Account enumeration in ikas E-Commerce Infrastructure (all versions through 2026-07-13) allows unauthenticated remote attackers to determine whether a given customer account exists by observing distinguishable responses from authentication-related endpoints such as login, registration, or password reset. The flaw is reached remotely with low complexity and no user interaction, but only discloses account existence rather than credentials or data, and no public exploit code has been identified at time of analysis. Note that the input score of 7.5 (HIGH) assumes a high confidentiality impact, whereas the assessed vector (C:L, no I/A) reflects a more limited information-disclosure impact typical of username enumeration; treat the exposure as a reconnaissance enabler for credential stuffing and phishing rather than as direct system compromise.
Apache Kylin versions 4 through 5.0.4 expose sensitive information to unauthorized actors through a CWE-200 flaw that, per the CVSS vector, can be reached remotely without authentication or user interaction (CVSS 3.1: 7.5). The advisory does not specify the exact endpoint or configuration condition, so practical exposure depends on whether a vulnerable Kylin instance is network-reachable; Kylin is typically deployed inside internal big-data and analytics clusters. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.20% (9th percentile).
Apache Kylin versions 4 through 5.0.4 expose their SQL black list - the defensive configuration that enumerates blocked SQL patterns - to an unauthorized actor, allowing unauthenticated network-reachable parties to read it (CWE-200). The official CVSS v3.1 vector scores this 7.5 (AV:N/AC:L/PR:N/UI:N with C:H), while our assessed vector reduces confidentiality impact to C:L because the disclosed data is defensive configuration rather than business data; integrity and availability are unaffected in either reading. Exploitation requires only that the Kylin service be reachable and the SQL black list feature be configured, with no authentication or user interaction needed; EPSS is low at 0.20% (9th percentile), no public exploit code was identified, and the issue is not confirmed actively exploited (CISA KEV).
Unauthenticated, network-reachable Apache Kylin instances (versions 4.0.0 through 5.0.4) allow cross-project job manipulation that exposes job data belonging to other projects, giving remote attackers a confidentiality impact rated 7.5 by the vendor. The realistic attack surface is narrow: Apache explicitly notes that only Kylin deployments directly exposed to the public internet are meaningfully at risk, calling that configuration 'not common' and stating in-house deployments are 'mostly not impacted.' No public exploit code has been identified at time of analysis and EPSS is just 0.20% (9th percentile), so despite the high base score this is a low-priority item for most organizations; the vendor-released fix is version 5.0.5.
Unauthenticated network access to Apache Kylin 4 through 5.0.4's job-management interface can expose job-discard operations and related information to an unauthorized actor, with the independent assessment rating confidentiality, integrity, and availability impact as low despite the official 7.5 CVSS score. Exploitation depends on the Kylin service being directly reachable from an untrusted or public network; vendor guidance says this deployment pattern is uncommon, and segmented in-house instances are largely unaffected. No public exploit identified at time of analysis, no CISA KEV confirmation was provided, EPSS is 0.20% (9th percentile), and upgrading to 5.0.5 resolves the exposure.
Perl's Text::CSV_XS module (versions before 1.65) contains a buffer under-read in its XS whitespace-stripping routine: when parsing an all-blank field with the non-default allow_whitespace option, cx_strip_trail_whitespace walks backwards past the start of the field's heap buffer, reading and potentially zeroing one byte before it. Reaching that path requires a specific input shape - an unquoted all-blank field preceded by an escape_char that differs from quote_char, or a quoted field in getline whose line ends in two carriage returns - and an allocator layout where the physically preceding byte is itself a space or tab, so the effect is layout-dependent and reliably observable only under valgrind/ASan. Remote unauthenticated attackers who can influence CSV input to an application that enables allow_whitespace are the exposure surface; the impact ranges from a one-byte out-of-bounds read (the CVE's information-disclosure reading, 7.5) to limited memory corruption (I:L/A:L in this independent assessment), and no public exploit code or active exploitation (CISA KEV) was identified at time of analysis, with EPSS low at 0.19% (8th percentile).
