Stored cross-site scripting in the Document Gallery WordPress plugin through 5.1.1 lets any authenticated user with the Contributor role or higher embed malicious event-handler attributes inside gallery shortcode attributes, which are then rendered unescaped into the page markup. Because the injected payload is stored in post content, it executes in the browser of a higher-privileged editor or administrator who later views or previews that content, potentially leading to session/token theft or full site takeover via an admin session. Publicly available exploit code exists (WPScan advisory), but the flaw is not in CISA KEV and carries no EPSS score in the supplied data, so there is no evidence of active or widespread exploitation - only demonstrated feasibility. Risk is tempered by the required authenticated foothold and the mandatory privileged-victim interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N per independent assessment).
Stored cross-site scripting in the Blaze Demo Importer WordPress plugin before 1.0.17 allows authenticated users holding the Author role or higher to upload crafted SVG files that execute arbitrary JavaScript in the browser of any user who later opens or previews them. The plugin both skips sanitization of uploaded SVGs and unconditionally registers the SVG MIME type with the WordPress media library, bypassing WordPress's default block on SVG uploads. Publicly available exploit code exists and the issue carries a moderate CVSS 6.8; because the payload is passive-stored and only fires when a second user (typically an administrator) opens the file, risk is concentrated on multi-author sites that grant Author accounts to untrusted or self-registered users, while sites with only trusted staff face materially lower exposure.
Authorization bypass in Camunda 7 Cockpit allows authenticated users with minimal Cockpit access to read all process instances, process definitions, and incidents engine-wide without logging when the engine has a non-empty disabledPermissions configuration. Affected versions are Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17. Publicly available exploit code exists, and a vendor patch is available; exploitation requires both valid Cockpit credentials and the non-default non-empty disabledPermissions setting, so exposure is configuration-dependent.
OS command injection in orbitale/imagemagick-php through 3.3.5 lets unauthenticated remote attackers inject shell metacharacters through the fontFile argument of Command::font when a host application passes untrusted input to that parameter. Publicly available exploit code exists, but there is no CISA KEV confirmation and exploitation depends entirely on whether the calling application exposes fontFile and on the OS/shell context in which ImageMagick commands run. The vendor did not respond to disclosure, and no vendor-released patch was identified at time of analysis.
Stack-based buffer overflow in H3C Magic NX15 firmware NX15V100R017 can be triggered remotely through the /usr/bin/usrlist function sub_416874, causing a denial-of-service condition by crashing the affected service. Exploitation requires network reachability plus low-level privileges (CVSS PR:L), so an attacker needs an existing authenticated session or equivalent low-privilege access to the router. Publicly available exploit code exists, but the independent CVSS:3.1 assessment is availability-only with PR:L and points to moderate, not critical, priority.
Unauthenticated remote attackers can influence which classes or code paths are loaded by the speaches speech server (all builds up to and including 0.9.0-rc.3) by supplying a crafted 'model' argument to PyannoteDiarizationModelManager._load_fn in src/speaches/executors/pyannote_diarization.py. The CVSS 4.0 base score is 5.5 with impact limited to low confidentiality, integrity and availability (VC:L/VI:L/VA:L), and publicly available exploit code exists (a PoC archive is linked from the advisory) - there is no CISA KEV confirmation of active exploitation. Practical exposure is bounded by the need for the server to be network-reachable, the diarization feature to be enabled, and the deployment to run an affected pre-release build of this niche self-hosted tool.
Denial of service in SGLang 0.5.19 and earlier allows an attacker who can reach the remote weight-export path to supply an unregistered group_name to WeightExporter.send_weights_to_remote_instance, triggering an unhandled KeyError that aborts the export operation. The CVSS vector rates it network-reachable and unauthenticated (PR:N), but practical exposure depends on whether the remote weight-export feature is actually reachable in the deployment, and impact is limited to availability loss of that operation rather than full service compromise. Publicly available exploit code exists, while the upstream fix is a pull request that awaits acceptance.
SQL injection in satya-vinay Events-Management-System allows unauthenticated remote attackers to manipulate the id, name, title, year, gender, fromdate, todate, and people parameters in doedit.php, affecting registration data with limited confidentiality, integrity, and availability impact. The application is a rolling-release GitHub project with no versioned fix, and publicly available exploit code exists; no CISA KEV entry was provided, so active exploitation is not confirmed. Real-world priority is modest because the product is niche and unmaintained, but the doedit.php endpoint must be internet-reachable for exposure.
