Cleartext transmission of the sensitive ecos_pw value in the Tenda F6 router (firmware 12.02.01.73) web management interface exposes that value to anyone positioned on the network path between the management client and the device. The flaw is rated low severity (CVSS 4.0 score 2.9; assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) because confidentiality impact is limited and exploitation requires the attacker to already be able to observe the traffic, which the vendor describes as difficult. Only a public PoC reference exists; it is not verified as working exploit code, and no confirmed active exploitation or fixed firmware version is documented in the available sources.
Cross-site scripting in the Admin Routing Page of gedelumbung HospitalManagement lets an attacker who controls the 'content' argument processed by the simpan function in application/modules/admin/controllers/routing_pages.php have script run in a user's browser when the affected page renders that content. The project uses a rolling release model, so no version range is published; builds up to and including commit c2d45543789a3887067d3915f69d44cfc2cf76a8 are reported affected. Impact is confined to low integrity with no confidentiality or availability effect, a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry indicates active exploitation.
Open redirect in gedelumbung HospitalManagement affects the admin routing_pages.php 'simpan' function, where an attacker-supplied url_route value is not adequately validated before being used for a redirect. Remote attackers can craft a link that, when a victim follows it (UI:P), sends the browser to an attacker-chosen destination; no authentication is required (PR:N), but confidentiality and availability impact are none and integrity impact is low. A public PoC reference exists (GitHub issue #17) but is not verified as working exploit code; no CISA KEV entry is available and the project has not responded to the report, with the product on a rolling release and no version-specific fix identified.
Cross-site request forgery (CWE-352) in the Tenda F6 web management interface (firmware 12.02.01.73) lets an attacker who controls a web page cause a logged-in administrator's browser to submit forged, session-authenticated requests against the router. The attacker needs no credentials (PR:N) but gains nothing without an active admin session to ride, and the victim must be induced to visit the malicious page (UI:P), so impact is bounded to limited integrity per the assessed vector (VI:L, no confidentiality or availability effect). A public PoC reference exists on GitHub (0xWKZER/tenda-f6-vulnerabilities); it is not verified as working exploit code, the issue is not in CISA KEV, and the vuln.today priority label places it in the this_month remediation window rather than an emergency.
Stored cross-site scripting in gedelumbung HospitalManagement lets an authenticated administrator inject script through the Title argument handled by sistem.php::simpan in the admin Settings Handler, and that payload then executes for users who view the page rendering the stored value. Scoring is 4.8 with the assessed vector requiring high privileges and user interaction, so real-world exposure is narrow - the realistic actor is an already-privileged operator or someone who has first taken over an admin session. A public PoC reference exists (the project's issue #15); it is not verified as working exploit code, no active exploitation is confirmed, and the vuln.today priority is this_month.
Path traversal in UbiquitousLearning mllm through 2.0.2 allows local users with low-level privileges to manipulate the shard_file argument passed to load_model in the Convertor component, potentially reaching files outside the intended model-shard path; assessed impact is low for confidentiality, integrity and availability. The attack requires local access rather than network exposure, and a public PoC reference exists but is not verified as working exploit code. No CISA KEV listing or confirmed active exploitation is associated with this CVE.
An out-of-bounds read in Kakao khaiii's neural-network loader (khaiii::nn::Linear::open in src/main/cpp/khaiii/nn/Linear.cpp) is reachable through the JSON Config File Handler when a crafted configuration supplies manipulated hidden_dim or class_num values. Only local, already-privileged attackers can reach it: exploitation presupposes write access to the resource directory passed via --rsc-dir, which the vendor treats as trusted input equivalent to a binary or shared library, and the vendor notes such an attacker could already alter analysis results without this flaw. All affected releases (0.1 through 0.4) are end-of-life and unsupported by the maintainer; a public PoC reference exists, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
Subsite administrators in WordPress Multisite deployments running Essential Addons for Elementor before 6.8.7 can alter the login-approval and login state of user accounts belonging to other sites on the network because the plugin checks only a site-level capability rather than verifying authority over the targeted account. The issue requires the login-approval feature to be in use and administrator access on at least one subsite; single-site WordPress installations are not affected. It is assessed as a low-priority authorization flaw, with no public exploit identified at time of analysis.