Quadratic CPU consumption in Text::CSV_XS releases before 1.65 lets remote attackers exhaust CPU on Perl applications that parse attacker-supplied CSV through getline() with the default (unset) eol and classic Mac CR-only line endings. Because CR-only input arrives from Perl's default line reader as a single chunk, the parser re-copies the entire unparsed remainder after every record, so parsing cost grows with the square of the input size - seconds of CPU per megabyte and escalating rapidly with larger payloads. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), and EPSS is low at 0.19% (8th percentile); no public exploit code or CISA KEV entry has been identified at time of analysis, making this a high-scored but low-urgency availability issue.
Memory exhaustion in the Perl Text::CSV_XS library before version 1.65 allows remote attackers to terminate a process by supplying an oversized RFC 7111 fragment selector. The fragment() and csv() methods expand row=, col=, and cell= selectors into one array element per requested index before any data is read, so a selector such as row=1-400000000 against a two-line file allocates 400 million elements and ends the process with an out-of-memory error that Perl's eval cannot catch. Only applications that pass request-supplied fragment strings into this feature are affected; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.19% (8th percentile).
Denial of service in OpenModSim 1.11.0 and earlier is triggered when the Modbus master simulator processes a maliciously crafted Modbus response containing a length or count value that causes a CWE-190 integer overflow, resulting in a crash or availability loss. The assessed vector requires user interaction because the operator must connect the tool to an attacker-controlled or compromised Modbus slave/server; no authentication is required (PR:N), and impact is limited to availability with no code execution or data disclosure. No public exploit was identified at time of analysis, CISA KEV does not list this issue, and EPSS is low at 0.15% (4th percentile).
Out-of-bounds reads in the X.Org X client libraries - libXrender before 0.9.13 and libXtst before 1.2.6 in the parsing paths covered by this entry, alongside the sibling fixes shipped in libX11 1.8.14, libXi 1.8.4 and libXpm 3.5.20 - let a malicious or compromised X server crash connecting clients by returning malformed protocol replies. The clients trust length, count and category fields supplied by the server (for example the depth, visual and subpixel counts used when building XRenderInfo, and the datum/category handling in libXtst's XRecord reply parser) without validating them against the actual received buffer, so parsing walks past the end of the packet and causes a denial of service. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), the attacker is unauthenticated from the network but exploitation requires user interaction - the victim must launch or connect an affected client to the hostile server (for example via ssh -X/-Y X11 forwarding to a compromised display) - and there is no public exploit identified at time of analysis.
Multiple out-of-bounds read and write defects in the X.Org X client libraries (libX11, libXi, libXpm, libXrender, libXtst) let a malicious or compromised X server send crafted replies that drive client-side parsers past the end of the received buffer, crashing the linked application and, in the libX11 XKB case, writing past an allocated array. Affected are libX11 before 1.8.14, libXi before 1.8.4, libXpm before 3.5.20, libXrender before 0.9.13 and libXtst before 1.2.6; exploitation requires the victim's client to connect to an untrusted server and, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (6.5), the craftwork is unauthenticated but needs user interaction, with demonstrated impact limited to denial of service rather than code execution. No CVSS vector, EPSS score, KEV entry or POC indicator was supplied for CVE-2026-109090 specifically, so no public exploit identified at time of analysis and quantitative exploitation signals are absent.
Unauthenticated denial of service in Countly Server prior to 24.05.50 and 25.03.44 lets any remote network attacker crash the Node.js process that serves the analytics API by requesting a public image or screenshot route (star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and other */screenshots/* paths) whose path contains a URL-encoded dot. On deployments using Countly's local filesystem storage backend, that crafted path makes createReadStream open a directory instead of a file; the resulting asynchronous EISDIR error has no listener on the piped stream, so it surfaces as an unhandled exception and terminates the server process. Repeated requests keep the API unavailable; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a low-complexity, unauthenticated, availability-only impact with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was identified at time of analysis.
