Splunk SOAR deployments running any version below 8.7.0 expose files and directories to external parties (CWE-552), and the vendor rates the issue at CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), meaning a network-reachable attacker holding only a low-privileged authenticated account can reach the exposed resources with no user interaction, with high confidentiality, integrity and availability impact and a scope change beyond the vulnerable component. The flaw was found during Cisco's internal security review and shipped in a bundled software hardening release rather than as a single documented bug, so the precise endpoint or feature that exposes the files is not described in the available sources. SSVC records no known exploitation and marks the issue not automatable, and no public exploit code or proof-of-concept was identified at time of analysis; the vendor-prioritised decision is act now, with upgrading to 8.7.0 as the remediation.
Improper neutralization weaknesses in Splunk Enterprise allow a network-positioned attacker holding a valid low-privilege account to achieve high confidentiality, integrity, and availability impact, with a scope change (S:C) indicating the effect can extend beyond the initially compromised component. Affected branches are Splunk Enterprise 9.4 before 9.4.16, 10.0 before 10.0.11, 10.2 before 10.2.8, and 10.4 before 10.4.4; CVSS 3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), so authentication is required but no user interaction is, and only the listed versions are in scope. Vendor fixes are available and the issue is prioritized act_now, but no public exploit code and no CISA KEV entry were identified at time of analysis; the two supplied references are one Splunk advisory plus an NVD detail page, so the corroborating signal quality is thin relative to the score.
Unauthenticated attackers can retrieve the most recently imported user dataset from WordPress sites running the WholesaleX plugin before 3.0.9, because the plugin leaves its user-import file in a web-accessible directory under a predictable filename. Exposed records can include account passwords together with customer contact and address details. Exploitation is conditional: an administrator must already have run the import feature and the file must not have been overwritten or cleaned up, which is why the assessed vector rates attack complexity High and SSVC marks the issue non-automatable; publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified as being used in the wild at time of analysis.
Improper access control in Splunk Enterprise 9.4, 10.0, 10.2, and 10.4 allows a low-privileged authenticated user to cross a security boundary and achieve high confidentiality, integrity, and availability impact, making the release a 9.9 severity fix. The flaw was found during Cisco's internal hardening review rather than through external reporting, and the affected ranges are 9.4 before 9.4.16, 10.0 before 10.0.11, 10.2 before 10.2.8, and 10.4 before 10.4.4. No public exploit code has been identified and there is no CISA KEV entry, but vendor patch availability combined with an act_now priority label places upgraded discipline on anyone running an unpatched instance; the trigger is not described in the available sources.
Pillow versions 11.0.0 through 12.x (fixed in 13.0.0) can reuse a stale native ImagingCore buffer when a multi-frame image is advanced to a later frame whose pixel mode widens from a narrow format to RGB or CMYK, or whose dimensions change, producing native out-of-bounds writes and crashes; the MPO path can additionally over-read memory and, on specific runtime/heap profiles, achieve command execution. Exploitation requires the application to open an attacker-supplied PSD, MPO, DCX, or MIC file and actually seek/load past the first frame, since reading only the initial frame does not trigger the bug; no credentials or user interaction are needed in an automated image-processing pipeline. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, although the 9.8 CVSS and the trivially craftable file format make weaponization plausible for any service that validates or thumbnails multi-frame uploads.
Heap-based buffer overflow in the GStreamer rtpL16depay element allows unauthenticated remote attackers to execute arbitrary code at the privilege level of the process hosting the pipeline. Only GStreamer-based software that actually instantiates rtpL16depay to depayload attacker-supplied RTP L16 (16-bit linear PCM) audio is exposed, so a passive RTP receiver or streaming server is effectively remotely exploitable while client-side applications may require the user to connect to a malicious stream. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published an upstream fix commit but no tagged patched release has been independently confirmed.
Authenticated arbitrary file upload in the Mang Board WP WordPress plugin through 2.4.4 lets any low-privileged account plant a PHP web shell and execute code on the underlying web server, changing scope beyond WordPress (CVSS 9.9). Exploitation requires a valid PR:L account, so exposure is concentrated on sites that permit untrusted or self-service registration; no public exploit or KEV entry was identified at time of analysis, and no fixed version is specified in the supplied data.