Sites running the Popup Builder WordPress plugin before version 4.4.6 expose a maintenance routine that trashes popup content and is reachable through unauthenticated requests, with no authorization check guarding it (CWE-862). Remote attackers can therefore move affected popups into the Trash and overwrite their stored preview data, an integrity-only impact with no confidentiality or availability loss and no code execution. Exploitation is rated high complexity because the trash routine's trigger conditions are not fully under the attacker's control, no public exploit has been identified at time of analysis, and CISA SSVC records no known exploitation with automatable set to no, so the current decision signal is to monitor rather than act urgently.
Out-of-bounds write in the Zephyr ADXL345 RTIO streaming path (drivers/sensor/adi/adxl345/adxl345_stream.c) affects builds from 4.0.0 through 4.4.2 that enable CONFIG_ADXL345_STREAM on a board with an interrupt-wired ADXL345. The completion callback clamps the reported read length to the buffer actually granted by rtio_sqe_rx_buf(), but then queues one 6-byte bus read per hardware FIFO entry at consecutive offsets bounded by the device-reported entry count, so a truncated allocation causes up to 186 bytes written past the end of the block-pool buffer; a companion defect that failed to reset fifo_total_bytes at batch start can carry a stale offset into the next batch. Exposure is strictly local with high attack complexity and low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L, score 3.6); the written data is accelerometer sample content at the allocation tail, so the realistic outcome is corruption of neighbouring RTIO consumers' buffers or a crash rather than a controllable primitive. No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and vendor fixes are merged on main and both release branches with a projected fixed release of 4.5.0.
Stored cross-site scripting in the Speed Optimizer WordPress plugin before 7.8.5 lets a high-privilege user, such as an administrator, inject script into plugin settings that is then written unescaped into the <head> of front-end pages. The flaw matters mainly in deployments where the unfiltered_html capability is stripped - classically a multisite network - so that a site admin who could not otherwise embed scripts can still persist one; a victim must load an affected front-end page for the payload to fire. Severity is low (CVSS 3.5, PR:H/UI:R): there is no unauthenticated path, no public exploit identified at time of analysis, no CISA KEV listing, and CISA SSVC records exploitation as none with partial technical impact, so this is a monitor-level item rather than an emergency.
Stored HTML injection in the Essential Addons for Elementor WordPress plugin (versions before 6.8.7) allows authenticated users with the author role or higher to place iframe and form elements into published pages, because some widgets pass their HTML tag setting into markup without validating it. Impact is limited: the injection is confined to iframe and form elements rather than arbitrary script execution, no public exploit code was identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and technical impact as partial, giving a priority decision of monitor. The CVSS base score is 3.5, reflecting low confidentiality and integrity impact with no availability effect.
Denial of service in Python filelock 3.20.4 through 4.2.0 on Windows: ReadWriteLock and AsyncReadWriteLock hand the lock database path straight to sqlite3.connect, so SQLite acts on the `<database>-wal`, `<database>-journal` and `<database>-shm` side files that any local account able to create files in the database's directory can plant beside it. An undeletable, planted `-wal` makes every read_lock() and write_lock() fail at once with sqlite3.OperationalError: disk I/O error regardless of the timeout value, because that error is not converted into Timeout, and it persists until the planting account removes the file - a condition that applies in C:\Windows\Temp and C:\Users\Public, where users may create files but not delete other accounts'. The scored impact is availability only (CVSS 3.1 3.3, AV:L/AC:L/PR:L, C:N/I:N/A:L); a harder secondary variant can make SQLite treat a planted journal as hot, replay it and delete a file of the other account's choosing (assessed AC:H/I:L, 3.6), and while the GitHub advisory ships a maintainer reproducer that was run on a Windows 11 VM, no exploitation in the wild has been reported and the vuln.today decision label is monitor.
Fallow 2.68.0 through 3.33.1, when run on an untrusted repository, can be induced to read Jest `projects` entries (and, from 3.33.1, Vitest `test.projects` entries, Vitest inline-project `extends` paths, and symlinked script `--config` paths) that resolve outside the project root via absolute paths, `..` segments, dot-prefixed wildcard globs, or in-root symlinks to parent directories. The outside files are parsed as test-runner configuration only to credit dependencies, setup files, and JSX import sources, so the attacker's payoff is altered unused-dependency and unused-file findings rather than disclosure of file contents - nothing is printed or sent over the network. Exploitation requires a user, CI job, or agent to execute Fallow against the hostile repository (AV:L, UI:R, unauthenticated per the CVSS vector), and no public exploit code was identified at time of analysis; priority signals are consistent with low, non-urgent risk and monitoring.