An unauthenticated remote client can disclose stale memory contents from a libIEC61850 server running the MMS file service, because a crafted out-of-range initialPosition in a fileOpen request drives an unsigned integer underflow in the fileRead path and produces an oversized response that appends leftover bytes from the reused connection buffer. All versions prior to 1.6.2 are affected, and exploitation requires only network reachability to the MMS/TCP listener with the file service enabled - a non-default configuration. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation, though the independently assessed confidentiality impact is moderate rather than catastrophic since the attacker cannot select or guarantee the sensitivity of the leaked bytes.
Out-of-bounds heap reads and writes in spice-server's SPICE_MSGC_MIGRATE_DATA handling let an authenticated SPICE client read arbitrary heap memory or corrupt the heap while a VM is undergoing live migration. Consistent with the assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H vector, the attacker must already hold a valid SPICE session and must land the malicious message inside the migration window, so real-world exposure is concentrated in deployments where the SPICE endpoint is reachable by low-privilege or untrusted users. No public exploit code and no CISA KEV entry were identified at time of analysis.
Heap buffer overflow in spice-server's GLZ encoder dictionary restore path allows an authenticated SPICE client to corrupt memory during a VM live migration by supplying a crafted max_encoders value; a size_t allocation size is truncated to int before the malloc callback, enabling a large out-of-bounds heap write. Exploitation requires an authenticated SPICE client connection (PR:L) and an active live migration with GLZ compression in use, which narrows the practical window; no public exploit identified at time of analysis. An upstream fix is proposed in GitLab merge request 253.
Unauthenticated exposure of system-level configuration information in Apache Kylin 4.0.0 through 5.0.4 lets any client that can reach the Kylin service retrieve sensitive deployment details, rated CVSS 3.1 base 7.5 (HIGH) with high confidentiality impact but no integrity or availability effect. Per the assessed vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is required, so default-reachable instances are exposed; exposure is limited mainly by whether the instance is network-reachable, and deployments confined to internal networks or placed behind authenticating proxies are significantly less at risk. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so prioritization should be driven by network exposure of Kylin installations rather than by observed exploitation. Upgrading to 5.0.5 is the vendor-recommended fix.
Stored cross-site scripting in the HivePress Business Directory, Listings & Classified Ads plugin for WordPress (all versions up to and including 1.7.32) allows unauthenticated attackers to persist arbitrary JavaScript that executes whenever a user views a page rendering an affected custom user attribute. The published CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N); our assessment retains that score but raises attack complexity to High (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) because exploitation depends on a site administrator having configured a custom user attribute whose display_format template places the %value% token inside an href, src, or style attribute context - a documented but non-default use of the plugin's attribute display feature. No public exploit identified at time of analysis, and although an upstream fix has been merged (PR #375 / changeset 3747070), the realistic affected population is limited to sites with such an attribute template already in place.
Stored cross-site scripting (XSS) in the Colibri Page Builder WordPress plugin versions up to and including 1.0.390 allows unauthenticated attackers to inject arbitrary web scripts via the comment parameter; the payload is stored and executes when any user views the injected page. The vulnerability has a CVSS v3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and no public exploit has been identified at time of analysis. While the score is elevated due to scope change and low confidentiality/integrity impact, the practical risk is notable but the raw score overstates the absolute danger; sites with comments disabled are not exposed.
OS command injection in SparkyFitness versions prior to 1.6.0 allows an authenticated global administrator to execute arbitrary operating-system commands on the server by uploading a restore archive with a filename containing shell metacharacters. The vulnerability resides in the api/admin/backup/restore endpoint, which improperly interpolates the user-supplied filename into a shell command. Exploitation requires the highest-level application privilege (global admin), and no public exploit code has been identified at time of analysis. The issue is fixed in version 1.6.0.
Unauthenticated stored cross-site scripting in the WordPress plugin Flying Scripts (Delay JavaScript to Improve Site Speed & Performance) through 1.2.4 lets attackers inject script through comment input that the plugin's output-buffer rewriter later re-emits into an HTML attribute. The bypass relies on a crafted payload using only WordPress kses-allowed markup-an <abbr title> attribute plus a double-quote-bearing <code> body-and the plugin's predictable unsalted ___noise___ placeholder substitution, so the script executes when a victim views the affected page. No public exploit identified at time of analysis, and exploitation requires the vulnerable plugin to be installed with its rewriting active and a comment or equivalent input path enabled, making this a moderate-priority issue despite the CVSS 7.2 scope-changed rating.