Unauthenticated remote command execution as root affects Cisco Expressway Series (Expressway-C and Expressway-E) deployments that expose the database service. The flaw combines reusable persistent cookies with a failure to validate client certificates when clustering TLS Verify Mode is set to Enabled, so an attacker in possession of the cookies can connect to the database service and invoke RPC commands to run arbitrary OS commands as root. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); no public exploit code was identified at time of analysis, and exploitation requires network reachability to the database and clustering service.
Authentication bypass in Cisco Unified CM and related Cisco collaboration products - Emergency Responder, Unified CM IM&P, Unity Connection, Prime Collaboration Deployment, and Unified CM SME - allows remote, unauthenticated attackers with low complexity and no user interaction to defeat authentication and potentially achieve full confidentiality, integrity, and availability impact (CVSS 9.8 Critical, CWE-287). The flaws were found in an internal Cisco review and fixed through hardening releases; no public exploit code or confirmed active exploitation was identified at time of analysis. Practical risk is tempered by exposure: these telephony and collaboration servers typically sit on internal or management networks rather than the public internet.
Cisco's batched voice-portfolio hardening release addresses several internally discovered injection-class defects (CWE-74) that affect Cisco Unified Communications Manager, Unified CM IM & Presence, Unified CM Session Management Edition, Unity Connection, Emergency Responder, and Prime Collaboration Deployment, and the vendor scores the bundled issue set at CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - network reachable, low complexity, no privileges and no user interaction, with high confidentiality, integrity, and availability impact. Because the advisory is a consolidated hardening bulletin rather than a per-defect writeup, the specific injectable parameter, protocol, or service is not disclosed, so the exact trigger cannot be derived from available data and real-world exposure depends on whether the management and application interfaces of these appliances are reachable from an attacker's network segment. No public exploit code and no confirmed active exploitation were identified at time of analysis, and these are typically intranet-deployed enterprise voice appliances rather than internet-facing systems, which narrows practical attack surface to adjacent-network or intranet positions in most deployments.
Signals conflict and must be weighed carefully: Splunk Enterprise versions before 9.4.16, 10.0.11, 10.2.8, and 10.4.4 contain internally discovered protection-mechanism failures tracked as CVE-2026-76301 (CWE-693), rated CVSS 9.8 with a vector for unauthenticated network attackers and high confidentiality, integrity, and availability impact. The specific feature, protocol, configuration, trigger, and per-vulnerability impact are not disclosed in the available sources, and no public exploit was identified at time of analysis; EPSS is low at 0.17% (6th percentile). A vendor patch is available, and the vuln.today decision is act_now.
php-travel-agency-system exposes an unauthenticated session-handling flaw in admin/session.php: by manipulating the user_id argument, a remote attacker can bypass authentication and obtain unauthorized session context with low confidentiality, integrity, and availability impact. The vendor distributes rolling releases with no affected or fixed version data and has not responded to the issue report, so every deployment must be treated as potentially vulnerable. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation; CVSS 4.0 scores it 6.9 with PR:N/UI:N, while practical risk is tempered by the product's rarity.
Unauthenticated remote attackers can invoke the index, store, update, and destroy actions of the Files API in MomoTommy file-management-system (app/Http/Controllers/FileController.php) because those actions lack any authentication check, allowing unauthorized listing, upload, modification, and deletion of files. The project is unversioned and has not responded to the early issue report, and publicly available exploit code exists (CWE-306, CVSS 4.0 score 5.5), though the niche hobby-project footprint and low confidentiality, integrity, and availability impact keep this a genuine but modest-priority issue rather than a top-tier emergency.
Unauthenticated remote attackers can delete arbitrary folders in oretnom23 file-management-system-php by invoking the delete_folder action in ajax.php and manipulating the ID argument; the endpoint lacks an authentication check (CWE-306). Publicly available exploit code exists, but no CISA KEV active-exploitation indication was provided in the available data. The issue is medium severity (CVSS 5.5) with low integrity and availability impact, and affected deployments are rolling-release with no fixed version identified while the maintainer has not responded to the report.