Unauthenticated information disclosure in Dav-ee dairy-management-system lets remote attackers manipulate the fname argument of the delivery/checkfarmer.json.php AJAX endpoint to expose sensitive data; affected deployments are rolling-release snapshots such as commits 31ace9692d1e1e6d64339a42c463b361319c615c and f31a584c3330c013b61f8b0306d9e0849c6d693d, and no version-specific fixed release is provided. Publicly available exploit code exists via the project's GitHub issue, but there is no CISA KEV confirmation of active exploitation. Impact is limited to confidentiality (CVSS 4.0 base 6.9; assessed CVSS 3.1 5.3), with no integrity or availability effect, and practical exposure depends on internet-reachable instances of this small-deployment PHP application.
SQL injection in vraj404 Criminal-Management-System's search.php lets unauthenticated remote attackers manipulate the Search parameter to access or alter limited data and affect availability, with low impact assessed across confidentiality, integrity, and availability. The project uses a rolling release, so all deployed snapshots up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 should be treated as potentially affected, and publicly available exploit code exists via the project's GitHub issue tracker. No CISA KEV listing or confirmed active exploitation is available, and real-world priority is low-to-moderate because exposure depends on an organization self-hosting and network-exposing this niche PHP application.
SQL injection in the /ws.asmx SOAP endpoint of Wubang Five-in-One Safety Production Management Information System through version 3.5 allows unauthenticated remote attackers to manipulate the 'sql' argument passed to the xp_cmdshell function, with limited confidentiality, integrity, and availability impact and possible escalation to database or OS command execution if MSSQL xp_cmdshell is enabled. Publicly available exploit code exists, but there is no CISA KEV confirmation; the vendor reportedly did not respond to disclosure. The issue is moderate severity (CVSS 5.5) and is most relevant to exposed deployments of this niche industrial safety-management product.
Denial of service in GPAC MP4Box 2.5-DEV (rev1672-gc9a31d0e1-master) occurs when SAP-dump processing of a crafted MP4 file reaches dump_isom_saps and uses a missing sample result, crashing the MP4Box process. The issue is local and requires user interaction because the victim must run MP4Box with SAP dumping enabled against the attacker-supplied file, and impact is limited to availability with no code execution or data disclosure. Publicly available exploit code exists, and the upstream project has a fix commit adding a null check, but no CISA KEV active-exploitation listing was provided.
Sensitive information exposure in Webkul Aureus ERP through 1.6.0 allows unauthenticated remote attackers to retrieve debugging-related data reachable via composer.json, and publicly available exploit code exists. The CVSS 4.0 vector shows network reachability with no privileges or user interaction and only low confidentiality impact; integrity and availability are unaffected, and there is no CISA KEV confirmation. Real-world risk is limited to deployments that expose composer.json or associated debug/metadata output, with the product's narrow footprint further reducing exposure.
SQL injection in vraj404 Criminal-Management-System, through commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4, lets remote attackers submit crafted values in the Officer Registration Form at Officers/addOfficer.php to alter backend MySQL queries. Publicly available exploit code exists, and the vendor's CVSS 4.0 vector rates the issue PR:N, while the independent assessment notes that a valid session may be required if the endpoint is not reachable without authentication. The project has not responded to the issue report, and no patched release is identified.
Unauthenticated SQL injection in the Search Page of vraj404 Criminal-Management-System (`Officers/searchOff.php`) allows remote attackers to manipulate the `Search` parameter passed to `mysqli_query`, exposing sensitive records and permitting limited data modification. The application is a niche open-source PHP project on a rolling release with no published affected or fixed version, and the vendor has not responded to the issue report; publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. With a CVSS 4.0 score of 6.9 and exposure-dependent preconditions, the practical risk is moderate and concentrated on Internet-reachable deployments.
Unrestricted file upload in vraj404's Criminal-Management-System lets a remote attacker push an arbitrary file through the 'my_img' parameter handled by move_uploaded_file in home.php, which can result in attacker-controlled content being written into a web-reachable location and potentially executed. All deployments built from the repository up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 are affected, and because the project follows a rolling release model with no tagged versions, there is no defined fixed release to upgrade to. Publicly available exploit code exists and the maintainer has not responded to the issue report, though real-world exposure is limited by the project's niche, single-developer nature and near-absent production footprint; no public exploit identified at time of analysis beyond the published proof-of-concept, and no CISA KEV listing applies.