Stored cross-site scripting in the GoSMTP Pro WordPress plugin (all versions up to and including 1.2.3) lets unauthenticated attackers plant arbitrary JavaScript inside the plugin's email-log records by submitting a comment crafted so that it survives WordPress comment kses moderation while entity-encoded, then is decoded into live HTML by core email notification handling and written verbatim to the plugin's log table. The script fires only when a privileged user, typically an administrator, opens the email-log page in wp-admin, which keeps real-world impact moderate despite the network-reachable, unauthenticated injection path; there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis. Exposure is limited to sites that accept comments from unauthenticated visitors and have GoSMTP Pro active with comment notification email logging enabled, while sites with comments disabled or logging unused are not affected.
Stored cross-site scripting in the Schema & Structured Data for WP & AMP plugin (versions up to 1.67) allows unauthenticated attackers to inject arbitrary JavaScript via the 'saswp_review_text' parameter, because the nonce used as the sole authorization check is publicly exposed in the [saswp-reviews-form] shortcode. Exploitation requires the shortcode to be present, making it a genuine but deployment-specific issue that sits in the mid-tier of urgency. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Feedzy RSS Feeds (RSS Aggregator by Feedzy) WordPress plugin, affecting all versions up to and including 5.2.11, allows a remote attacker to place arbitrary JavaScript into a page generated from an imported feed item by embedding a payload in the 'media:thumbnail@url' field, which then executes when a user views that page. The bug is not exploitable against an arbitrary site: the target must already have the plugin configured to import from an RSS feed whose content the attacker controls or can influence, and the script only fires when a visitor or administrator opens the resulting page. The published CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reads as a low-complexity unauthenticated issue, but the assessed vector raises attack complexity to High (AC:H) because of the feed-control prerequisite; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, and the vendor has released version 5.2.12 that fixes the flaw.
Stored cross-site scripting in the TranslatePress - Translate Multilingual Sites with AI Translation WordPress plugin through version 3.3.7 allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which then execute in the browser of any visitor who loads the affected translated page. Successful exploitation depends on two conditions that coincide with the plugin's normal use case: the site must permit unmoderated comment submission on at least one post (WordPress holds first-time commenters for moderation by default, so this usually means a modified Discussion setting), and a secondary language must be configured so that comments are processed by the plugin's translation-render code path. Wordfence rates the issue at CVSS 3.1 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), confirming unauthenticated remote exploitation with no user interaction on the attacker's side and a scope change reflecting how stored script in a comment can act beyond the vulnerable component, and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the SureCart plugin for WordPress (versions up to and including 4.9.4) allows unauthenticated attackers to inject arbitrary web scripts via the 'comment' parameter, which execute when a victim visits a page that loads the SureCart components runtime and lacks an sc-checkout element. While the entry point is unauthenticated, successful exploitation requires a specific combination of page layout (e.g., a post with a [sc_buy_button] shortcode and no sc-checkout element) and victim interaction, significantly limiting the real-world attack surface. No public exploit identified at time of analysis.
Stored DOM-based cross-site scripting in the WordPress plugin Opti-Behavior (Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights) through version 1.9.2.1 lets unauthenticated attackers write arbitrary script content into heatmap/analytics records via the 'targetUrl' parameter, which is later rendered into a DOM sink when a user - most plausibly an administrator viewing the heatmap analytics metabox - accesses the injected page. The write endpoint is gated only by a nonce (optiBehaviorHeatmapConfig.nonce) that the plugin itself publicly emits to every anonymous visitor on tracked pages, so no account or login of any kind is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C, 7.2). Exploitation requires the plugin to be installed and active with heatmap/session tracking enabled on at least one page; no public exploit code was identified at time of analysis and there is no CISA KEV confirmation of active exploitation, though the code references in the advisory make the vulnerable paths easy to locate.
