Hardcoded TURN relay credentials in the Girafit camera app (Android and iOS) version 1.9.1 and earlier expose a shared, static TURN username and session token that is identical across every installation and tied to no specific user or device. Unauthenticated remote attackers can recover this credential by decompiling the app binary or by capturing the cleartext STUN/TURN authentication exchange that occurs during live-view registration, and publicly available exploit code exists. On its own the leak supports tracking and fingerprinting of relay sessions; impersonation or deeper abuse is explicitly gated on also holding the separate TURN relay password, which this vulnerability does not disclose, keeping the assessed impact to confidentiality-only and low severity.
Insufficient GraphQL scope enforcement in GitLab CE/EE lets an authenticated user with a read_api-scoped token retrieve a project's incoming email address and create work items that the token should not permit. The flaw affects GitLab CE/EE versions from 18.2 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1; publicly available exploit code exists, and no confirmed active exploitation is indicated in the provided intelligence. The independent assessment rates this as a moderate-priority authorization issue because exploitation requires a valid read_api token and a conditional GraphQL path, with impact bounded to the disclosed email address and work-item creation rather than broad data access.
Stored cross-site scripting in Elementor Website Builder for WordPress before 4.3.5 lets an authenticated user with the Contributor role or higher upload an SVG whose text content carries a script payload that the plugin's sanitizer never inspects, since only SVG elements and attributes are validated. The payload fires when the SVG is rendered inline on a page and a victim views that page in a Chromium-based browser; Firefox users are unaffected, and exploitation requires the victim to actively load the poisoned page. Publicly available exploit code exists (published through WPScan) and the issue carries a vendor patch, but there is no CISA KEV listing and no evidence of active, widespread exploitation, making this a medium-severity (CVSS 6.8, CWE-79) stored XSS with meaningful but constrained prerequisites.
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signed intermediate CA certificates protected by weak private keys, so a man-in-the-middle attacker who can intercept traffic and who can factor or guess those keys could mint certificates for arbitrary hostnames that TLS clients using the system trust store would accept (CVSS 6.8, CWE-295). Affected platforms span Red Hat Enterprise Linux 6 through 10 plus a long list of layered products such as OpenShift Container Platform 4, Satellite 6, Quay 3, Advanced Cluster Management, and the cert-manager and logging operators. Attackers need a privileged network position and a victim client that actually initiates a TLS connection validated against the system store, so this is a trust-anchoring and impersonation problem rather than a remotely reachable code-execution flaw; there is no availability impact and no public exploit code identified at time of analysis. Because individual intermediate certificates cannot be selectively distrusted across every consumer of the system store, Red Hat is removing the parent root CAs outright, which is the crux of the remediation.
Stored cross-site scripting in the HireZoot WordPress plugin before 4.1.1 allows any account holding the Author role to plant script payloads in plugin data that is later rendered unescaped in the admin dashboard, and the plugin actively reverses the HTML-entity encoding that would otherwise neutralise those payloads. The injected script executes in a logged-in administrator's session once that administrator views the affected dashboard page, giving a low-trust Author-level user a path to admin-context actions; publicly available exploit code exists and the vendor has released 4.1.1 as the fix. Because exploitation requires an existing Author account plus administrator interaction, this is a moderate-risk insider privilege-escalation issue rather than an anonymous remote compromise.
SQL injection in Swift Performance Lite before 2.3.7.4 allows authenticated users with author-level or higher privileges to execute arbitrary SQL queries, potentially exposing sensitive database contents. The flaw arises from missing sanitization and escaping of a value used in a SQL statement (CWE-89), and publicly available exploit code exists. Exploitation requires a valid author account on a site with the plugin active, which narrows the attack surface compared to unauthenticated flaws.
