Oracle Agile PLM 9.3.6 can disclose critical or all PLM-accessible data through its Import component to an attacker who already has a local logon on the server infrastructure. The flaw is low-complexity and requires no user interaction, but it is not remotely triggerable and affects confidentiality only, with no write or denial impact. No public exploit code was identified at time of analysis; Oracle's October 2026 Critical Patch Update advisory is the reference.
Local attackers who already hold a logon to the host running Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can read critical application data through the Test Framework component without supplying any application-level credentials or user interaction. The exposure is confidentiality-only (CVSS 3.1 base 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), so integrity and availability of the PeopleTools environment are not directly affected and the practical gate is the mandatory pre-existing local foothold on the PeopleTools server - a realistic threat mainly from insiders or attackers who have already compromised the host. It is not a top-tier emergency: no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and no EPSS score was supplied with the source data.
Local code execution on iOS and iPadOS (before 26.7 and the 27 line), macOS Golden Gate (before 27), and visionOS (before 27) can let an attacker-controlled app process overwrite restricted files, breaking file-system integrity protections. The issue is an improper privilege-management and permissions-validation weakness (CWE-269) scored 6.2 with a local-only vector (AV:L/AC:L/PR:N/UI:N), so it is unauthenticated once code is running but cannot be reached remotely - a malicious or sideloaded app must first execute on the device. No public exploit identified at time of analysis and no KEV confirmation; Apple has released vendor patches in iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, macOS Golden Gate 27, and visionOS 27.
Authenticated path traversal in aaPanel through version 8.25.0 lets a logged-in panel user read files outside the intended download directory by manipulating the 'filename' argument of the send_file endpoint in BTPanel/routes/v2.py. Remote attackers who hold at least a low-privileged panel account can use ../ style sequences to escape the base path and disclose arbitrary files readable by the aaPanel web process, silently and without any user interaction. Publicly available exploit code exists (a dedicated GitHub PoC repository), and exploitation is gated by two real constraints: prior authentication and the operating-system permissions of the panel's service account.
Cross-site scripting in ApostropheCMS before 4.33.0 allows an unauthenticated attacker to craft a link that, when opened by an authenticated user in the admin context, abuses apos.http.parseQuery prototype-key handling to mutate browser prototypes and reach a DOM sink for script execution in the victim's session. Exploitation requires user interaction and only affects pages that load the admin bundle, so anonymous front-end visitors are not exposed; no public exploit was identified at time of analysis. Version 4.33.0 fixes the issue, which is scored CVSS 6.1 with a scope change.
Path traversal in DrayTek Vigor2960 1.5.1.6 Revision 8218 allows an authenticated low-privilege user to manipulate the setSWMProfile argument in /cgi-bin/mainfunction.cgi and reach files outside the intended directory. Publicly available exploit code exists, and the vendor states that 2960 firmware 1.5.1.7 corrected many security issues while noting the Vigor2960 is End-of-Service with limited support. The CVSS 4.0 score is 5.3 with Low confidentiality, integrity, and availability impact; risk increases where the web management interface is reachable from untrusted networks.
Cross-site scripting in IBM Carbon Charts 0.4.0 through 1.27.19 lets remote attackers execute arbitrary JavaScript in a victim's browser session when the MeterChart title text exceeds the available container width and is truncated. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates unauthenticated remote exploitation that requires the victim to load a page rendering the chart, with scope change and limited confidentiality/integrity impact. No public exploit code was identified at time of analysis, and practical exploitation depends on the host application passing attacker-influenced text into a MeterChart title and that title being long enough to trigger truncation.
Oracle Agile PLM 9.3.6 Web Client contains a client-side injection weakness that a remote, unauthenticated attacker can deliver over HTTP, but exploitation requires a victim other than the attacker to interact with attacker-controlled content. Successful attacks can read or modify a limited subset of data accessible through the victim's Agile PLM session, with scope change potentially affecting additional products and no availability impact; no public exploit code or CISA KEV entry was identified at time of analysis.
Oracle One-to-One Fulfillment in Oracle E-Business Suite 12.2.3 through 12.2.15 contains an Admin Console UI exposure that can be triggered when a privileged console user is induced to interact with attacker-controlled content, allowing limited unauthorized read and write actions within the victim's session and potentially affecting other products due to scope change. The CVSS 3.1 score is 6.1, and the vector shows PR:N with UI:R, meaning the attacker needs no credentials but cannot succeed without human interaction from an operator other than the attacker. No public exploit code or confirmed active exploitation was identified in the supplied intelligence, so this is a moderate, context-dependent risk rather than a mass-exploitation emergency.