DNS response spoofing in Twisted's twisted.names client and resolver (all versions through 26.4.0) arises because twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS answer solely on a matching 16-bit transaction ID and never verifies that the datagram originated from the server the query was sent to. Attackers who can deliver a UDP packet to the resolver's listening port with the right transaction ID can inject a forged answer and redirect hostname resolution, enabling mail interception via spoofed MX/A records, server-side request forgery, or man-in-the-middle positioning; on-path attackers or those sharing a broadcast domain/NAT with the resolver or the real DNS server face essentially no barrier, while the standard client.Resolver's per-query random source-port rotation raises off-path effort to roughly 32 bits of combined entropy within the query timeout. Applications that directly construct and reuse one DNSDatagramProtocol instance across multiple queries are limited to the 16-bit transaction-ID space after the first query, which is the weakest case; the advisory includes a public PoC reference (not verified as working exploit code), there is no KEV listing or active-exploitation signal, and the assessed severity is low (CVSS 3.1, AV:A/AC:H) with a monitor priority.
The LiteSpeed Cache plugin for WordPress before 7.9.2 allows an authenticated Subscriber-level user to dismiss administrative notices that the plugin explicitly marks as non-dismissible, including a warning that sensitive files may be publicly accessible. The dismissal handler lacks a capability check and relies on a nonce that is not tied to the specific notice, so the weakness only materialises on sites in certain configurations - most notably those where low-privileged accounts such as Subscribers exist or can self-register. Impact is limited to suppressing the display of a warning; the flaw does not by itself expose files, grant data access, or allow code execution, and severity is low (CVSS 3.1, AC:H, I:L). No public exploit code has been identified at time of analysis, CISA SSVC records no exploitation, and the priority decision is monitor.
On Windows, the Python filelock library (3.22.0 through 4.2.0) reads, renames and deletes soft-lock marker files by path, so a second local account that holds an unanswered Level 1 oplock on a marker makes every `acquire()` wait inside the underlying file open; `timeout`, `blocking=False` and `cancel_check` are only consulted after that wait returns, and a `timeout=1` call was recorded returning `Timeout` after 10.02 s. A stale marker under the same oplock is never broken, so no process acquires the lock until the oplock holder answers or closes its handle; availability is the only impact, mutual exclusion is never broken and no other file is touched. Exploitation is narrow: it requires a Windows host, a second logged-on account granted read access to newly created files by the lock directory's inheritable ACL, and a marker with no open handle at the moment the oplock is requested, a state the attacker cannot force. CVSS 3.1 scores 2.5 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L); no CISA KEV entry or active exploitation is reported, and the advisory ships reproduction scripts rather than verified exploit code. Fixed in 4.2.1.
Cross-site scripting in serialize-javascript 7.0.1 before 7.1.3 occurs when a serialized function's attacker-influenced source text ends in a bare `</script`, letting surrounding output and a later serialized value complete the tag and inject live markup such as an `img onerror` handler. The flaw only affects applications that serialize attacker-controlled function values via a spoofed `toString()` and embed the result inside an HTML `<script>` element; ordinary functions and non-function values are escaped correctly. The vendor fixed this in 7.1.3, no KEV listing or confirmed active exploitation is reported, the advisory's demonstration payload is not verified as working exploit code, and the decision label is monitor.
SSRF in Signal K Server's App Store icon fetcher allows anyone who can publish an npm package carrying Signal K keywords to make every server that browses the App Store issue HTTP requests to loopback addresses, hosts on the vessel network, and cloud metadata endpoints. Affected builds are 2.28.0-beta.2 through 2.33.0; because only responses with an image/* content type are stored and returned to the admin UI, retrievable data is limited to content that can pass as an image. The issue is vendor-confirmed and fixed in 2.34.0 (CVSS 4.0 score 2.3; independent CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), carries a monitor decision label, is not in CISA KEV, and while the advisory includes a reproduction, no verified working exploit code is confirmed.
