue, namespaceURI, prefix, or localName fields to strcmp. The NULL fields arise legitimately from non-namespaced attributes created by ixmlDocument_createAttribute, and the crash occurs only when find_condition_node compares two distinct attribute objects with the same nodeName so the pointer-identity shortcut does not apply. No public exploit code or active exploitation was identified at time of analysis, and the vendor fixed the issue in 2.0.2 via commit 4b2f775e; impact is limited to availability (CWE-476, CVSS 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no code execution or data disclosure.
Unauthenticated attackers can read other customers' stored billing and shipping address PII on WordPress sites running the FluentCart plugin through version 1.7.0, exploiting an insecure direct object reference in the plugin's public AJAX checkout endpoint. Because the attacker supplies both the order_id and the address ID being compared, the plugin's internal id-equality guard is trivially satisfied, and sequential AUTO_INCREMENT order/address IDs can be enumerated at the soft rate limit of five requests per sixty seconds to harvest street address, city, state, postcode, phone, company name, VAT number and legal registration ID. The issue is confidentiality-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with no write, modification or availability impact; it is not listed in CISA KEV and no public exploit code was identified at time of analysis.
Privilege escalation in the InstaWP Connect - 1-click WP Staging & Migration WordPress plugin (all versions up to and including 0.1.4.1) lets any authenticated user at Subscriber level or above read the site's plaintext InstaWP master API key from a plugin settings page and redeem it for a full administrator session. The key is disclosed because the admin page is registered with a role name returned by InstaWP_Setting::get_allowed_role() in place of a real capability, and because generate_section_field() prints the master API key directly into a plain-text HTML input without a manage_options check; the attacker then derives the bearer secret from that key, satisfies the plugin's REST validate_api_request(), and calls POST /wp-json/instawp-connect/v2/auto-login to mint a 30-second single-use login URL that sets an administrator authentication cookie. Exploitation is not default-configured: it additionally requires the site to be actively connected to InstaWP (a valid master API key in instawp_api_options) and an administrator to have added the attacker's role to the plugin's Sync Tab Access list (instawp_sync_tab_roles) while still retaining administrator in that list, so realistic exposure is narrower than the 7.5 base score implies. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); authentication requirements are authenticated (CVSS PR:L) with high attack complexity (AC:H).
Denial of service in pupnp (libupnp) releases prior to 22.0.4 lets remote unauthenticated attackers stall the UPnP miniserver by feeding it hostnames that resolve slowly or not at all: parse_hostport() in uri.c synchronously calls getaddrinfo() while parsing inbound HTTP request targets and GENA SUBSCRIBE CALLBACK headers, so each request pins a worker thread for the resolver timeout. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with only availability impact (C:N/I:N/A:H, 7.5), a small number of crafted requests can exhaust the bounded miniserver worker pool and deny UPnP service to legitimate devices; no public exploit code was identified at the time of analysis, though the upstream fix commit and advisory are public. Realistically the issue is bounded and self-recovering - once the hostile requests stop, threads free up - and exploitation in practice presumes LAN reachability, since miniservers are normally bound to the local network.
Denial of service in pupnp (the portable UPnP SDK) versions prior to 2.0.2 allows unauthenticated remote attackers to exhaust process resources by sending HTTP messages that use Transfer-Encoding: chunked, which the internal parser decodes and buffers without ever enforcing the configured g_maxContentLength limit on the decoded entity. The flaw is reachable through default-enabled SOAP, GENA, miniserver, and control-point HTTP response paths, so any host that can reach a pupnp-based UPnP endpoint - commonly other devices on the same LAN segment - can trigger memory/resource exhaustion with no authentication or user interaction (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited; the vendor has shipped a fix in release 2.0.2.
Denial of service in JavaCV's IPCameraFrameGrabber affects all versions prior to 1.5.14, where an attacker-influenced MJPEG stream can supply an oversized Content-Length header that overflows a 32-bit buffer-doubling loop and traps the frame-grabbing thread in a permanent 100% CPU spin. Unauthenticated remote attackers can trigger this either by operating a malicious or compromised IP camera endpoint the application connects to, or by tampering with the plaintext HTTP response in transit; the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms no privileges or user interaction are required and that impact is limited to availability. No public exploit code was identified at time of analysis and there is no CISA KEV listing, and the vendor has released a fixed version (1.5.14).