Content injection in Oracle Email Center's Message Component (Oracle E-Business Suite 12.2.3 through 12.2.15) allows unauthenticated, network-based attackers to trick a victim into interacting with attacker-supplied content over HTTP, yielding partial read and update/insert/delete access to Email Center data (CVSS 3.1 6.1). The scope change (S:C) means injected content may affect additional Oracle EBS products, but confidentiality and integrity impacts are low and availability is unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis.
Reflected cross-site scripting (XSS) is the assessed weakness in Oracle Customer Care within Oracle E-Business Suite 12.2.3 through 12.2.15, where an unauthenticated remote attacker can use HTTP to induce a victim user to open attacker-supplied content and cause limited unauthorized reads or updates in Customer Care and, through scope change, potentially affect other EBS products available to that user. The CVSS 3.1 base score is 6.1, exploitation requires human interaction, and confidentiality/integrity impact is Low with no availability impact; no public exploit identified at time of analysis.
Unauthenticated HTTP-based content injection in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a remote attacker abuse a victim's authenticated browser session, so that crafted content or a crafted link opened by a legitimate user can cause unauthorized read of a subset of PeopleTools-accessible data and limited insert, update, or delete operations - with the scope change (S:C) indicating impact can extend beyond PeopleTools into other products reachable from that session. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) is the textbook signature of a cross-site scripting / content-injection flaw rather than a true authentication bypass, despite the 'Authentication Bypass' tag on the source record; no availability impact is described. No public exploit code or confirmed active exploitation (CISA KEV) is identified in the available data, and the mandatory user-interaction prerequisite (UI:R) is the primary limiting factor, with realistic risk concentrated on internet-facing PeopleSoft portals whose user populations are susceptible to phishing.
Unauthenticated, network-reachable content injection in the Web Server component of Oracle BI Publisher allows an attacker to craft a link or served page that, once a victim is induced to interact with it, can read and modify a limited subset of BI Publisher data - and because the vector carries a scope change (S:C), the injected content executes in the victim's context and may affect resources beyond the vulnerable component itself. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, all of which are reachable over HTTP with no credentials required of the attacker (PR:N), though the attack cannot succeed without a human in the loop (UI:R). The CVSS 3.1 base score is 6.1 with Low confidentiality and integrity impact; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so it should be triaged as moderate rather than critical.
Oracle Siebel CRM Integration 25.12 through 26.9 is exposed through its Open Integration component to unauthenticated, HTTP-based attacks that succeed only when a legitimate user interacts with attacker-supplied content. A successful attack gives limited read access plus unauthorized insert, update, or delete capability within the integration scope, and the scope change means other products can be affected. At CVSS 3.1 base 6.1, the required user interaction is the main barrier to automated exploitation, and no public exploit was identified at the time of analysis.
Unauthorized data modification and limited data disclosure in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can be triggered by an unauthenticated network attacker who convinces a victim to interact with a crafted HTTP request; the pattern is consistent with a cross-site-scripting-class issue in the Monitoring and Diagnostics SEC component. Successful exploitation can update, insert, or delete some accessible data and read a subset, with a scope change that may affect additional products, but no public exploit was identified at time of analysis and it is not confirmed actively exploited. This is a moderate-severity issue (CVSS 3.1 base 6.1) whose primary limiting factor is the required victim interaction.
Unauthenticated, user-assisted attacks against the JD Edwards EnterpriseOne Tools web interface (supported versions 9.2.0.0 through 9.2.26.5) let a remote attacker lure a victim into interacting with attacker-supplied HTTP content, yielding low-impact read and write access to a subset of application data, with scope change extending the impact to additional connected products. Oracle scores this 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) - the UI:R requirement for a tricked human victim is the main limiting factor, so it cannot be triggered automatically. No public exploit code and no CISA KEV entry are identified at time of analysis, and no EPSS data was supplied; treat this as a schedule-the-patch item rather than an emergency.