Node.js TLS identity checking accepts non-canonical textual representations of IP addresses, so a peer certificate carrying an IP subjectAltName in a non-canonical form can pass the check it should fail (CWE-295). The flaw is grouped with CVE-2026-106069 under the Node.js 26.12.1 security release ('tls: reject non-canonical IP addresses') and is rated High by the project; EUVD lists Node 24.22.0 (≤24.22.0), 26.12.0 (≤26.12.0) and 22.23.3 (≤22.23.3) as affected baselines, and it is fixed by upgrading to 26.12.1 or the corresponding patched 24.x and 22.x releases. Exploitation is not opportunistic: the attacker must be able to intercept or interpose on a TLS connection and present a certificate whose non-canonical IP form is accepted - an on-path/MITM position rather than a plain remote request - and the independent reassessment scores this AV:N/AC:H/PR:N/UI:N with high confidentiality and integrity impact. There is no CISA KEV entry and no confirmed active exploitation; a public PoC reference exists (a gist linked from exploit-tracking sources) but it is not verified as working exploit code, and the priority label is 'this_month' rather than act-now.
Memory-amplification denial of service in Pillow's BMP RLE decoder (BI_RLE4/BI_RLE8) allows unauthenticated remote attackers to exhaust memory by delivering a small crafted BMP to any image pipeline that processes untrusted files with Pillow before 13.0.0. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so impact is limited to availability with no code execution or information disclosure; the Pillow project classifies this issue as Medium severity. No public exploit code was identified at time of analysis, and exploitation requires the application to actually route attacker-supplied BMP data into Pillow's decoder.
Information disclosure in GitLab CE/EE allows an attacker to retrieve sensitive internal server credentials when GitLab fails to filter internal response headers, leaking secrets that may be reusable against backend services. Affected are all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1, remediated in the 19.3.6, 19.4.3, and 19.5.1 patch releases. Publicly available exploit code exists (a HackerOne report is linked in the references), and a key prerequisite remains disputed: the published CVSS vector specifies PR:L (an authenticated low-privilege session) while the vendor description states an unauthenticated user could exploit the issue, so realistic exposure depends on resolving that question for the specific deployment.
Node.js releases at or below 22.23.3, 24.22.0 and 26.12.0 contain a flaw in the HTTP Agent's internal data guard, fixed in the v26.12.1 security release so that the guard functions even when no I/O is taking place. Exploitation is network reachable and needs no authentication or user interaction, but the assessed high attack complexity means an attacker must win a narrow timing window, and the resulting impact is bounded to low confidentiality and low integrity effects; the vendor classifies this item as 'Medium' within a release that otherwise bundles several High-severity fixes. A public PoC reference exists; it is not verified as working exploit code, no confirmed active exploitation has been reported, and the current priority places remediation in this month's cycle.
An authorization bypass in the GitLab CE/EE group milestones API lets any authenticated user read milestone metadata - titles, descriptions, and full project paths - from arbitrary private projects without holding membership in them. Affected releases span 15.10 through the fixed versions 19.3.6, 19.4.3, and 19.5.1, and exploitation only requires a valid account plus a crafted project filter parameter (CVSS 4.3, PR:L, confidentiality-only). Publicly available exploit code exists (HackerOne report 3792168), but the flaw is read-only metadata disclosure with no modification or code access, making it a low-to-moderate priority information-disclosure issue rather than a high-impact compromise.
Broken authorization on a plugin REST route lets unauthenticated attackers take over existing WooCommerce orders on stores running the Synchrony Financing WordPress plugin (affected range 1.0.5 up to, but not including, 1.1.2) - reassigning an order to an account they control, altering its contents, and reading the associated customer's personal data. Rated CVSS 6.5 (CWE-863) with a network-reachable, no-prerequisite attack path (AV:N/AC:L/PR:N/UI:N), the flaw is narrow in deployment scope but exposes customer PII wherever it is present, and publicly available exploit code exists. No confirmed active exploitation (CISA KEV) was observed at time of analysis, and a vendor-released patch (1.1.2) is available.
Unauthenticated attackers can activate pending WholesaleX accounts on WordPress sites running plugin versions before 3.0.9 by supplying a request that satisfies the plugin's confirmation-code comparison against an unset stored value, bypassing the administrator approval normally required before login. Publicly available exploit code exists, but the supplied SSVC assessment records exploitation as none and technical impact as partial; the issue is remotely reachable with no credentials or user interaction under the default approval configuration. The practical risk is moderate because a successful attack can activate an existing pending account and alter its login state, with low confidentiality and integrity impact and no availability impact.