Stored cross-site scripting in the Mang Board WordPress plugin (all versions up to and including 2.4.3) lets unauthenticated attackers inject arbitrary JavaScript that executes in the browser of any user who later loads the poisoned board content. The injection path is unusually easy because the wp_ajax_nopriv_mb_template endpoint is publicly reachable, nonce verification is not enforced in content_reply mode, and admin-ajax.php answers with Content-Type: text/html so script tags embedded in the JSON body are parsed and executed. Wordfence rates it CVSS 7.2 (scope changed, PR:N/UI:N) and an upstream fix commit is referenced in the plugin's Trac changeset, but no public exploit code has been identified at time of analysis and there is no confirmed active exploitation, so this is an elevated-priority, patch-now issue rather than a top-tier emergency - the residual constraint is that execution requires a victim, ideally a privileged one, to view the injected page.
Cross-team authorization bypass in APIPark through 1.9.7-beta allows an authenticated team manager to read, modify, and delete services and applications belonging to other teams by supplying their own team identifier in the 'team' query parameter to /api/v1/service/info and /api/v1/app. Exploitation requires a valid team-manager account on an instance configured with multiple teams; the attacker first enumerates foreign service and app IDs via /api/v1/simple/services and /api/v1/simple/apps, and no user interaction or non-default settings are needed. The vendor CVSS 4.0 base score is 7.2 (High) with low confidentiality and high integrity/availability impact on other teams' resources, and no public exploit identified at time of analysis, though a public technical writeup documenting the bypass exists.
Stored cross-site scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions up to and including 3.5.54) lets unauthenticated attackers upload a text-type file whose contents begin with HTML markup, which is then persisted and executed in the browser of any user who later views the injected page - a classic CWE-79 stored XSS. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), no authentication or user interaction is needed to deliver the payload, though execution depends on a victim subsequently loading the affected page. Exploitation is only reachable on sites that run the plugin and expose its file-upload/database add-on on a Contact Form 7 form; there is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a credible moderate-priority web flaw rather than an emergency.
Stored cross-site scripting in the Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (all versions up to and including 7.5.5) allows unauthenticated commenters to plant script payloads in comment content that execute in visitors' browsers once the comment is approved and rendered. The flaw is a bypass of WordPress's wp_kses comment sanitization: the payload uses only allow-listed tags and hides executable tokens as plain text inside quoted attribute values, and the XSS is only realized when Complianz's own Cookie-Blocker output-buffer filter applies str_replace() rewrites that break out of the attribute context. Attack complexity is assessed as High rather than Low, because exploitation requires the Cookie-Blocker output buffering and the yotu-wp integration code path to be active, and critically requires a moderator to approve the malicious comment before it renders; no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Overall this is a real but non-urgent, lower-tier issue gated by human comment moderation rather than a mass-exploitation priority.
Stored cross-site scripting in the WordPress plugin CP Multi View Events Calendar (CodePeople) in all versions up to and including 1.4.42 lets unauthenticated attackers inject arbitrary JavaScript through the CalendarTitle parameter, which is then rendered without escaping and executes in the browser of any user - including administrators - who later views the poisoned calendar page. Exploitation is conditional on a non-default configuration: a site administrator must have enabled the 'Allow edition in frontend?' option on at least one calendar view, which exposes the unauthenticated event-add endpoint together with a publicly accessible nonce that the attacker uses to submit the malicious title. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, but the 7.2 CVSS score with PR:N (unauthenticated) and scope change (S:C) makes the attack path low-complexity once that frontend-editing setting is active.
Stored cross-site scripting in the Salon Booking System WordPress plugin (Appointment Booking for Salons, Barbershops & Spas, all versions up to and including 10.31.9) lets unauthenticated attackers inject arbitrary JavaScript through the sln[<checkout-field-key>] checkout parameter, which is persisted and later executed when a user loads the affected page - in practice the admin customer view. Impact is conditional: the site must have at least one admin-configured custom checkout field of type Html or File, a documented but non-default plugin feature, so sites without such a field are not exploitable. No public exploit code has been identified at time of analysis, and the independent assessment rates the issue as a moderate, conditional risk rather than an emergency, downgrading the vendor's AC:L to AC:H because of the configuration dependency and the admin-context trigger.