A cross-site scripting-style injection flaw in the Web Runtime SEC component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can be triggered over HTTP by an unauthenticated remote attacker, but only succeeds if a victim other than the attacker interacts with attacker-supplied content (UI:R). CVSS 3.1 scores it 6.1 with scope change, low confidentiality and low integrity impact on the affected and possibly additional products, and no availability impact; the practical delivery vehicle is a targeted JD Edwards user session rather than mass-automated scanning. Exploitation requires social engineering of a legitimate user's browser, there is no confirmed active exploitation (not in CISA KEV), and no public exploit code was identified at time of analysis.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 are affected by a moderate-severity Runtime Tools flaw that lets remote unauthenticated attackers obtain partial read access and limited update/insert/delete capability against portal data, with potential scope change into integrated products. Exploitation requires a victim other than the attacker to interact with crafted content (UI:R), which limits unattended mass exploitation, and the CVSS 3.1 score is 6.1; no public exploit code was identified at time of analysis.
Cross-site scripting-class weakness in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 (Business Interlink) appears to let an unauthenticated remote attacker who persuades a victim to interact with crafted HTTP content gain limited read and update/insert/delete access to some PeopleTools data, with possible scope change to linked products. The CVSS 3.1 base score is 6.1, and exploitation requires user interaction (UI:R), so the flaw cannot be triggered autonomously against an idle server and is best treated as a moderate-severity, socially engineered issue. No public exploit code or CISA KEV entry is identified in the supplied intelligence; no public exploit identified at time of analysis.
Unauthenticated attackers with HTTP network access to the Content Server component of Oracle WebCenter Content can induce a targeted user to perform an interaction that grants limited unauthorized read and insert/update/delete access to application data, with scope change potentially extending impact to connected products. The issue affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 6.1; no public exploit code or CISA KEV confirmation was identified at time of analysis, and the required victim interaction makes automated mass exploitation impractical.
Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 contain a moderate-severity flaw in the OIM Legacy UI that can allow an unauthenticated network attacker to read a subset of OIM data and update, insert, or delete some OIM-accessible data if a victim user is induced to interact with attacker-supplied content. The CVSS 3.1 base score is 6.1, with scope change indicating possible impact beyond OIM itself, but the UI:R requirement means exploitation depends on user action and is not silent or automatic at scale. No public exploit identified at time of analysis.
Reflected cross-site scripting in the HTML UI component of Oracle E-Business Suite's Installed Base module (versions 12.2.3 through 12.2.15) lets an unauthenticated remote attacker deliver a crafted HTTP request or link that executes in a victim's session once that user interacts with it. Because the vector carries scope change (S:C) with low confidentiality and integrity impact, a successful attack can read and modify a subset of Installed Base data and potentially affect other EBS products sharing the session context; there is no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation depends on social-engineering a user into following the crafted link.
Oracle Purchasing in Oracle E-Business Suite 12.2.3 through 12.2.15 contains an approval-workflow flaw that can let an unauthenticated network attacker read or modify some Purchasing data if a legitimate user is induced to interact with attacker-supplied content. The CVSS 3.1 score is 6.1 (MEDIUM) with scope change, meaning successful exploitation may affect additional EBS products beyond Purchasing. No public exploit code or CISA KEV entry was identified at time of analysis, and the required user interaction makes automated mass exploitation unlikely.
Oracle Demand Planning 12.1 and 12.2 contains a flaw in the Internal Operations component that allows an unauthenticated, network-capable attacker to deliver HTTP content and rely on a victim user's interaction to cause unauthorized read access to a subset of Demand Planning data and limited insert/update/delete actions. The CVSS 3.1 score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with partial confidentiality and integrity impact, no availability impact, and a scope change that can affect additional products; successful exploitation requires a separate human victim to interact with attacker-supplied content, which limits practical exploitability. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so this is a routine patch-cycle priority rather than an emergency.
Reflected cross-site-scripting-style input handling in Oracle Siebel CRM's Email Marketing component (Siebel Apps - Marketing, versions 17.0 through 26.9) allows an unauthenticated remote attacker to use HTTP to induce a victim to render crafted content, potentially altering or reading limited marketing data and, because of scope change, affecting connected products. The CVSS 3.1 score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with the requirement for user interaction and limited confidentiality/integrity impact constraining practical risk. No public exploit was identified at time of analysis.
Unauthenticated remote attackers can exploit the Siebel Apps - Marketing component in Oracle Siebel CRM 17.0 through 26.9 over HTTP to gain unauthorized read access and limited insert/update/delete capability, provided a victim is first induced to perform a user-interaction step. The issue is scope-changing and moderate severity (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so exploitation is gated by social engineering rather than direct automated compromise. No public exploit code or CISA KEV confirmation was identified at time of analysis.