Unrestricted file upload in the PHP-based file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) lets remote users submit attacker-controlled files through the File parameter handled by FileController::store; the practical impact ranges from stored malicious content to code execution only if uploads are web-accessible and executable by the server. Publicly available exploit code exists, the report was filed with the project but no response is noted, and no CISA KEV entry is present. Authentication requirements are not confirmed from the available data-the authoritative assessment uses a CVSS 3.1 vector with PR:L, while the supplied CVSS 4.0 vector claims PR:N-so the endpoint should be treated as reachable by remote users and potentially requiring a valid low-privileged session.
SQL injection in oretnom23 php-travel-agency-system's admin/update.php endpoint allows attackers who can reach the administrative interface to manipulate the action, full_name, visa_no, hiden, title, description, page_id, or user parameters and execute arbitrary SQL statements. The project is a rolling-release PHP application without specific affected-version data, and publicly available exploit code exists through the vendor issue tracker. Although the supplied CVSS 4.0 vector rates PR:N, the independent assessment treats this as an admin-panel script requiring an authenticated administrative session (PR:L), with low confidentiality, integrity, and availability impact; no CISA KEV or active-exploitation evidence applies.
SQL injection in the admin/delete.php endpoint of oretnom23's php-travel-agency-system allows remote attackers to manipulate parameters such as costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, or user_id to alter backend SQL queries. Publicly available exploit code exists via the project's GitHub issue, and VulDB reports a CVSS 4.0 score of 6.9, but independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L and flags that access to the admin/ endpoint likely requires an authenticated administrator session despite VulDB's PR:N rating. No CISA KEV entry or confirmed active exploitation is reported at time of analysis.
SQL injection in oretnom23's file-management-system-php allows unauthenticated remote attackers to inject arbitrary SQL through the fid and id parameters of files.php, letting them read or tamper with the data the File Management component stores. Publicly available exploit code exists and the CVSS 4.0 vector carries an E:P (proof-of-concept) metric against a 6.9 base score; the issue is not in CISA KEV, and the vendor was notified via an issue report but has not responded. Impact is bounded to limited confidentiality, integrity and availability loss (C:L/I:L/A:L) rather than full database or host takeover, and because the project ships as a rolling release no version-specific fix has been published.
SQL injection in the Login function of oretnom23's file-management-system-php allows remote, unauthenticated attackers to manipulate the username and password parameters and alter the SQL used during the admin authentication flow. The assessment rates confidentiality, integrity, and availability impact as low, and affected deployments are identified only up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 because the project uses rolling releases. Public exploit code exists, but no CISA KEV entry or confirmed active exploitation was provided.
SQL injection in oretnom23 file-management-system-php (download.php) allows unauthenticated remote attackers to manipulate the 'ID' parameter and execute arbitrary SQL statements against the backend database. Publicly available exploit code exists, and the project uses a rolling release with no fixed version; the maintainer has not responded to the issue report. Although the CVSS 4.0 vector indicates network-reachable, low-complexity exploitation without authentication or user interaction, real-world exposure is limited by the project's obscurity and negligible installation base, and remediation currently depends on manual code patching or removing the component.
SQL injection in the dhikshitha29 Insurance-Management-System agent policy editor (EditPolicyHolder.php) lets remote attackers manipulate the Policy_no and Name parameters, which are concatenated directly into a mysqli_query call, potentially exposing or altering policy-holder records. The project is a niche open-source PHP application maintained on a rolling release with no published fixed version and an unresponsive maintainer, and publicly available exploit code exists. The supplied CVSS vector indicates no required privileges (PR:N) and no user interaction, but because the affected script resides under /Agent/ManagePolicy/, realistic exploitation likely requires an authenticated agent-portal session; authentication requirements are not definitively confirmed from the available data, and production exposure is expected to be minimal.
