Insecure temporary-file handling in Mix's partitioned dependency compilation lets a local user on a shared host execute arbitrary shell commands as another user's build account. Elixir releases 1.20.0-rc.4 through 1.20.4 write the serialized project configuration into a fixed-name directory under the system temp dir (created with File.mkdir_p/1, which accepts a pre-existing directory regardless of owner) and each partition VM trusts the file it reads back, so an attacker who owns that directory can swap in a payload whose dependency compile: commands Mix then runs as the victim. Exploitation requires partitioned compilation explicitly enabled via MIX_OS_DEPS_COMPILE_PARTITION_COUNT greater than 1, a build compiling at least two non-local dependencies, a shared temp directory (Linux default when TMPDIR is unset; macOS and Windows use per-user temp dirs by default and are not affected), and a local low-privileged attacker account (PR:L) that wins a timing race; the vendor advisory documents a step-by-step proof-of-concept, there is no CISA KEV listing, and the vendor has released a fix in mix 1.20.5. Even without pre-creating the directory, the world-readable partition file discloses project configuration, including Mix.install compile-time config, to other local users during the build.
Stored cross-site scripting in the FV Flowplayer Video Player WordPress plugin, affecting versions up to and including 7.5.55.7212, lets unauthenticated commenters place malicious HTML inside the 'ad', 'popup', or 'end_action_value' attributes of an [fvplayer] or [flowplayer] shortcode, which the plugin later decodes and renders as raw markup. Execution requires the non-default 'Parse Vimeo and YouTube links' option to be enabled, a site administrator to approve the crafted comment, and a visitor to interact with the player on the affected page; the assessed CVSS is 5.4 with AC:H and UI:R. No public exploit was identified at time of analysis, with no CISA KEV entry or confirmed working PoC in the supplied data.
Stored cross-site scripting in the FV Flowplayer Video Player plugin for WordPress (all versions up to and including 7.5.55.7212) lets unauthenticated attackers submit comments whose shortcode 'align' attribute value is neither sanitized on input nor escaped on output, so script executes in the browsers of visitors who later view the affected page. The flaw is only reachable when an administrator has enabled the plugin's 'Parse Vimeo and YouTube links' (parse_comments) setting, which registers do_shortcode on the comment_text filter; that condition is not the default, which is why the CVSS 3.1 score of 5.4 (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) carries a high attack-complexity metric despite unauthenticated access. Impact is confined to client-side script execution in visitors' browsers with no availability impact, no public exploit has been identified at time of analysis, and priority is assessed as this month rather than immediate.
Cross-site request forgery in the APIExperts Square for WooCommerce (woosquare) WordPress plugin, in all versions through 4.7.5, lets an attacker who lures a logged-in, sufficiently privileged user into interacting with crafted content cause unintended requests to be issued with that user's session. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L, score 5.4) confirms no attacker account is needed but a victim must perform the interaction, and impact is limited to partial integrity and availability with no confidentiality loss. Reported by Patchstack and labelled this_month, with no public exploit code and no confirmed active exploitation (no CISA KEV entry) identified at time of analysis.
Missing authorization (CWE-862) in the WordPress plugin The Events Calendar, affecting versions through 6.18.2, lets an authenticated low-privilege user perform actions that should be reserved for higher-privileged roles, with low confidentiality and low integrity impact and no availability effect. Exploitation requires a valid WordPress account at subscriber level or above (CVSS PR:L, AV:N, UI:N), so sites that allow open or self-service registration present the widest exposure while closed-registration sites require an attacker to already hold credentials. There is no confirmation of active exploitation (not in CISA KEV) and no verified public exploit code; the decision label for this entry is 'this month' rather than immediate action.
Missing authorization (CWE-862) in the WordPress plugin Fluent CRM through version 3.2.6 lets a low-privilege authenticated user reach functionality or data they should not be permitted to access, with limited confidentiality and integrity impact (CVSS 5.4). Exploitation requires a valid account on the target WordPress site (PR:L) and no user interaction (UI:N), so fully unauthenticated visitors cannot trigger it. No public exploit code and no confirmed active exploitation are indicated in the available sources; the specific endpoint or role boundary crossed is not described in the available sources. This is a moderate, authentication-gated access-control flaw rather than a top-tier emergency, prioritized as this_month.
Missing authorization in the Webba Booking WordPress plugin (webba-booking-lite) through version 6.5.4 lets a logged-in low-privilege user, such as a subscriber, reach a function that omits a proper capability check. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) scores this at 5.4, reflecting low confidentiality and integrity impact with no availability effect, and no user interaction is required. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor reference points to the Patchstack advisory for the 6.5.4 broken access control issue.
Dell OpenManage Enterprise versions prior to 4.8.0 leave a critical function without an authentication check, letting an unauthenticated attacker with adjacent-network access trigger server-side request forgery; CVSS 3.1 scores this 5.4 with low integrity and availability impact and no confidentiality impact. Dell's advisory identifies 4.8.0 as the fixed release, and this is a moderate-severity, context-limited issue rather than an urgent emergency because the assessed vector requires AV:A adjacency. No public exploit identified at time of analysis.