SQL injection in the Vitepos - Point of Sale (POS) for WooCommerce WordPress plugin, affecting all versions up to and including 3.5.1, lets an attacker append arbitrary SQL through the 'src_by' parameter on the /vitepos/v1/vendor/list REST route and read sensitive data out of the site's database. Exploitation requires the affected plugin to be installed and active, and our assessment rates the route as reachable by any user holding a low-privileged POS role (for example vtpos-cashier) rather than by a fully anonymous visitor, although the vendor advisory also claims unauthenticated exploitation; no public exploit code has been identified at time of analysis. Impact is confidentiality-only - database disclosure, not modification - with no user interaction required.
Unauthenticated order enumeration and PII disclosure in the Klarna for WooCommerce (Klarna Payments for WooCommerce) WordPress plugin affects all versions up to and including 4.13.3, allowing any remote attacker to retrieve the secret order_key plus full billing and shipping personal data for any order in the store. Because the plugin fails to verify authorization (CWE-862) before emitting order details inline as the klarna_payments_params JavaScript variable on the order-pay endpoint, and WooCommerce order IDs are sequential integers, a full store-wide order dump can be obtained with ordinary sequential GET requests and no session, order_key, or credentials. The CVSS vector confirms the exposure is remote, unauthenticated, and requires no user interaction (AV:N/AC:L/PR:N/UI:N), with high confidentiality impact only; exploitation is trivially automatable, though no public exploit code and no confirmed active exploitation were identified at time of analysis. This is a genuine high-priority information-disclosure flaw rather than an inflated high-CVSS score, since every signal aligns with easy mass abuse across any default storefront running an affected version.
An authorization bypass in the FunnelKit Funnel Builder for WooCommerce Checkout WordPress plugin (all versions up to and including 3.16.0.6) lets unauthenticated attackers pull billing PII - full name, street address, email address, and phone number - for any WooCommerce order on a site by simply iterating sequential order IDs. Exploitation requires no authentication, privileges, or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 7.5), and the sequential ID space makes automated bulk extraction practical, so a single vulnerable store can leak its entire customer billing dataset. The hard precondition is that a FunnelKit thank-you page rendering the [wfty_order_meta] or [wfty_order_total] shortcode must exist and be reachable - stores that do not use these shortcodes are not exposed. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; Wordfence-coordinated disclosure tracks it as a genuine medium-to-high priority data-exposure flaw rather than a drop-everything emergency.
Sensitive information exposure in Modula Image Gallery 3.0.11 and earlier allows unauthenticated remote attackers to read the plaintext Password Protect password and username for published galleries by requesting the core WordPress REST route /wp-json/wp/v2/modula-gallery/{id}. The plugin redacts the same modulaSettings values on its dedicated /wp-json/modula/v2/gallery/{id}/settings endpoint, but the custom post type's show_in_rest=true registration leaves the core route without equivalent redaction. No public exploit identified at time of analysis; exploitation requires the target site to have enabled Password Protect for a gallery, so practical exposure is narrower than the 7.5 CVSS score suggests.
Privilege escalation in the Nexter Extension WordPress plugin (all versions up to and including 4.7.11) allows an authenticated Subscriber-level or higher user to restore a stale stored Administrator role onto their own account, effectively becoming an Administrator. Exploitation is tightly constrained: the attacker's account must previously have held the Administrator role, must have used the plugin's View Admin Role Switcher, and must have been demoted specifically through the wp-admin/users.php?action=promote bulk role-change control rather than the Edit User screen. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, and the assessed conditions are why the effective risk is lower than the 7.5 (HIGH) base score implies.
Rendering untrusted Markdown with the Go library github.com/gomarkdown/markdown while the html.Safelink hardening flag is enabled can crash the calling process: parser.IsSafeURL slices a link destination before validating its length and panics on empty, '.', or '..' destinations such as the input `[x]()`, and every version before 0.0.0-20260724235538-61af6e1e6971 is affected. The same panic is reachable without that flag by any downstream caller that passes a 0/1/2-byte attacker-controlled URL directly to the exported parser.IsSafeURL function, yielding a remote, unauthenticated, availability-only denial of service (CVSS 3.1 score 7.5; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exploitation is conditional rather than universal - the default render path with Safelink disabled never reaches the vulnerable code, there is no confirmed active exploitation (not in CISA KEV), and the upstream advisory itself publicly documents the minimal crash trigger.