Stored DOM-based cross-site scripting in the Opti-Behavior WordPress plugin (all versions up to and including 1.9.2.1) allows unauthenticated attackers to inject arbitrary JavaScript that executes when a victim later views recorded heatmap, session, or analytics data. The heatmap recording endpoint requires no authentication, and its only guard - a nonce - is freely obtainable by any anonymous visitor through the plugin's public opti_behavior_refresh_nonces AJAX action, so there is effectively no privilege barrier; the payload is stored rather than reflected, meaning it fires only when an administrator or other user loads the affected analytics page. The assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), there is no CISA KEV entry and no public exploit code identified at time of analysis, and it should be treated as a genuine but moderate-priority issue rather than an emergency.
Stored cross-site scripting in WPConsent (Cookie Banner & Cookie Consent for Privacy Compliance) through 1.1.9 allows unauthenticated attackers to inject arbitrary web scripts into comment content that execute when a user views an injected page. Exploitation is constrained: it requires the optional Script Blocking feature to be enabled, the ability to submit comments that are rendered, and two coordinated comments that place event-handler syntax in an allowed code element and the deterministic ___noise___ restoration key in an allowed abbr title attribute, with the key offset confirmable via an unauthenticated wpconsent_debug=1 request. No public exploit identified at time of analysis, and the assessed vector is AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, so the non-default configuration and precise coordination limit realistic exploitation below the raw 7.2 score.
Stored cross-site scripting in the WordPress Profile Builder plugin (Cozmoslabs) affects all versions up to and including 4.0.3 and lets unauthenticated remote attackers plant arbitrary JavaScript through the First Name registration field, which executes in the browser of any user who later views the injected page - realistically an administrator processing pending registrations. The attack is explicitly gated on the plugin's Email Confirmation feature being enabled, so sites using default or other registration flows are not reachable through this path. Scoring is CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) with a scope change reflecting script execution in the victim's browser context, and no public exploit has been identified at time of analysis.
Stored cross-site scripting in the NotificationX WordPress plugin (all versions up to and including 3.3.3) lets remote unauthenticated attackers inject arbitrary JavaScript through the 'name' parameter, which then executes in the browser of any visitor loading an affected page. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2), no authentication or victim interaction is required to deliver the payload, but exploitation is conditional: a site administrator must first enable the WordPress.org Reviews campaign and place the notificationx-pro/notificationx dynamic block on a publicly reachable page, neither of which is a default configuration. No confirmed active exploitation (not in CISA KEV) and no public exploit code has been identified at time of analysis, and the independent assessment rates this as a real-but-conditional, lower-tier priority rather than an urgent threat; a fix is available in version 3.3.4.
Stored DOM-based cross-site scripting in SiteOrigin CSS 1.6.7 and earlier allows unauthenticated attackers to inject scripts through the WordPress comment 'Website' (comment_author_url) field, executing when a victim loads a page where the plugin renders the stored comment URL into a DOM sink. Exploitation requires the site to accept comments from unauthenticated visitors and to use an affected plugin version; the CVSS 3.1 score of 7.2 reflects network reachability, low complexity, no authentication, and a scope change, with limited confidentiality and integrity impact. No public exploit code was identified at time of analysis.
Stored DOM-based cross-site scripting in the SiteOrigin CSS WordPress plugin (all versions up to and including 1.6.7) lets an unauthenticated attacker smuggle script into a page via the 'href' parameter, which the plugin's Visual Inspector later writes into the DOM without sanitization. Exploitation is not self-firing: the attacker's comment must survive moderation and be approved, and an administrator must subsequently open the Visual Inspector and manually click the injected anchor link - a mandatory user-interaction step that the CVSS base vector understates (our assessment re-scores it AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N versus the published 7.2). There is no confirmed active exploitation or public exploit code identified at time of analysis, and the practical impact is bounded to script execution in an authenticated administrator's browser context.