SQL injection in the dhikshitha29 Insurance-Management-System PHP application lets remote attackers inject arbitrary SQL through the Plan_no and Name parameters handled by mysqli_query() in /Admin/View/editPlan.php. The application is a niche, single-developer project distributed as a rolling release with no versioned tags, so the exact affected build range cannot be pinned beyond the referenced commits (91de5edda5baa109ad8e9baf03ce6a3ceda84183 and 125362cc21dca20d74091a4913a5096bb58dd837), and no vendor fix exists because the maintainer has not responded to the upstream issue report. Publicly available exploit code exists and the reporter (VulDB) documents the issue publicly, though there is no confirmed evidence of active exploitation (no CISA KEV listing); real-world risk is constrained mainly by the product's very small production footprint, and secondarily by the fact that the vulnerable endpoint sits under an /Admin/ path that some deployments may gate behind admin authentication.
Missing authorization in the Admin Endpoint of SourceCodester Food Order Management System 1.0 allows remote attackers to invoke administrative functionality without valid admin credentials, with limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, making the issue practical wherever the admin interface is network-exposed; no CISA KEV listing or confirmed active exploitation was provided at time of analysis. Because the vulnerable function is unnamed, defenders should confirm the affected admin route using the published PoC before tuning detections.
Unrestricted file upload in oretnom23's file-management-system-php lets remote attackers supply files of unrestricted type through the save_files function in admin_class.php, with potential server-side code execution if uploaded files land in a web-accessible directory that executes PHP. Affected code includes deployments at or before commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4, and no fixed release is identified because the project uses rolling releases and has not responded to the issue report; publicly available exploit code exists. The supplied CVSS 4.0 vector lists PR:N, but the handler's administrative location leaves authentication requirements unconfirmed and no CISA KEV confirmation of active exploitation was provided.
Improper authorization in the Policy Holder Update Form of dhikshitha29 Insurance-Management-System lets unauthenticated remote attackers update policy-holder records by manipulating the Policy_no parameter, and public exploit code exists. The project uses rolling releases, has no fixed version, and the maintainer has not responded to the issue report, so deployments exposing /Agent/includes/UpdatePolicyHolder-inc.php remain at risk unless they add authorization checks or block the endpoint. No CISA KEV listing confirms active exploitation at time of analysis.
SQL injection in the PHP-based File Management System (oretnom23/file-management-system-php) allows remote attackers to inject arbitrary SQL through the save_folder, delete_folder, delete_file, file_rename, and save_files functions in admin_class.php, with malicious values supplied in the name, parent_id, id, type, folder_id, or description parameters. Publicly available exploit code exists (documented in GitHub issue #4 and VulDB), though there is no CISA KEV confirmation of active exploitation. The project uses a rolling-release model with no tagged versions, so no fixed build can be specified, and the maintainer has not responded to the report; because the vulnerable routines sit in the admin class, real-world exploitability hinges on whether the administrative interface is reachable without a valid admin session - a discrepancy between the supplier's PR:N vector and the more likely PR:L assessment that defenders must verify.
SQL injection in oretnom23 File Management System (file-management-system-php) allows remote attackers to supply malicious name, username, password, type, or id values to the save_user function in admin_class.php, potentially reading or altering backend database contents. The project uses a rolling-release model, so no fixed version is published, and publicly available exploit code exists. Because save_user sits in the admin/user-management area, risk is highest where admin_class.php is reachable without enforced authentication or access control; the independent assessment models this as requiring low privileges (PR:L).
Unauthenticated SQL injection in ProjectWorlds Advanced Library Management System 1.0 lets remote attackers manipulate the roll_number parameter of individual_report_search.php, which is passed unsanitized into a mysqli_query call, enabling arbitrary SQL execution against the backend database. No privileges or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L); the practical barrier is exposure, since this is a niche PHP student/hobby application rarely internet-facing. Publicly available exploit code exists and the vector carries E:P, but there is no CISA KEV confirmation of active exploitation; impact is assessed as limited-tier confidentiality, integrity, and availability loss.
GPAC MP4Box before 2.5 can be crashed by a crafted MP4 file whose BIFS scene description contains deeply nested nodes, exhausting the stack in gf_bifs_dec_node and causing a denial of service. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, so exploitation is local, requires the victim to open or process the file, and affects only availability; publicly available exploit code exists. No CISA KEV entry is indicated in the provided data.