Authenticated Subscriber-level users can abuse Moloni WordPress plugin versions before 5.0.14 to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock because several AJAX actions lack capability and nonce checks. Exploitation requires the site to have an active stored connection to the external Moloni invoicing provider, and publicly available exploit code exists; the CVSS 3.1 score is 6.5 (Medium) with PR:L and integrity-only impact. Sites that allow open registration or host untrusted low-privilege accounts face the highest practical exposure.
Unauthenticated attackers can rewrite the merchant credential that a WordPress store's Wava Payment Plugin uses to create payments, silently flip the integration into a 'verified' state the site owner never completed, and strip the payment method from checkout entirely. The flaw affects versions 0.3.1 through 0.3.9 (fixed in 0.3.10) and is reachable in default configuration because the exposed public REST endpoint enforces no authorisation, nonce, or origin check. Ratings put it at CVSS 6.5 (AV:N/AC:L/PR:N/UI:N, integrity and availability only), and publicly available exploit code exists, so mass scanning against WordPress REST paths is plausible even though there is no confirmed active exploitation (no CISA KEV listing).
Stored cross-site scripting in the Elementor Website Builder WordPress plugin before 4.3.5 allows users holding the Author role or higher to upload SVG files whose embedded JavaScript executes in the browser of anyone who later opens or previews the file. The vendor's CVSS vector marks this authenticated (PR:L), and exploitation carries two hard preconditions: the plugin's non-default 'unfiltered file uploads' setting must be enabled, and the attacker must already possess an Author-or-above account, with the payload only firing when a second victim interacts with the uploaded SVG. Publicly available exploit code exists (WPScan reference) but there is no evidence of active exploitation, so the practical risk is moderate and configuration-dependent rather than urgent.
An authorization bypass in GitLab Enterprise Edition (versions 12.0 through 19.3.5, 19.4.0-19.4.2, and 19.5.0) lets an authenticated user grant or accept project and group membership outside identity provider control when the instance-wide SAML or LDAP membership lock is enabled. The flaw stems from incomplete enforcement of the membership lock against membership requests or invitations that were created before the lock was turned on, so it is state-dependent: it does not affect Community Edition or default installs, and it does not work against requests created after the lock is active. Publicly available exploit code and a HackerOne report exist, but there is no CISA KEV confirmation of active exploitation; it yields unauthorized project/group membership rather than administrative takeover.
Unauthenticated attackers can retrieve the most recently imported user dataset from WordPress sites running the WholesaleX plugin before 3.0.9, because the plugin leaves its user-import file in a web-accessible directory under a predictable filename. Exposed records can include account passwords together with customer contact and address details. Exploitation is conditional: an administrator must already have run the import feature and the file must not have been overwritten or cleaned up, which is why the assessed vector rates attack complexity High and SSVC marks the issue non-automatable; publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV) and no public exploit identified as being used in the wild at time of analysis.
php-travel-agency-system exposes an unauthenticated session-handling flaw in admin/session.php: by manipulating the user_id argument, a remote attacker can bypass authentication and obtain unauthorized session context with low confidentiality, integrity, and availability impact. The vendor distributes rolling releases with no affected or fixed version data and has not responded to the issue report, so every deployment must be treated as potentially vulnerable. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation; CVSS 4.0 scores it 6.9 with PR:N/UI:N, while practical risk is tempered by the product's rarity.
Unauthenticated remote attackers can invoke the index, store, update, and destroy actions of the Files API in MomoTommy file-management-system (app/Http/Controllers/FileController.php) because those actions lack any authentication check, allowing unauthorized listing, upload, modification, and deletion of files. The project is unversioned and has not responded to the early issue report, and publicly available exploit code exists (CWE-306, CVSS 4.0 score 5.5), though the niche hobby-project footprint and low confidentiality, integrity, and availability impact keep this a genuine but modest-priority issue rather than a top-tier emergency.