Information disclosure in OctoAlly (ai-genius-automations/octoally) through version 1.0.87 lets remote attackers manipulate the path argument handled in server/src/index.ts to expose data the server should not return. Per the CVSS vector (PR:N, AV:N) no authentication is required, and because pre-1.0.88 builds default to binding all interfaces with no Host or Origin validation, exposure is reachable either directly over the network or through a victim's browser via DNS rebinding or cross-origin requests against an otherwise loopback-only deployment. Publicly available exploit code exists (upstream issue #24) and the vendor shipped a fix in 1.0.88; no confirmed active exploitation (CISA KEV) has been reported, and the CVSS 4.0 base score is 6.9 with E:P reflecting proof-of-concept maturity rather than in-the-wild use.
Unauthenticated remote attackers can retrieve sensitive files such as project.sql from satya-vinay Events-Management-System deployments running up to commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a, exposing database schema or seed content. Publicly available exploit code exists and the project has not responded to the issue report, although no CISA KEV entry confirms active exploitation. The assessed impact is read-only confidentiality loss; integrity and availability are not affected.
Missing authentication enforcement across multiple endpoints in satya-vinay Events-Management-System (rolling-release code through commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a) lets unauthenticated remote attackers reach functionality that should require login, yielding Low confidentiality, integrity, and availability impact without scope change. Publicly available exploit code exists via VulDB and GitHub issue #4, but no CISA KEV confirmation is present in the supplied data; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Because the project uses a rolling release and has not responded to the issue report, no fixed version is identified and defenders must identify exposed deployments by commit or deployment state.
SQL injection in the dodelete.php Registration-Delete Handler of satya-vinay Events-Management-System allows unauthenticated remote attackers to manipulate the ID parameter and influence backend SQL queries, with low impact to confidentiality, integrity, and availability per the assessed vector. Publicly available exploit code exists via the linked GitHub issue, but the flaw is not confirmed actively exploited (not in CISA KEV); no vendor-released patch or fixed version is identified, and the project has not responded to the report.
SQL injection in the administrative document viewer of subhajitkhan's Online Clinic Management System allows remote attackers to supply a crafted docid value to admindocview.php and influence backend SQL queries, with the supplied vector indicating no privileges or user interaction are required. Publicly available exploit code exists, and the rolling-release project has not issued a fixed version or responded to the upstream issue, so deployments remain exposed until the endpoint is manually hardened or restricted. The practical risk is moderate: the CVSS v3.1 assessment rates confidentiality, integrity, and availability impact as low, and any login enforced on the admin area would be a key prerequisite to verify.
Cross-site scripting in the Five-in-One Safety Production Management Information System through version 3.5 allows remote attackers to inject script through the NewFile argument in the legacy FCKeditor ASPX upload connector, with exploitation requiring a victim to follow a crafted request to /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx. Publicly available exploit code exists, but no CISA KEV confirmation of active exploitation was provided.
The App Builder WordPress plugin before 5.7.1 writes attacker-supplied data into one of its options without any authentication or authorization check, and a second unauthenticated request then redirects the visitor's browser to a URI built from that stored value. The result is an unauthenticated, persistent open redirect (CVSS 5.3, integrity-only) that remote attackers can use to bounce victims to attacker-chosen destinations, typically as a phishing delivery step. Publicly available exploit code exists, but the real-world impact is bounded because a victim must actually follow the crafted link; sites running 5.7.1 or later are not affected.
TrueBooker, a WordPress booking/appointment plugin, renders a booking confirmation summary without verifying that the requester actually owns the referenced booking, so anyone on the internet can walk booking identifiers and read the confirmation pages of other customers. That exposes customer personal information contained in the summary and also lets an attacker invalidate a victim's own confirmation link (a limited integrity impact on top of the disclosure). All versions before 1.3.0 are affected, no authentication or user interaction is required against a default installation, publicly available exploit code exists, and the issue is rated CVSS 5.3 (Medium) with confidentiality and limited integrity impact only.
Unauthenticated WooCommerce order-status manipulation in the Snap Finance WordPress plugin before 3.12.0 allows remote attackers to mark arbitrary orders as paid or failed because the status-change handler does not verify that the request comes from an authorised source. The flaw has a CVSS 3.1 base score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), with impact limited to order-state integrity and no confidentiality or availability impact. Publicly available exploit code exists, but no CISA KEV entry was provided indicating confirmed active exploitation.
Missing authorization checks in the TrueBooker WordPress plugin before 1.3.0 allow unauthenticated remote attackers to create and modify booking services and categories, including their prices. Publicly available exploit code exists, and the assessed CVSS vector indicates integrity-only impact (C:N/I:L/A:N) with no confidentiality or availability effect. This is a moderate-severity broken access control issue requiring only that the vulnerable plugin version be deployed.