Code execution inside the target SageMaker execution environment, together with disclosure of the execution role's IAM credentials, is reachable through the Amazon SageMaker Python SDK's default_bucket() helper, which provisions and then consumes an S3 bucket whose name is derived predictably from the account ID and region but never verifies who actually owns that bucket. The defect affects V3 releases before 3.10.0 and V2 releases before 2.257.3; a remote actor who registers that predictable bucket name in their own AWS account first can influence the artifacts, scripts and data the victim's training, processing and hosting jobs read and write, which the vendor scores 9.4 (Critical) under CVSS 4.0 and which our independent assessment rates CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H because the attacker must win a bucket-name pre-creation race. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation favors newly onboarded or not-yet-provisioned environments, since targets that already own their default bucket are not exposed.
A NULL pointer dereference in GPAC's MP4Box command-line tool (versions before 2.5) allows a crafted MP4 file to crash the process, giving a local denial of service. The flaw sits in check_media_profile() in applications/mp4box/mp4box.c, which dereferences esd->decoderConfig after parsing an elementary stream descriptor that carries no decoder configuration; exploitation requires a user or automated workflow to run MP4Box against the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5). Impact is availability only - no code execution, disclosure or integrity effect is indicated - the issue is not in CISA KEV, EPSS is low at 0.21% (10th percentile), and a public PoC reference exists but is not verified as working exploit code.
Heap use-after-free in the DASH segmenter of GPAC/MP4Box (the dasher filter, src/filters/dasher.c) crashes the process when it is fed a crafted MP4 file, giving a Denial of Service with no confidentiality or integrity impact. Only builds prior to 2.5 are affected, and triggering it requires a user or an automated pipeline to locally open the malicious file with MP4Box (AV:L/UI:R, PR:N), so there is no network-reachable path. No confirmed active exploitation and no KEV entry are associated with this CVE; a public PoC reference exists but is not verified as working exploit code, and EPSS is low at 0.21% (10th percentile), which fits the moderate-to-low priority assessment that keeps this in the this_month queue rather than an emergency.
Heap use-after-free in GPAC/MP4Box AC-4 audio descriptor handling allows a crafted AC4 file to crash the parser, giving denial of service on affected builds before version 2.5. The flaw sits in gf_odf_ac4_cfg_clean_list in src/odf/descriptors.c and in the AC4 raw-frame parsing in src/media_tools/av_parsers.c, where attacker-controlled AC4 fields drive cleanup of substream-group and presentation structures that may already have been freed or double-freed. Per the assessed vector (AV:L/AC:L/PR:N/UI:R) the attack is local and needs the victim or an automated pipeline to open or process the malicious file; impact is limited to availability, with no confidentiality or integrity effect, EPSS is low (0.18%, 7th percentile), there is no confirmed active exploitation, and only a public PoC reference exists that is not verified as working exploit code.
A NULL pointer dereference in GPAC's AC-4 parser (gf_ac4_presentation_ch_mode in src/media_tools/av_parsers.c) crashes MP4Box and other GPAC-based tools when they process a crafted AC4 file, giving an attacker a denial-of-service condition against the parsing process. GPAC releases before 2.5 are affected; the attack is local and requires the victim or an automated workflow to open the malicious file (AV:L, UI:R), and the assessed impact is availability only, with no confidentiality or integrity effect and no code execution indicated by the sources. There is no CISA KEV entry, EPSS is 0.18% (7th percentile), and a public PoC reference exists but is not verified as working exploit code, so this fits a normal monthly patch cadence rather than an emergency response.
Processing a crafted MP4 file with GPAC/MP4Box before 2.5 can crash the application through an unvalidated track-dependency count in GetESD(), causing a denial of service. The flaw is local and user-assisted (AV:L, UI:R): the victim or an automated workflow must open or parse the malicious file, and impact is availability-only with no evidence of code execution or confidentiality/integrity loss. Publicly available exploit code exists, but the supplied data does not indicate CISA KEV active exploitation; this is a genuine but low-priority memory-safety DoS rather than a critical RCE.