Unauthenticated remote attackers can delete arbitrary folders in oretnom23 file-management-system-php by invoking the delete_folder action in ajax.php and manipulating the ID argument; the endpoint lacks an authentication check (CWE-306). Publicly available exploit code exists, but no CISA KEV active-exploitation indication was provided in the available data. The issue is medium severity (CVSS 5.5) with low integrity and availability impact, and affected deployments are rolling-release with no fixed version identified while the maintainer has not responded to the report.
Unrestricted file upload in the PHP-based file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df) lets remote users submit attacker-controlled files through the File parameter handled by FileController::store; the practical impact ranges from stored malicious content to code execution only if uploads are web-accessible and executable by the server. Publicly available exploit code exists, the report was filed with the project but no response is noted, and no CISA KEV entry is present. Authentication requirements are not confirmed from the available data-the authoritative assessment uses a CVSS 3.1 vector with PR:L, while the supplied CVSS 4.0 vector claims PR:N-so the endpoint should be treated as reachable by remote users and potentially requiring a valid low-privileged session.
SQL injection in oretnom23 php-travel-agency-system's admin/update.php endpoint allows attackers who can reach the administrative interface to manipulate the action, full_name, visa_no, hiden, title, description, page_id, or user parameters and execute arbitrary SQL statements. The project is a rolling-release PHP application without specific affected-version data, and publicly available exploit code exists through the vendor issue tracker. Although the supplied CVSS 4.0 vector rates PR:N, the independent assessment treats this as an admin-panel script requiring an authenticated administrative session (PR:L), with low confidentiality, integrity, and availability impact; no CISA KEV or active-exploitation evidence applies.
SQL injection in the admin/delete.php endpoint of oretnom23's php-travel-agency-system allows remote attackers to manipulate parameters such as costomer_id, ticket_id, payment_id, id, document_id, salary_id, emp_id, or user_id to alter backend SQL queries. Publicly available exploit code exists via the project's GitHub issue, and VulDB reports a CVSS 4.0 score of 6.9, but independent assessment rates it CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L and flags that access to the admin/ endpoint likely requires an authenticated administrator session despite VulDB's PR:N rating. No CISA KEV entry or confirmed active exploitation is reported at time of analysis.
SQL injection in oretnom23's file-management-system-php allows unauthenticated remote attackers to inject arbitrary SQL through the fid and id parameters of files.php, letting them read or tamper with the data the File Management component stores. Publicly available exploit code exists and the CVSS 4.0 vector carries an E:P (proof-of-concept) metric against a 6.9 base score; the issue is not in CISA KEV, and the vendor was notified via an issue report but has not responded. Impact is bounded to limited confidentiality, integrity and availability loss (C:L/I:L/A:L) rather than full database or host takeover, and because the project ships as a rolling release no version-specific fix has been published.
SQL injection in the Login function of oretnom23's file-management-system-php allows remote, unauthenticated attackers to manipulate the username and password parameters and alter the SQL used during the admin authentication flow. The assessment rates confidentiality, integrity, and availability impact as low, and affected deployments are identified only up to commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4 because the project uses rolling releases. Public exploit code exists, but no CISA KEV entry or confirmed active exploitation was provided.
SQL injection in oretnom23 file-management-system-php (download.php) allows unauthenticated remote attackers to manipulate the 'ID' parameter and execute arbitrary SQL statements against the backend database. Publicly available exploit code exists, and the project uses a rolling release with no fixed version; the maintainer has not responded to the issue report. Although the CVSS 4.0 vector indicates network-reachable, low-complexity exploitation without authentication or user interaction, real-world exposure is limited by the project's obscurity and negligible installation base, and remediation currently depends on manual code patching or removing the component.
SQL injection in the dhikshitha29 Insurance-Management-System agent policy editor (EditPolicyHolder.php) lets remote attackers manipulate the Policy_no and Name parameters, which are concatenated directly into a mysqli_query call, potentially exposing or altering policy-holder records. The project is a niche open-source PHP application maintained on a rolling release with no published fixed version and an unresponsive maintainer, and publicly available exploit code exists. The supplied CVSS vector indicates no required privileges (PR:N) and no user interaction, but because the affected script resides under /Agent/ManagePolicy/, realistic exploitation likely requires an authenticated agent-portal session; authentication requirements are not definitively confirmed from the available data, and production exposure is expected to be minimal.