Unauthenticated attackers can create TrueBooker bookings at attacker-chosen prices and attach them to arbitrary customer accounts in WordPress plugin versions before 1.3.0 because several AJAX actions lack authorization checks and the service price is not validated server-side. The flaw is medium severity (CVSS 5.3) with integrity-only impact, and publicly available exploit code exists. Exploitation requires the plugin to be installed and active with its booking AJAX actions reachable, which is the default state for core functionality.
WooCommerce orders can be marked as paid without payment by unauthenticated attackers on WordPress sites running BDM Digital Payment Gateway through 1.3.12. The plugin's public payment-status update route does not verify credentials and treats unset credentials as valid in the default configuration, so no special setup is required; no CISA KEV entry is provided, but publicly available exploit code exists. Impact is an integrity-only change to WooCommerce order payment status on sites with this specific plugin, with no code execution or data disclosure.
TrueBooker, a WordPress plugin, lets unauthenticated remote attackers rewrite its entire stored configuration because one of its setup handlers performs no WordPress capability check and validates only a token that is itself handed out to unauthenticated visitors. Any site running a version before 1.3.0 is affected; no login, no user interaction, and no non-default configuration are required, and publicly available exploit code exists (no CISA KEV entry at time of analysis). Impact is limited to integrity - settings the attacker does not supply are discarded, so the plugin can be left in an attacker-chosen or broken state - with no confidentiality or availability impact reflected in the CVSS 5.3 score, making this a moderate-priority integrity issue rather than a code-execution emergency.
Unauthenticated attackers can mark WooCommerce orders as paid without actually paying in sites running the 'Gateway for Vantiv on WC' WordPress plugin through version 1.0.1. The plugin's hosted-payment return handler accepts return notifications without verifying their authenticity (CWE-284), yielding a low-integrity impact (CVSS 5.3, I:L) with no confidentiality or availability effect. Publicly available exploit code exists, and exploitation is limited to sites that use this specific plugin as their payment gateway and expose the return handler.
Unauthenticated coupon creation in the ActiveTrail for WooCommerce WordPress plugin (all versions through 1.2.6) lets remote attackers mint arbitrary WooCommerce coupons, including 100%-off and free-shipping codes, without any credentials or user interaction. The defect is a missing authorization check on the plugin's coupon-generation routine (CWE-862), so any visitor who can reach the endpoint can write coupon data into the store; the assessed vector (AV:N/AC:L/PR:N/UI:N, I:L only) confirms default installs are reachable over the network while impact stays confined to integrity of discount data rather than data disclosure or site takeover. Publicly available exploit code exists and the finding is documented by WPScan and EUVD-2026-104082, but there is no CISA KEV entry - the practical threat is financially motivated coupon and discount fraud, not mass site compromise; no vendor-released patch is identified in the available data.
Unauthenticated information disclosure in the FormFlow for GoHighLevel (GHL) WordPress plugin through version 1.0.0 lets anyone who can reach the plugin's log file in the public wp-content/uploads directory read its contents, which include connected-CRM identifiers and, on sites that have linked their GoHighLevel integration, a third-party access token. Because the log is written into a web-served path rather than a protected location, no credentials or user interaction are required - only knowledge or guessing of the file path - so the exposure scales directly with how many affected installs exist and how many operators have completed the CRM link. Publicly available exploit code exists, making path discovery and retrieval straightforward; the practical blast radius is limited mainly by the plugin's small deployment footprint, with the high-confidentiality outcome reserved for integration-linked sites whose token is captured in the log.
Paid WooCommerce downloadable files can be retrieved without purchase on WordPress sites running ElementsReady Addons for Elementor through 6.7.2, because the plugin fails to enforce authorization on protected product download requests. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium) indicates a remote, low-complexity, unauthenticated attack with no user interaction; the practical exposure is limited to stores that actually sell protected downloadable products through the plugin. Publicly available exploit code exists, and no CISA KEV status or EPSS score is provided in the supplied data.
Unauthenticated attackers can mark arbitrary WooCommerce orders as paid on WordPress sites running the Snap Finance plugin through version 3.11.0, because the plugin's payment-return handling never verifies that the provider actually approved a completed transaction. Publicly available exploit code exists and the flaw needs no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 5.3 medium), but exploitation is limited to sites where the plugin is active and Snap Finance is enabled as a checkout payment method. Impact is confined to integrity of order/payment status - fraudulent marking of orders as paid - with no data disclosure, site compromise, or availability loss.