Use-after-free in GPAC/MP4Box builds before 2.5 lets an attacker crash the process by getting a victim to open a crafted MPEG-2 file with the affected tooling. The CVSS vector (AV:L/AC:L/PR:N/UI:R) means the attacker needs local access and must rely on the victim invoking MP4Box or a GPAC-based pipeline on the malicious input; impact is limited to availability (A:H with C:N/I:N), so the realistic outcome is a denial of service rather than code execution or data exposure. There is no CISA KEV entry and EPSS is low at 0.17% (6th percentile), but a public PoC reference exists; it is not verified as working exploit code, and the issue is resolved by upgrading to GPAC 2.5.
Denial of service in GPAC MP4Box before 2.5 occurs when a crafted file is processed and a null pointer dereference in gf_isom_get_esd crashes the tool. The issue requires local access and user interaction, with no privileges required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), and impact is limited to availability with no code execution or data exposure. No CISA KEV entry is present and EPSS is low at 0.17% (6th percentile), although a public PoC reference exists and is not verified as working exploit code.
Heap use-after-free in GPAC/MP4Box before 2.5 lets local, unauthenticated attackers crash the process by supplying a crafted MP4 file that the victim processes. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms local access with user interaction and no privileges required, and impact is limited to availability. EPSS is low at 0.17% (6th percentile), a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
Denial of service in GPAC (MP4Box) releases before 2.5 occurs when the tool processes an attacker-supplied crafted MPEG-4 file that drives the scene-statistics code path to call StatSFVec2f with a NULL 'val' pointer, crashing the process. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) describes a local attack in which the operator must open or process the malicious file - there is no remote or unauthenticated network trigger, and impact is limited to availability with no confidentiality, integrity, or code-execution impact indicated. EPSS is 0.16% (5th percentile) and there is no CISA KEV listing; a public PoC reference exists but it is not verified as working exploit code, and the vulnerability is not treated as a high-priority emergency (priority label: this_month).
GPAC MP4Box before 2.5 can crash with a NULL pointer dereference in dasher_insert_timeline_entry when it processes a crafted MP4 file through the dasher/DASH-segmentation code path, causing a denial of service. The issue is local and requires user interaction-a user or automated job must run MP4Box on the malicious file-with no privileges required and impact limited to availability. No active exploitation is confirmed, a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.16% (5th percentile).
An out-of-bounds read in GPAC's AC-4 decoder-specific-information parser (gf_odf_ac4_cfg_dsi_v1 in src/odf/descriptors.c) causes MP4Box to crash when it processes a crafted AC4 audio file. The flaw affects GPAC builds before v26.07.0 and is reachable when a user opens, muxes or transcodes an untrusted AC4 file (local vector, user interaction required, no authentication per the CVSS vector); the assessed impact is denial of service only, with no code execution or confirmed data disclosure. Risk is modest: EPSS is 0.16% (5th percentile), the issue is not in CISA KEV, and a public PoC reference exists but is not verified as working exploit code - practical exposure is concentrated in automated pipelines that batch-ingest untrusted media.
An insecure direct object reference (CWE-639) in the Pricing Table WordPress plugin before 4.1.3 lets users with the contributor role or higher duplicate legacy pricing tables without any authorization check, thereby cloning and publishing arbitrary posts and pages on the site - including private and draft content owned by other users. Publicly available exploit code exists, and exploitation requires only a legitimate low-privilege account plus use of the plugin's legacy duplication feature; impact is confined to content cloning/publication rather than full site takeover, which keeps this at moderate severity.
Improper authorization in dhikshitha29 Insurance Management System lets remote, unauthenticated attackers create a new administrator account by manipulating the submit, Admin_id, and password parameters sent to /Admin/includes/Admin-Register-inc.php. The project uses a rolling-release model, so no fixed or affected version can be scoped; publicly available exploit code exists and the vendor has not responded to the report. With a CVSS score of 5.5 (medium), impact is limited to partial confidentiality, integrity, and availability rather than full system compromise.