Unauthenticated attackers can store arbitrary JavaScript in WordPress sites running the Simply Schedule Appointments plugin through version 1.6.12.35 by submitting an unsanitized 'status' parameter; the payload is written to the plugin's debug log unconditionally because debug logging is enabled by default. The script does not fire automatically for arbitrary visitors: execution is gated behind the plugin's debug-log viewer, which is reachable by anyone holding the site-wide Support PIN (an HMAC-MD5 of AUTH_SALT displayed in wp-admin), so the realistic victim is an administrator or support agent reviewing the log during routine troubleshooting, where the script executes in their session (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). There is no CISA KEV listing and no public exploit code identified at time of analysis, and the practical risk is lower on sites that rarely open the debug log or that rotate/restrict the Support PIN; signals are moderately concerning but do not indicate an urgent, widespread threat.
Stored cross-site scripting in the premium build of the User Registration PRO WordPress plugin (all versions up to and including 6.2.9) lets unauthenticated attackers inject arbitrary JavaScript through the HTTP Referer header into a vulnerable AJAX endpoint, with the payload persisting so it executes whenever a victim loads the injected page. The nonce that normally protects that endpoint is localized into the page source of every front-end page for anonymous visitors, so no account or credentials are required, although the attacker must target a site running the paid premium build - the free WordPress.org distribution is not affected - and the payload only fires once a user actually visits the compromised page. No public exploit code and no confirmed active exploitation were identified at time of analysis; the assessed severity of 7.2 reflects the scope change and the limited, though real, confidentiality and integrity impact of script execution in a victim's browser.
Stored cross-site scripting in the WP Ghost (Hide My WP Ghost) - Security & Firewall plugin for WordPress versions up to and including 7.0.12 lets unauthenticated attackers inject arbitrary web scripts through the plugin's replaceHeadersAndTags function, which performs insufficient input sanitization and output escaping; the injected payload persists and executes in a victim's browser when they click the crafted link, with impact limited to that victim's session (no availability impact). Exploitation requires the affected code path to be reachable on a site running 7.0.12 or earlier, but no authentication (CVSS PR:N) and no special non-default plugin configuration; although the published CVSS 3.1 vector scores UI:N, the practical trigger is a victim clicking the injected link, which is why our assessment adjusts user interaction to UI:R while keeping the same 7.2 base impact. The vendor has released a fix in version 7.0.13 (WordPress.org changeset from 7.0.12 to 7.0.13), no public exploit code has been identified and there is no CISA KEV entry indicating active exploitation at time of analysis. Reported by Wordfence, a credible source for WordPress plugin vulnerability intelligence.
Cross-tenant authorization bypass in Magistrala through 1.0.0 allows any authenticated member of a workspace to view, issue, and revoke device certificates belonging to other tenants by supplying foreign serial numbers or entity/device IDs to the certs service (RevokeBySerial, RevokeAll, ViewCert, ListCerts, IssueCert). A successful attacker can disconnect other tenants' devices, disclose their certificates, and mint CA-signed certificates for arbitrary device IDs, giving high integrity and availability impact with limited confidentiality exposure (assessed CVSS:3.1 base 7.2, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H). Exploitation is not pre-authentication, and no public exploit was identified at time of analysis; the practical risk is greatest on multi-tenant deployments that actively use the certificate service.
Mailu, an open-source mail server distributed as a set of Docker images, contains an authorization flaw that lets an authenticated domain manager reset the password of, or mint an API token for, a higher-privileged account that merely owns a mailbox in a domain they manage - including a global admin or a manager of another domain. Because the vulnerable endpoints are the user edit, password reset, and token creation flows, a successful attack grants full control of the victim account and all of its privileges, escalating a limited domain-manager role into global administrative control; the CVSS 3.1 vector is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid domain-manager credentials and the specific condition that a higher-privileged user owns a mailbox inside the attacker's managed domain, so single-tenant installs with no delegated domain managers are effectively not exposed; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Stored cross-site scripting in the WP Sessions Time Monitoring Full Automatic WordPress plugin affects all versions up to and including 1.1.5 and allows unauthenticated attackers to inject arbitrary JavaScript that persists in the site's stored data. Because the CVSS vector is PR:N, exploitation requires no prior authentication, but the injected payload only fires when a victim - typically an administrator reviewing the plugin's active-session and activity views - subsequently loads the affected page, so impact is deferred and depends on a privileged user visiting the poisoned view. The issue is assessed as moderate priority rather than a top-tier emergency, and no public exploit code or confirmed active exploitation was identified at time of analysis; the primary mitigations are updating or disabling the plugin and restricting exposure of its admin views.