SQL injection in the dhikshitha29 Insurance-Management-System PHP application lets remote attackers inject arbitrary SQL through the Plan_no and Name parameters handled by mysqli_query() in /Admin/View/editPlan.php. The application is a niche, single-developer project distributed as a rolling release with no versioned tags, so the exact affected build range cannot be pinned beyond the referenced commits (91de5edda5baa109ad8e9baf03ce6a3ceda84183 and 125362cc21dca20d74091a4913a5096bb58dd837), and no vendor fix exists because the maintainer has not responded to the upstream issue report. Publicly available exploit code exists and the reporter (VulDB) documents the issue publicly, though there is no confirmed evidence of active exploitation (no CISA KEV listing); real-world risk is constrained mainly by the product's very small production footprint, and secondarily by the fact that the vulnerable endpoint sits under an /Admin/ path that some deployments may gate behind admin authentication.
Missing authorization in the Admin Endpoint of SourceCodester Food Order Management System 1.0 allows remote attackers to invoke administrative functionality without valid admin credentials, with limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, making the issue practical wherever the admin interface is network-exposed; no CISA KEV listing or confirmed active exploitation was provided at time of analysis. Because the vulnerable function is unnamed, defenders should confirm the affected admin route using the published PoC before tuning detections.
Unrestricted file upload in oretnom23's file-management-system-php lets remote attackers supply files of unrestricted type through the save_files function in admin_class.php, with potential server-side code execution if uploaded files land in a web-accessible directory that executes PHP. Affected code includes deployments at or before commit 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4, and no fixed release is identified because the project uses rolling releases and has not responded to the issue report; publicly available exploit code exists. The supplied CVSS 4.0 vector lists PR:N, but the handler's administrative location leaves authentication requirements unconfirmed and no CISA KEV confirmation of active exploitation was provided.
Improper authorization in the Policy Holder Update Form of dhikshitha29 Insurance-Management-System lets unauthenticated remote attackers update policy-holder records by manipulating the Policy_no parameter, and public exploit code exists. The project uses rolling releases, has no fixed version, and the maintainer has not responded to the issue report, so deployments exposing /Agent/includes/UpdatePolicyHolder-inc.php remain at risk unless they add authorization checks or block the endpoint. No CISA KEV listing confirms active exploitation at time of analysis.
SQL injection in the PHP-based File Management System (oretnom23/file-management-system-php) allows remote attackers to inject arbitrary SQL through the save_folder, delete_folder, delete_file, file_rename, and save_files functions in admin_class.php, with malicious values supplied in the name, parent_id, id, type, folder_id, or description parameters. Publicly available exploit code exists (documented in GitHub issue #4 and VulDB), though there is no CISA KEV confirmation of active exploitation. The project uses a rolling-release model with no tagged versions, so no fixed build can be specified, and the maintainer has not responded to the report; because the vulnerable routines sit in the admin class, real-world exploitability hinges on whether the administrative interface is reachable without a valid admin session - a discrepancy between the supplier's PR:N vector and the more likely PR:L assessment that defenders must verify.
SQL injection in oretnom23 File Management System (file-management-system-php) allows remote attackers to supply malicious name, username, password, type, or id values to the save_user function in admin_class.php, potentially reading or altering backend database contents. The project uses a rolling-release model, so no fixed version is published, and publicly available exploit code exists. Because save_user sits in the admin/user-management area, risk is highest where admin_class.php is reachable without enforced authentication or access control; the independent assessment models this as requiring low privileges (PR:L).
Unauthenticated SQL injection in ProjectWorlds Advanced Library Management System 1.0 lets remote attackers manipulate the roll_number parameter of individual_report_search.php, which is passed unsanitized into a mysqli_query call, enabling arbitrary SQL execution against the backend database. No privileges or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L); the practical barrier is exposure, since this is a niche PHP student/hobby application rarely internet-facing. Publicly available exploit code exists and the vector carries E:P, but there is no CISA KEV confirmation of active exploitation; impact is assessed as limited-tier confidentiality, integrity, and availability loss.