Protocol-relative URL injection in i18next-http-backend before 4.0.3 lets an attacker who controls an i18next namespace value redirect translation fetches to an attacker-chosen origin when the loadPath/addPath template places {{ns}} directly after a leading slash. The per-value validation added for the earlier GHSA-xvq9-wjp8-hwqf fix rejects '//evil.example' but still permits a single leading '/', which the template's own '/' turns into '//evil.example/en.json' - a URL browsers resolve off-origin, yielding translation content injection and, where translations are rendered as HTML, cross-site scripting. Exploitation requires the non-default template, attacker-controlled namespace input (applications usually set namespaces in code), and a browser context; Node is not affected, the default '/locales/{{lng}}/{{ns}}.json' template is not affected, and the issue is not known to be exploited in the wild. A minimal proof-of-concept is published in the advisory and was re-verified against 4.0.2, and the release 4.0.3 contains the fix.
An authorization bypass in Chatwoot before 4.17.0 lets an authenticated agent bot use a foreign account's contact-inbox source_id against the conversations create endpoint to create or retrieve conversations and post messages to another account's contacts. Exploitation requires a valid agent bot API access token plus prior knowledge of a valid source_id belonging to a different account, so impact is bounded to cross-account conversation and message manipulation on multi-tenant or shared instances, with no availability impact. The vendor has released a fix in Chatwoot 4.17.0; no public exploit code, CISA KEV entry, or confirmed active exploitation was identified at time of analysis, and the aggregated priority decision is monitor.
Cross-site scripting in serialize-javascript before 7.1.3 lets an attacker who controls the source text of a serialized function (in practice via a spoofed toString()) break out of an HTML <script> element and introduce live markup, but only in a narrow configuration: the function body must end exactly at a bare '</script' with no trailing delimiter character, the surrounding serialized output must then supply the delimiter (for example the newline emitted by the 'space' pretty-print option), and a later serialized value must supply the closing '>' plus injected markup. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, a scope-changing low-impact injection that requires a victim to load the affected page; ordinary functions (which end in '}') and non-function values, including strings containing '</script', are escaped correctly and are not affected. There is no CISA KEV entry and no confirmed active exploitation; a public reproducer is documented in the upstream advisory, and the vendor-released fix is version 7.1.3.
Cross-site scripting in the PHP-based HospitalManagement project (gedelumbung) lets remote, unauthenticated attackers inject script through the contact form fields nama, email, alamat, telepon and pesan, which the kirim function in application/modules/web/controllers/contact.php renders without adequate output encoding. The payload only fires when a victim - realistically an operator or administrator reviewing submitted contact entries - later views the affected page (CVSS 4.0 UI:P; our assessed 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so impact is confined to the low-integrity script execution in that browser context rather than server compromise. Severity is low (CVSS 4.0 base 2.1, rated E:P) and the priority label is monitor; there is no CISA KEV entry, but the vendor report states the exploit has been publicly disclosed and exploit maturity is scored Proof-of-Concept, so a public PoC reference exists that has not been independently verified as working exploit code.
File overwrite in VLC for Android before 3.7.2 lets a co-installed app with no permissions send a crafted VIEW intent to the exported StartActivity and have VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory. The flaw is local-only and requires the attacker app to spoof the com.fsck.k9.attachmentprovider or gmail-ls authority; overwriting other apps' files additionally depends on VLC holding All files access, which is non-default. Impact is limited to integrity, no public exploit was identified at time of analysis, and the vendor fixed it in 3.7.2.
Crash of Qt-based client applications can be triggered by a malicious or compromised HTTP/2 server through a use-after-free flaw in the HTTP/2 client support of the Qt Network module's QNetworkAccessManager. Only applications that actually open an outbound HTTP/2 session to an attacker-controlled or compromised endpoint are exposed - the hostile server delivers the triggering traffic, and the client must initiate that connection - while authentication is not bypassed and no code execution, data disclosure, or integrity impact is described. All signals converge on LOW real-world priority: the vendor rates it CVSS 4.0 at 2.1, the independent assessment scores it CVSS 3.1 at 3.1 (AV:N/AC:H/PR:N/UI:R/A:L), no public exploit code is identified at time of analysis, there is no CISA KEV listing, and the priority decision is monitor.