A browser-mediated injection flaw (signals point to reflected cross-site scripting) in the Siebel Apps - Marketing component of Oracle Siebel CRM 17.0 through 26.9 allows an unauthenticated remote attacker to have crafted HTTP content executed in the context of a legitimate Marketing user who is lured into interacting with it. Successful exploitation yields unauthorized read access to a subset of Marketing data plus unauthorized update, insert, or delete capability, and because the flaw has scope change (S:C) the impact may extend to other products; no public exploit code was identified and the issue is not in CISA KEV at time of analysis, with moderate severity (CVSS 3.1 6.1) reflecting the user-interaction prerequisite and low confidentiality/integrity weighting.
Oracle REST Data Services 24.2.0 through 26.1.0 contains a web-facing flaw that can let an unauthenticated network attacker cause limited unauthorized reads and writes to ORDS-accessible data when a victim is induced to interact with attacker-supplied content. The CVSS 3.1 score is 6.1, with scope change indicating that sessions or downstream products trusting ORDS output may also be affected; the mandatory user interaction is the primary barrier to exploitation. No public exploit code or confirmed active exploitation was identified at time of analysis.
Improper authorization of custom URL schemes in Nerimity Desktop up to 2.2.2 allows unauthenticated remote attackers to pass attacker-controlled URLs to Electron's shell.openExternal through the Window Open Handler, and publicly available exploit code exists. Exploitation requires the victim to interact with attacker-supplied content and the host OS to have a registered handler for the abused scheme, which limits practical impact to medium severity. Upgrading to 2.3.3 restricts shell.openExternal to http/https URLs and resolves the flaw.
Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1, specifically the eProcurement component, exposes critical data to a high-privileged attacker who can reach the server over the adjacent network segment. Successful exploitation lets that attacker create, delete, or modify critical records and read all data the module can access, with high confidentiality and integrity impact and no availability impact. The CVSS 3.1 score of 6.1 reflects severe data impact offset by demanding prerequisites: an existing high-privileged account (PR:H) plus physical or adjacent-network access (AV:A), no user interaction (UI:N), and low attack complexity (AC:L) once those are met. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is concentrated among insiders and attackers who already hold a strong foothold on the PeopleSoft deployment.
Symlink redirection in filelock's ReadWriteLock and AsyncReadWriteLock (versions 3.20.4 through 4.0.8) allows a local user with write access to a shared lock directory to plant a symbolic link at the lock database path, causing SQLite to create, open, or lock a different file than the one the victim intended. The practical effect is integrity loss - mutual exclusion can be split between two targets so two processes believe they hold the same lock, and a lock database can be forced into an attacker-chosen location - with a modest availability impact from the resulting SQLite errors. The attacker must already hold a local account (PR:L, AV:L, unauthenticated network access is not a factor), must be able to create names in the lock directory before the victim initialises its lock, and the victim must actually use the newer ReadWriteLock classes rather than the classic FileLock. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and the issue is fixed in filelock 4.0.9.
Percent-encoded scheme normalization in fast-uri before 2.4.8, in 3.0.0 through 3.1.8, and in 4.0.0 through 4.2.2 can convert an input that raw-string filters consider inert into a live javascript, data, or vbscript URL. Applications that parse, normalize, or resolve a URL with fast-uri, screen dangerous schemes using the raw input, and then store or render the normalized/resolved result-or use equal() for equality-based allowlists-can be exposed to stored or reflected cross-site scripting. Exploitation requires victim interaction (UI:R), and no public exploit identified at time of analysis; KEV status is not indicated.
Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 contain a flaw in the Web Runtime SEC component that allows an unauthenticated, network-positioned attacker to deliver HTTP content which a legitimate logged-in user must be lured into interacting with, yielding partial read plus unauthorized insert/update/delete against that user's accessible data (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The scope change (S:C) means the impact can extend beyond EnterpriseOne Tools into other products that share the victim's browser session and trust context, but confidentiality and integrity effects are each rated Low and there is no availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and a vendor fix is published in Oracle's October 2026 Critical Patch Update.
Low-privileged users holding a local logon account on infrastructure running Oracle Product Lifecycle Analytics 3.6.1 can abuse an installation-related defect to read critical application data and partially degrade availability of the service. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, base 6.1) confirms the attack is local-only and requires existing low-privileged host access with no user interaction, yielding high confidentiality and low availability impact but no integrity impact. No public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis, and overall risk is materially bounded by the local attack surface, the single affected version, and the fact that the product is a specialized Supply Chain back-office application.