GPAC MP4Box before 2.5 can be crashed by a crafted MP4 file whose BIFS scene description contains deeply nested nodes, exhausting the stack in gf_bifs_dec_node and causing a denial of service. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, so exploitation is local, requires the victim to open or process the file, and affects only availability; publicly available exploit code exists. No CISA KEV entry is indicated in the provided data.
Heap use-after-free in the DASH segmenter of GPAC/MP4Box (the dasher filter, src/filters/dasher.c) crashes the process when it is fed a crafted MP4 file, giving a Denial of Service with no confidentiality or integrity impact. Only builds prior to 2.5 are affected, and triggering it requires a user or an automated pipeline to locally open the malicious file with MP4Box (AV:L/UI:R, PR:N), so there is no network-reachable path. No confirmed active exploitation and no KEV entry are associated with this CVE; a public PoC reference exists but is not verified as working exploit code, and EPSS is low at 0.21% (10th percentile), which fits the moderate-to-low priority assessment that keeps this in the this_month queue rather than an emergency.
A NULL pointer dereference in GPAC's MP4Box command-line tool (versions before 2.5) allows a crafted MP4 file to crash the process, giving a local denial of service. The flaw sits in check_media_profile() in applications/mp4box/mp4box.c, which dereferences esd->decoderConfig after parsing an elementary stream descriptor that carries no decoder configuration; exploitation requires a user or automated workflow to run MP4Box against the malicious file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5). Impact is availability only - no code execution, disclosure or integrity effect is indicated - the issue is not in CISA KEV, EPSS is low at 0.21% (10th percentile), and a public PoC reference exists but is not verified as working exploit code.
Heap use-after-free in GPAC/MP4Box AC-4 audio descriptor handling allows a crafted AC4 file to crash the parser, giving denial of service on affected builds before version 2.5. The flaw sits in gf_odf_ac4_cfg_clean_list in src/odf/descriptors.c and in the AC4 raw-frame parsing in src/media_tools/av_parsers.c, where attacker-controlled AC4 fields drive cleanup of substream-group and presentation structures that may already have been freed or double-freed. Per the assessed vector (AV:L/AC:L/PR:N/UI:R) the attack is local and needs the victim or an automated pipeline to open or process the malicious file; impact is limited to availability, with no confidentiality or integrity effect, EPSS is low (0.18%, 7th percentile), there is no confirmed active exploitation, and only a public PoC reference exists that is not verified as working exploit code.
A NULL pointer dereference in GPAC's AC-4 parser (gf_ac4_presentation_ch_mode in src/media_tools/av_parsers.c) crashes MP4Box and other GPAC-based tools when they process a crafted AC4 file, giving an attacker a denial-of-service condition against the parsing process. GPAC releases before 2.5 are affected; the attack is local and requires the victim or an automated workflow to open the malicious file (AV:L, UI:R), and the assessed impact is availability only, with no confidentiality or integrity effect and no code execution indicated by the sources. There is no CISA KEV entry, EPSS is 0.18% (7th percentile), and a public PoC reference exists but is not verified as working exploit code, so this fits a normal monthly patch cadence rather than an emergency response.
Processing a crafted MP4 file with GPAC/MP4Box before 2.5 can crash the application through an unvalidated track-dependency count in GetESD(), causing a denial of service. The flaw is local and user-assisted (AV:L, UI:R): the victim or an automated workflow must open or parse the malicious file, and impact is availability-only with no evidence of code execution or confidentiality/integrity loss. Publicly available exploit code exists, but the supplied data does not indicate CISA KEV active exploitation; this is a genuine but low-priority memory-safety DoS rather than a critical RCE.
Denial of service in GPAC MP4Box before 2.5 occurs when a crafted file is processed and a null pointer dereference in gf_isom_get_esd crashes the tool. The issue requires local access and user interaction, with no privileges required (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), and impact is limited to availability with no code execution or data exposure. No CISA KEV entry is present and EPSS is low at 0.17% (6th percentile), although a public PoC reference exists and is not verified as working exploit code.