Unauthenticated attackers can replace the published thumbnail image for any document on WordPress sites running the Document Gallery plugin through 5.1.1. The plugin's webhook endpoint does not verify request signatures when no shared secret is configured, and that is the default configuration, so default installations are exposed. Publicly available exploit code exists; impact is limited to integrity (CVSS 5.3, I:L with no confidentiality or availability impact), and CISA KEV status is not indicated.
The iPOSpays Payment Gateway for WooCommerce plugin (all versions before 1.4.7) records orders as paid without confirming that a payment actually settled, letting unauthenticated remote attackers flip any unpaid order to 'paid' and rewrite the order total. Exploitation is trivial where the gateway is enabled - no credentials, privileges, or victim interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) - but impact is confined to order and payment-record integrity, with no data disclosure or availability loss, giving a base score of 5.3. Publicly available exploit code exists and the flaw was reported by WPScan; there is no indication of confirmed active exploitation (CISA KEV) at time of analysis.
Forged Coinbase Commerce webhook notifications can mark arbitrary WooCommerce orders as paid or cancel already-paid orders in the Coinbase Commerce Payment Gateway plugin through version 1.4.1. The plugin ships with an empty webhook shared secret and does not reject an unconfigured value, so unauthenticated remote attackers who know or guess an order ID can bypass signature validation; publicly available exploit code exists. The CVSS 5.3 impact is limited to order-payment integrity with no confidentiality or availability impact, and merchants who have explicitly set a non-empty shared secret are not affected by the bypass.
Missing authorization in the ElementsReady Addons for Elementor WordPress plugin through version 6.7.2 allows any authenticated user at subscriber level or above to overwrite the plugin's stored settings, including saved API credentials and its feature and template configuration. The vulnerable code paths are settings-save handlers that do not halt execution when authorization fails; publicly available exploit code exists, though CISA SSVC rates exploitation as none and the flaw is not in KEV, indicating no confirmed active exploitation. Impact is confined to integrity (CVSS 4.3, PR:L, no confidentiality or availability effect), so it is a moderate, authenticated-access problem rather than an emergency - but on sites with open self-registration, an outside attacker can obtain the required subscriber account and tamper with the plugin's configuration and stored third-party credentials.
Missing authentication in the Remote Control Server component of eremef bandcamp-player through 1.8.33-beta allows unauthenticated attackers with LAN reachability to control the desktop player's remote interface without a device pairing or approval step. The flaw is rooted in how the remoteEnabled setting is handled in database.ts, and it is practically exposed only when the Remote Control feature is switched on and the legacy, non-secure connection mode (plain HTTP/WS, no pairing) is in use; no victim interaction is required against such a server. No public exploit code or active exploitation has been confirmed, and the vendor has released a patched version, 1.8.34-beta, which turns Secure Mode (HTTPS/WSS with QR pairing and desktop approval) on by default.
Heap out-of-bounds read in libtins's DNS name parser through version 4.6 can be triggered by a crafted DNS label that ends exactly at the packet buffer boundary, causing a one-byte read past the buffer when additional, answer, or authority records are parsed. The flaw is network-reachable and unauthenticated per the CVSS vector (PR:N/UI:N), but impact is limited to availability: affected applications may crash, especially on hardened allocators, while non-hardened allocators may only read adjacent memory. No public exploit identified at time of analysis.
A regular-expression denial-of-service (ReDoS) flaw in DiffSK configobj through version 5.0.9 lets remote attackers stall Python applications that parse untrusted configuration text, because the _sectionmarker routine in configobj/__init__.py builds a regex vulnerable to catastrophic backtracking. Impact is confined to availability (low-severity availability loss, no confidentiality or integrity effect); unauthenticated attackers can trigger it whenever attacker-influenced input reaches the parser. No vendor patch has been identified at time of analysis - the issue was filed upstream (GitHub issue #281) but the project has not responded, and no public exploit code was identified at time of analysis. Exploitation is highly context-dependent: typical deployments that only parse local, operator-controlled config files expose no remote surface.
Saving attacker-controlled images as GIF in Python Pillow 9.2.0 through 12.x can drive quadratic comment-header assembly and consume excessive CPU, delaying or denying service. The issue is reachable without authentication or user interaction (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N), but only when an application preserves a very large embedded GIF comment and re-encodes the image as GIF; impact is limited to availability. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and the vendor-released fix is Pillow 13.0.0.