Local low-privileged users with logon access to Oracle Siebel CRM Development hosts can create, delete, or modify critical configuration data in versions 17.0 through 26.9, with a CVSS 3.1 base score of 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). The flaw is easily exploitable once an attacker holds valid low-privilege credentials on the development infrastructure, requires no user interaction, and primarily threatens integrity while exposing a subset of readable data. No public exploit identified at time of analysis, the provided source data does not include a CISA KEV designation, and no EPSS score was supplied; the reporting source's 'Authentication Bypass' tag should be read alongside the authoritative PR:L/AV:L vector, which confirms a local authenticated prerequisite rather than remote unauthenticated access.
SoftReadWriteLock in the Python filelock package (4.0.0 through 4.2.0) refreshes holder records by pathname without verifying that the name still resolves to the file it originally created, so a local user who can rename entries in the lock directory can substitute a named pipe (FIFO) and stall the lock, or - where the hard-link policy is permissive - link a file the victim can reach and cause the lock holder to write through it. Exploitation requires an authenticated local account sharing the lock directory (CVSS PR:L, AV:L), so this is a locally-exploitable, medium-severity issue (CVSS 6.1, integrity low, availability high) rather than a remote one; no public exploit code was identified at time of analysis and the flaw is fixed in filelock 4.2.1.
Python filelock's UnixFileLock truncates a regular file that a second local user has renamed onto the lock path (or hard-linked there when hard-link protections are relaxed), destroying that file's contents; when an explicit mode is requested, versions from 3.10.2 onward can additionally fchmod the file to the lock's mode. Exploitation requires a low-privileged local account (CVSS PR:L) plus rename/write permission on the directory holding the lock file, or a host with fs.protected_hardlinks disabled, so only multi-user shared lock directories and permissive-hardlink systems are exposed - no remote or unauthenticated path exists. Fixed in 4.2.1; no public exploit identified at time of analysis, and EPSS/KEV data are not available for this CVE.
Local, authenticated low-privileged users on hosts running Oracle Outside In Technology 8.5.8 can abuse the Outside In Clean Content SDK to corrupt or delete critical data and trigger a partial denial of service, with no confidentiality impact. The CVSS 3.1 score is 6.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L), so exposure is limited to environments where an attacker can both log on locally and get crafted content processed by the SDK. No public exploit code or confirmed active exploitation was identified at time of analysis.
A time-of-check-to-time-of-use (TOCTOU) flaw in the Python filelock library's ReadWriteLock, present from 4.1.0 through 4.2.0, allows a second local account to abuse rename rights in a shared, non-sticky parent directory to observe the randomized .filelock-* private hard-link directory name or forge a dead-owner sweep name, then rename a sibling directory onto that name so the lock's cleanup deletes it - producing high integrity impact with limited availability impact on data the attacker does not own. Exploitation requires a local account on the same host, rename access in a parent directory that is group/other-writable and lacks the sticky bit, and an application that places its ReadWriteLock database in such a shared location; deployments where the database directory is owned by the locking account or root and is not group/other-writable, or where parent directories are sticky, are not affected. The issue is fixed in 4.2.1, and no public exploit code was identified at time of analysis.
Authenticated command injection in the IPsec certificate-handling path of DrayTek Vigor2960 routers running firmware 1.5.1.6 Revision 8218 lets a low-privilege management user execute arbitrary OS commands on the device, fully compromising confidentiality, integrity and availability. Publicly available exploit code exists and maps directly to the flaw (DRV2960-0014), though no active exploitation is confirmed by CISA KEV. DrayTek has discontinued the Vigor2960 (EoS with limited support) and states it only reviews major issues such as unauthenticated flaws, making the availability of the 1.5.1.7 fix and a prompt upgrade the primary defense.
Authenticated path traversal in the End-of-Sale DrayTek Vigor2960 1.5.1.6 web management interface lets a low-privilege user manipulate the multipart field name processed by cgiEscape in /cgi-bin/mainfunction.cgi, enabling path traversal and file clobbering. The vendor fixed the issue in firmware 1.5.1.7, but public exploit code exists for the affected swmconfigupload component; exploitation still requires valid credentials and reachability to the management interface. No CISA KEV confirmation or EPSS score was included, so this should be treated as a moderate-priority authenticated issue rather than confirmed active exploitation.