Heap use-after-free in GPAC/MP4Box before 2.5 lets local, unauthenticated attackers crash the process by supplying a crafted MP4 file that the victim processes. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms local access with user interaction and no privileges required, and impact is limited to availability. EPSS is low at 0.17% (6th percentile), a public PoC reference exists but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation.
Use-after-free in GPAC/MP4Box builds before 2.5 lets an attacker crash the process by getting a victim to open a crafted MPEG-2 file with the affected tooling. The CVSS vector (AV:L/AC:L/PR:N/UI:R) means the attacker needs local access and must rely on the victim invoking MP4Box or a GPAC-based pipeline on the malicious input; impact is limited to availability (A:H with C:N/I:N), so the realistic outcome is a denial of service rather than code execution or data exposure. There is no CISA KEV entry and EPSS is low at 0.17% (6th percentile), but a public PoC reference exists; it is not verified as working exploit code, and the issue is resolved by upgrading to GPAC 2.5.
Denial of service in GPAC (MP4Box) releases before 2.5 occurs when the tool processes an attacker-supplied crafted MPEG-4 file that drives the scene-statistics code path to call StatSFVec2f with a NULL 'val' pointer, crashing the process. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) describes a local attack in which the operator must open or process the malicious file - there is no remote or unauthenticated network trigger, and impact is limited to availability with no confidentiality, integrity, or code-execution impact indicated. EPSS is 0.16% (5th percentile) and there is no CISA KEV listing; a public PoC reference exists but it is not verified as working exploit code, and the vulnerability is not treated as a high-priority emergency (priority label: this_month).
GPAC MP4Box before 2.5 can crash with a NULL pointer dereference in dasher_insert_timeline_entry when it processes a crafted MP4 file through the dasher/DASH-segmentation code path, causing a denial of service. The issue is local and requires user interaction-a user or automated job must run MP4Box on the malicious file-with no privileges required and impact limited to availability. No active exploitation is confirmed, a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.16% (5th percentile).
An out-of-bounds read in GPAC's AC-4 decoder-specific-information parser (gf_odf_ac4_cfg_dsi_v1 in src/odf/descriptors.c) causes MP4Box to crash when it processes a crafted AC4 audio file. The flaw affects GPAC builds before v26.07.0 and is reachable when a user opens, muxes or transcodes an untrusted AC4 file (local vector, user interaction required, no authentication per the CVSS vector); the assessed impact is denial of service only, with no code execution or confirmed data disclosure. Risk is modest: EPSS is 0.16% (5th percentile), the issue is not in CISA KEV, and a public PoC reference exists but is not verified as working exploit code - practical exposure is concentrated in automated pipelines that batch-ingest untrusted media.
An insecure direct object reference (CWE-639) in the Pricing Table WordPress plugin before 4.1.3 lets users with the contributor role or higher duplicate legacy pricing tables without any authorization check, thereby cloning and publishing arbitrary posts and pages on the site - including private and draft content owned by other users. Publicly available exploit code exists, and exploitation requires only a legitimate low-privilege account plus use of the plugin's legacy duplication feature; impact is confined to content cloning/publication rather than full site takeover, which keeps this at moderate severity.
Improper authorization in dhikshitha29 Insurance Management System lets remote, unauthenticated attackers create a new administrator account by manipulating the submit, Admin_id, and password parameters sent to /Admin/includes/Admin-Register-inc.php. The project uses a rolling-release model, so no fixed or affected version can be scoped; publicly available exploit code exists and the vendor has not responded to the report. With a CVSS score of 5.5 (medium), impact is limited to partial confidentiality, integrity, and availability rather than full system compromise.
HTML injection in the HappyForms WordPress plugin (versions before 1.26.15) allows unauthenticated attackers to place arbitrary HTML into the notification emails that site administrators receive, because a user-controlled referral value is embedded without sanitisation or escaping. The injected markup only renders when an administrator actually opens the notification email, so exploitation requires user interaction and yields limited integrity impact on the email content rather than server-side compromise. Publicly available exploit code exists per the WPScan disclosure; there is no CISA KEV indication of active exploitation, and the severity is moderate.