GeoDirectory WordPress plugin before 2.8.194 fails to verify ownership of listings submitted by logged-out visitors, so unauthenticated attackers can edit, unpublish, attach images to, or reassign any guest-submitted listing. The flaw only matters when guest posting is enabled and guest listings already exist, and impact is limited to integrity changes on those listings - no data disclosure or availability loss - giving it a low vendor-aligned CVSS of 3.7 (AC:H, PR:N, UI:N). A public reference to the issue exists via WPScan but is not verified as working exploit code, EPSS is 0.19% (8th percentile), there is no KEV entry, and the tracking decision is monitor; a vendor patch is available.
InternScience InternAgent 1.5.0 contains an untrusted-control-sphere inclusion flaw (CWE-829) in the LoRA loading logic reached through the 'train' function in tasks/AutoChem/code/experiment.py, where an attacker-influenced base_model_name_or_path value causes functionality to be pulled from outside the intended trust boundary. The assessed impact is limited to integrity (CVSS 3.1: 5.3, AV:N/AC:L/PR:N/UI:R, I:L only, no confidentiality or availability impact), and exploitation is not passive - a legitimate operator must run the training routine with the malicious path value. A public PoC reference exists; it is not verified as working exploit code, and there is no KEV confirmation of active exploitation; this is a moderate-severity issue slated for this month's remediation cycle rather than an emergency.
Reflected cross-site scripting in phpIPAM through 1.8.3 can execute attacker-supplied script in a victim operator's browser when the deviceid argument in the Rack Link Creation popup (app/tools/racks/show-rack-popup.php) is manipulated and a crafted link is loaded. The vector records PR:N, but rack management is an authenticated operator feature and pre-authentication reachability of this endpoint is not confirmed, so that prerequisite should be verified for each deployment; impact is confined to the victim's browser session. A public PoC reference exists but is not verified as working exploit code, no CISA KEV entry is present, and the priority decision is monitor.
phpIPAM through 1.8.3 contains a reflected cross-site scripting flaw in upgrade/index.php where the REQUEST_URI value is reflected without sanitization. Exploitation requires a high-privilege authenticated administrator to be lured into following a crafted request, and impact is limited to low integrity with no confidentiality or availability effect; a public PoC reference exists but is not verified as working exploit code, and the issue is rated low priority (monitor).
Authorization bypass in Scada-LTS 2.8.0 lets a low-privileged authenticated user read data outside their assigned scope by tampering with the 'ids' parameter handled by HttpServletRequest.getParameter in AmChartValuesAPI.java (the AmCharts Data API). Only confidentiality is affected and only at a low level, with no integrity or availability impact and no victim interaction required; the attacker must already hold a valid account on the web application and be able to reach the API endpoint. The vendor acknowledges the issue and states a security-hardened release is in preparation, while a published exploit is referenced and the CVSS 4.0 vector carries E:P; CISA KEV does not list this CVE and the priority label is monitor, so no confirmed active exploitation is established.
Integer truncation in Ghidra's decompiler packed-stream parser (PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc) causes the parser cursor to under-skip string attributes when a crafted length such as 0x100000000 is supplied, so the cursor remains inside attacker-controlled string data that is then decoded as legitimate protocol elements. Any Ghidra release before 12.2 is affected; an analyst must open or import a malicious packed stream such as a crafted .sla file, after which the decompiler process can be made to misinterpret data, inject attributes into its input stream, or crash. Impact is bounded to the decompiler process with no confidentiality effect and only limited integrity/availability impact; no public exploit was identified at time of analysis and the issue is not in CISA KEV, so this is a low-priority, patch-when-convenient fix rather than an emergency.