Authenticated remote attackers can exploit an unrestricted file-upload flaw in DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218 by manipulating the upload_path and upload_name parameters in the commonupload function of /cgi-bin/mainfunction.cgi, resulting in arbitrary file clobber on the device. Publicly available exploit code exists, but exploitation requires valid credentials and access to the web management interface, keeping the issue moderate-risk rather than an emergency. DrayTek addressed the flaw in firmware 1.5.1.7; because the Vigor2960 is end-of-sale with limited support, exposure is limited to units still running the vulnerable release.
Authenticated path traversal in DrayTek Vigor2960 firmware 1.5.1.6 (Revision 8218) lets a user with a valid web-management session manipulate the 'action' argument in the Apmupload component of /cgi-bin/mainfunction.cgi to traverse paths and potentially clobber targeted files, with low confidentiality, integrity, and availability impact. The issue is remotely reachable but requires authentication and network access to the management interface, and the vendor has fixed it in firmware 1.5.1.7; publicly available exploit code exists, while no CISA KEV active-exploitation confirmation was provided. Because the Vigor2960 is end-of-support and unpatched devices may persist, defenders should prioritize inventory and access restrictions, though the authentication prerequisite keeps risk low for most environments.
Reflected cross-site scripting in the Ticimax E-Commerce Platform (builds through 2026-10-20) lets remote attackers inject script into pages served to victims who follow a crafted link, potentially stealing session cookies, hijacking authenticated storefront or admin sessions, or rewriting page content to phish customers. Unauthenticated attackers can craft the URL (CVSS:3.1/PR:N), but the payload only executes when a victim actively opens it (UI:R), and the scope change (S:C) means impact lands in the victim's browser origin rather than the server itself, which is why the score sits at 6.1 rather than critical. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS and KEV data were not provided, so the practical risk is driven by targeted social-engineering delivery against storefront users or administrators.
High-privileged attackers with network access to the CORBA interface can hang or repeatedly crash Oracle Siebel CRM Development versions 17.0 through 26.9 through the Integration - Scripting component, while also obtaining limited read and write access to a subset of application data. The CVSS 3.1 base score is 6.0 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H), and no public exploit was identified at the time of analysis.
SQL injection in the Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 allows an authenticated low-privileged user to read arbitrary database tables - including Moodle user password hashes - through the filter_var request parameter of viewreport.php. Exploitation requires that the attacker hold the capability to view a SQL-type report that was authored with the %%FILTER_VAR%% placeholder, which is why the vector carries AT:P and PR:L; impact is limited to confidentiality (C:H with I:N/A:N) and no user interaction is needed. A vendor patch is available in release 5.3.1, and no public exploit code was identified at time of analysis.
Authenticated high-privileged users of Oracle PeopleSoft Enterprise HCM Human Resources 9.2 can abuse the Administer Workforce component over HTTP to create, delete, or modify critical HR data, read a subset of otherwise restricted records, and force repeatable hangs or crashes of the application. Exploitation is constrained by three factors drawn from the CVSS vector - a high-privileged account (PR:H), interaction by a separate victim user (UI:R), and Oracle's own assessment that the flaw is difficult to exploit (AC:H) - which together point to insider or post-compromise misuse rather than opportunistic remote attack. There is no public exploit code identified at time of analysis and the issue is not in CISA KEV; the vendor-reported severity is 6.0, and independent assessment rates real-world urgency as low.
OS command injection in mcollina mcp-ripgrep through 0.4.0 lets a local, low-privilege user who can control the Advanced Search Tool's fileType argument run arbitrary shell commands with the MCP server's privileges. Publicly available exploit code exists, and the finding is disputed by the maintainer as documented shell-execution behavior; no CISA KEV active-exploitation confirmation is present. Real-world priority is low-to-moderate because the attack is strictly local and depends on untrusted input reaching fileType.
Oracle Siebel CRM Deployment 17.0 through 26.9 contains a local high-privilege access-control weakness that can let an attacker who already has logon access to the Siebel host read and modify critical deployment data. Exploitation is not network-reachable and requires a pre-existing high-privileged local foothold, so realistic risk is limited to malicious insiders or attackers who have already compromised a privileged account. No public exploit code or CISA KEV entry was identified at time of analysis.
Oracle Concurrent Processing 12.2.3 through 12.2.15 in Oracle E-Business Suite can expose critical data to a high-privileged attacker who already has interactive logon to the infrastructure where the component runs, with scope change extending confidentiality impact to other E-Business Suite products. The CVSS 3.1 score is 6.0 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), and impact is confined to confidentiality with no integrity or availability effect. No public exploit identified at time of analysis.