Command injection in the `ssh` service of Lagoon core (uselagoon/lagoon) lets an authenticated Lagoon user execute arbitrary commands on the core container, which can be leveraged to escalate to elevated administrative permissions across the platform. Affected deployments are those running a Lagoon core release before the fix shipped in v2.33.2 (helm chart lagoon-core v1.62.2); note the advisory text says "prior to 2.33.1" while the actual patch landed in 2.33.2, so 2.33.2 should be treated as the first safe version. Exploitation requires a provisioned account (CVSS vector PR:L, authenticated) and network reachability to the Lagoon core ssh service specifically; the separate `ssh-portal` service is not affected. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is detectable by watching the ssh service container logs for the string "too many arguments".
HTML injection in the HappyForms WordPress plugin (versions before 1.26.15) allows unauthenticated attackers to place arbitrary HTML into the notification emails that site administrators receive, because a user-controlled referral value is embedded without sanitisation or escaping. The injected markup only renders when an administrator actually opens the notification email, so exploitation requires user interaction and yields limited integrity impact on the email content rather than server-side compromise. Publicly available exploit code exists per the WPScan disclosure; there is no CISA KEV indication of active exploitation, and the severity is moderate.
Authentication bypass and SYSTEM-level command execution in Best Practice Software Bp Premier before 1.14.1.1128 stem from a hardcoded, installation-wide Microsoft SQL Server sysadmin password, allowing unauthenticated remote attackers with TCP access to the database to bypass application authentication and execute operating system commands as SYSTEM under the documented default SQL service configuration. The credential is shared across all installations and cannot be changed without breaking the application, so no in-product hardening is possible pending the vendor patch. No public exploit code or CISA KEV entry was identified at time of analysis, but the main constraint is database reachability: deployments exposing SQL Server port 1433 or attackers already on the clinic LAN can exploit it.
Missing authentication in the HKUDS Vibe-Trading FastAPI server (pip package vibe-trading-ai 0.1.0 through 0.1.6) lets unauthenticated remote attackers reach every endpoint guarded by Depends(require_auth), because require_auth() returns immediately when API_AUTH_KEY is unset - which is the shipped default in agent/.env.example. Attackers can POST to /sessions/{id}/messages to drive the agent's BashTool toward shell command execution, upload .py/.sh/.yaml files via /upload, read other users' session histories, and recover partial API keys via _mask_secret(); because the shipped Dockerfile has no USER directive and docker-compose publishes 0.0.0.0:8899, any command executed lands as root inside the container. Exploitation matches the assessed vector AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact; the full chained RCE demonstration additionally requires the operator to have configured a working LLM API key so the tool-call loop can complete, while the unauthenticated API surface, file upload, history read and partial key disclosure work without it. No CISA KEV listing and no public exploit code identified at time of analysis, though the vendor advisory publishes detailed reproduction steps; fix in 0.1.7.
Unauthenticated vote-integrity bypass in the Contest Gallery WordPress plugin before 34.0.1 allows remote attackers to cast multiple votes for the same contest entry, inflating its tally without compromising site data or availability. The plugin relies on a client-supplied request header and an unbound client-generated token rather than a server-verified visitor identity, so any visitor can replay or forge vote submissions. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation; CVSS 5.3 reflects integrity-only impact (I:L).
Unauthenticated visitors can view the content of maintenance-exempt pages on WordPress sites running CMP - Coming Soon & Maintenance plugin before 4.1.21 when the operator has enabled maintenance mode and manually whitelisted pages by URL pattern. The disclosure is limited to those explicitly whitelisted pages and requires that non-default configuration; publicly available exploit code exists.
Unauthenticated information disclosure in the SureCart WordPress plugin before 4.9.5 allows anonymous visitors to pull merchant-private catalog metadata - pricing, commission, stock levels, SKU and tax internals, including unpublished products - by abusing the include parameters of the plugin's public single-upsell-funnel REST endpoint. The endpoint neither restricts which related objects a caller may request nor strips private fields from the returned objects, so any reachable storefront exposing at least one upsell funnel is affected without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3). Publicly available exploit code exists according to the WPScan reference, and the vendor has released a patch in version 4.9.5; impact is bounded to catalog disclosure, with no customer records, credentials, write access, or code execution exposed.