Path traversal in WildFly's management take-snapshot operation lets an authenticated user holding only the Monitor RBAC role write a copy of the server configuration to an arbitrary filesystem location and then read it back, bypassing RBAC restrictions to disclose sensitive credentials. This is a credible, moderate-priority privilege-boundary bypass rather than a critical internet-facing threat, because exploitation requires an authenticated management session and a reachable management endpoint; no public exploit code has been identified at time of analysis and no vendor-released patch version is specified in the provided data.
Authenticated SQL injection in ZR.Admin.NET through 3.8.2 allows any account holding the system:user:list permission to inject subquery or CASE expressions into the ORDER BY clause of the shared ToPage paging helper by supplying a crafted PagerInfo.Sort query parameter to GET /system/user/list, enabling blind extraction of database contents such as stored credentials. The flaw is read-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor-published CVSS 4.0 base of 7.1) and requires a valid low-privileged session with that specific list permission, so it is not remotely exploitable without authentication. No public exploit code and no confirmed active exploitation were identified at time of analysis, though a public technical writeup describing the ORDER BY injection path exists; a vendor patch is available.
Authenticated SQL injection (CWE-89) in FilePress through version 3.0.1 lets any low-privilege logged-in user inject arbitrary SQL into the ORDER BY clause through the unvalidated 'asc' parameter, enabling blind boolean- or time-based extraction of database contents including administrator credential hashes. The affected endpoints are dzz/pichome/library/filelist.php and dzz/collection/filelist.php; exploitation requires a valid authenticated session (PR:L) rather than anonymous access, and the injected queries are read/inference-based so the assessed impact is confidentiality-only. No active exploitation is confirmed (not in CISA KEV) and no public exploit identified at time of analysis, though the CVE record references a public technical writeup describing the injection point; rated CVSS 7.1 (4.0) / 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, making this a moderate, contained priority.
Integer overflow in pupnp's HTTP Content-Length parser (raw_to_int in upnp/src/genlib/net/http/httpparser.c) allows a remote adjacent-network attacker to desynchronize the parser from the declared body length on LP64 builds, enabling either request smuggling in persistent or proxied contexts or a denial of service by forcing a worker to wait for an oversized body. Affected are all pupnp releases prior to 2.0.2 across the whole CPE range cpe:2.3:a:pupnp:pupnp:*:*:*:*:*:*:*:*; no authentication (PR:N) and no user interaction (UI:N) are required, though exploitation is limited to adjacent/link-local reachability (AV:A) and to 64-bit builds where long is 64 bits and int is 32 bits. No public exploit identified at time of analysis; vendor-released patch: 2.0.2.
Authenticated users of Rocboss paopao-ce through 0.6.0-alpha.3 can obtain signed download URLs for other users' private, friend-only, and following-only media by requesting arbitrary content IDs from the /v1/attachment endpoint. Because post_content IDs are sequential, an ordinary registered low-privileged account (no administrative role required) is enough to enumerate IDs and harvest images, videos, and attachments belonging to other users, giving a high confidentiality impact with no write or availability effect. This is a genuine but bounded data-confidentiality issue rather than a critical infrastructure threat; no public exploit code was identified at time of analysis, although a public technical write-up describing the cross-user IDOR is referenced.
Mall4cloud through 4.0 allows an authenticated merchant to read other shops' buyer shipping addresses by enumerating sequential orderAddrId values through GET /m/order/order_addr/{orderAddrId}, exposing consignee names, mobile numbers, addresses, and post codes. The flaw is an insecure direct object reference (CWE-639) in the multishop OrderController getOrderAddr handler, which serves records without an ownership or tenant check. Exploitation requires a valid merchant account and use of the multishop order module, so the realistic threat population is registered sellers rather than anonymous internet users; no public exploit identified at time of analysis, no CISA KEV active exploitation is noted, and the signals are moderately consistent but point to a targeted, not mass-exploitation, profile.