Denial of service in Pillow 5.4.0 through pre-13.0.0 allows unauthenticated remote attackers to exhaust CPU by supplying a crafted GIF containing numerous comment extensions; Image.open() parses frame zero and triggers quadratic bytes copying in GifImageFile._seek() before the application can inspect the image. Impact is limited to availability (vendor CVSS 4.0 score 6.9; assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with no code execution or data exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and environments that only open trusted images are not practically exposed.
High-privilege authenticated administrators of Koozali SME Server 11.0rc1-215 can inject reserved Apache configuration directives through the domain creation function, corrupting httpd.conf so Apache fails to start after a subsequent reboot and taking down the web server and hosted virtual hosts. The issue is an input-validation failure (CWE-20) scored 6.9 Medium; exploitation requires administrator access to the management interface and a reboot to trigger the DoS, and no public exploit identified at time of analysis.
Regular-expression denial of service in Pillow before 13.0.0 lets unauthenticated remote attackers stall an image-processing worker by submitting a tiny crafted XBM file that triggers catastrophic backtracking in the XBM header parser before image dimensions are ever validated. Any service that routes untrusted uploads through Image.open() with XBM parsing reachable is affected; impact is confined to availability degradation of the decoding worker, with no code execution, data exposure, or integrity impact. The flaw is fixed in Pillow 13.0.0, which replaces the backtracking regex with line-based parsing; no public exploit tooling or confirmed active exploitation was identified at time of analysis, though the upstream fix commit includes a regression test that reproduces a minimal triggering input.
Uninitialized stack memory disclosure in Pillow 9.1.0 through 12.x allows an attacker who controls a palette image passed to Image.quantize(palette=p) to receive raw stack contents - including pointer addresses and stack-canary bytes - embedded as pixel indices in the returned PNG or GIF. Exploitation is not implicit in normal Pillow use: the application must expose the quantize-with-palette path to untrusted input and must accept an attacker-supplied palette whose palette data is empty (p.palette.palette == b""), which causes ImagingPaletteCacheUpdate() to leave its local cache array uninitialized before those bytes are emitted by the topalette() conversion path. The flaw yields confidentiality-only impact with no memory corruption or crash; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the vendor-released fix is Pillow 13.0.0.
FOSSBilling versions 0.1.0 through 0.8.6 leak email-to-client membership through the unauthenticated guest signup endpoint POST /api/guest/client/create: submitting an already-registered address returns a distinct, unredacted exception message from Client\Service::clientAlreadyExists instead of the normal success response, which effectively turns signup into an account-enumeration oracle. The CVSS 4.0 base score is 6.9, but the authoritative assessment rates actual impact as low (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/C:L/I:N/A:N) because it only confirms that an email belongs to a client - no credentials, session, or account data are exposed. No public exploit code or active exploitation is known at time of analysis, and because guest registration can be disabled and pre-0.8.7 builds had no per-email throttling, unthrottled bulk enumeration was the realistic abuse case.
Path traversal in the TickTick Android app (com.ticktick.task) 8.2.2.0 lets a malicious co-resident application write files to attacker-chosen locations using TickTick's own application privileges. The attacker must already have code installed on the same device and register a ContentProvider whose _display_name value contains traversal sequences, then deliver an ACTION_SEND intent with a crafted content:// URI to TickTick's exported ShareReceiveActivity; the unsanitized name passes through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly, yielding arbitrary-location writes with high integrity impact but no confidentiality or availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and the impact is limited to local, same-device scenarios requiring the victim to have already installed the attacker's app.
VOCALOID6 Editor fails to disable XML external entity resolution when it parses project files, so a crafted project can cause unintended outbound communication, disclosure of files readable by the editor process, or a denial-of-service crash. The issue is rated CVSS 7.1 and requires local file loading plus user interaction (AV:L/UI:R, PR:N), which limits practical exploitation to social-engineering delivery of a malicious project file. No public exploit code or active exploitation was identified in the provided intelligence, making this a genuine but not emergency-priority risk.
Unauthenticated remote attackers can exploit Parse Server user-update handling to confirm guessed usernames and email addresses and, when passwordPolicy.maxPasswordHistory or doNotAllowUsername is configured, validate guessed current or previous passwords while bypassing account lockout. The flaw results from target-account checks being evaluated before caller authorization; affected releases are prior to 8.6.99 and 9.0.0 through 9.10.3-alpha.2. No public exploit code has been identified at time of analysis, and the primary impact is credential enumeration rather than direct compromise.