Dell OpenManage Enterprise releases before 4.8.0 fail to sufficiently restrict excessive authentication attempts (CWE-307), allowing an unauthenticated attacker on the adjacent network to trigger authentication-related behavior that the description links to phishing attacks; the assigned CVSS is 5.4 with low confidentiality and integrity impact. The vendor has released 4.8.0 as the fix, and the supplied intelligence gives this a this_month priority rather than an emergency designation. No CISA KEV confirmation is present and no public exploit identified at time of analysis.
phpMyAdmin through 5.2.3 lets an authenticated user disable two-factor authentication on an account by POSTing key=2fa with a null JSON value to the /config/set route handled by SetConfigController, which applies the change without requiring the session to re-authenticate; an attacker holding a valid or hijacked session can therefore strip 2FA and leave only the MySQL password guarding subsequent logins. Severity is medium (vendor score 5.3; independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the technique only yields anything against accounts that actually have 2FA enabled, and the practical limiting factor is obtaining the session in the first place. A public research writeup of the flaw exists but is not verified as working exploit code, there is no CISA KEV entry, and the vendor fix is delivered as two Git commits plus pull request 19087 rather than a tagged release confirmed in the supplied data.
Cross-site scripting in phoenix_html (from 1.0.0 before 3.3.5, and from 4.0.0 before 4.4.0) allows attackers who control HTML attribute names to break out of an attribute and inject new attributes or script into rendered markup. Only attribute keys are mishandled - attribute values are escaped correctly - so applications are exposed solely when they derive attribute names from untrusted input and render them through HEEx <tag {@attrs}>, content_tag/3, or a direct Phoenix.HTML.attributes_escape/1 call (before 3.0.0 the same code lived in Phoenix.HTML.Tag). No public exploit identified at time of analysis; the victim must load the rendered page, and vendor fixes are available in 3.3.5 and 4.4.0.
Cross-organization IDOR in Coop before 1.0.2 lets an authenticated user who holds MRT queue-edit permission grant or revoke another organization's users' access to that organization's manual review queues by supplying arbitrary queueId and userId values. The attacker cannot read the other organization's queues or jobs, so confidentiality is not affected; integrity and availability impact is limited to queue-access assignments. The vendor addressed this in 1.0.2, and no public exploit was identified at time of analysis.
Picsou's `/api/auth/login` endpoint returns measurably different response times for valid versus invalid usernames, letting an unauthenticated remote attacker enumerate account names by timing requests. The discrepancy arises because unknown usernames short-circuit to a `BadCredentialsException` before the bcrypt comparison, while existing usernames pay the full bcrypt cost - the reporter measured a stable ~20× gap (roughly 300-450 ms versus 15-25 ms) despite both paths returning identical generic HTTP 401 responses. A working public PoC script exists and was confirmed against a local instance; the vendor shipped a fix in release 1.0.8 that performs a dummy bcrypt comparison on the unknown-user path. Practical exposure is limited by built-in login rate limiting, the tiny user population of a self-hosted personal finance dashboard, and the fact that many deployments are only reachable from the local network.
Improper authorization in the Drupal 7 Field Collection module (7.x-1.0 through 7.x-1.2) allows an authenticated user who holds the non-default 'edit field collections' permission to edit or delete field collection items attached to a host entity - such as a node - that the user is not permitted to edit. The field_collection_item_access() callback grants edit and delete rights on the strength of the collection permission alone, so the host entity's access restrictions are silently skipped, yielding limited confidentiality and integrity impact (CVSS 5.3, independently assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). No public exploit code and no CISA KEV listing appear in the provided intelligence, and the priority is rated this_month rather than an emergency.
Memory exhaustion in Bitcoin Core's peer-to-peer send path (the fPauseSend OOM condition) allows a remote peer to drive a node into out-of-memory conditions, degrading or halting availability of the affected node. Nodes running versions prior to 29.5, 30.4, 31.2 and 32.1 are affected, per the vendor disclosure dated 2026-10-28. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms remote, unauthenticated reachability with only availability impact; EPSS is low at 0.16% (5th percentile) and there is no KEV entry, so this is a medium-severity denial-of-service issue rather than an emergency, triaged as 'this_month' remediation priority. No public exploit code was identified at time of analysis.
Unauthenticated information disclosure in the BuddyForms WordPress plugin before 2.10.3 lets remote attackers export any form's stored configuration without an authorization check, exposing notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form. The flaw is remotely reachable with no authentication or user interaction (CVSS 5.3, confidentiality-only impact) and is rated automatable under SSVC, but exploitation is assessed as none, no public exploit was identified at time of analysis, and EPSS is low at 0.15% (4th percentile). Sites running BuddyForms 2.10.3 or later are unaffected.
Ghost's ActivityPub service (self-hosted activitypub image, v1.0.0 through v1.2.5) fails to verify that an incoming Undo activity's actor matches the actor of the original Follow or Announce, letting a remote federated server unfollow or strip a repost belonging to another account without that account's involvement. The impact is integrity-only and re-establishable: no private data is exposed and no content is modified, which matches the assessed CVSS 5.3 vector (network, no privileges or interaction, integrity low only). Only self-hosters running their own activitypub deployment with federation enabled are exposed, since Ghost Pro hosted instances at ap.ghost.org were already updated; fixes are released in v1.2.6 and there is no public exploit identified at time of analysis.
Missing authorization in the Drupal DKAN open-data module allows remote unauthenticated attackers to browse directly to resources that lack an access check, resulting in limited information disclosure. DKAN releases before 4.0.4 and 4.1.x releases before 4.1.5 are affected, with a medium CVSS score of 5.3 and only confidentiality impact. The vendor has released fixes in 4.0.4 and 4.1.5; EPSS is 0.14% (4th percentile) and no public exploit code was identified at time of analysis.
Authorization bypass in the BuddyForms WordPress plugin before 2.10.1 allows an authenticated user who has merely been granted edit access to a form - a role as low as Subscriber - to overwrite the title, content and status of any other user's posts or pages, including those belonging to administrators, by referencing the target post ID. The flaw is a missing-authorization issue (CWE-862) rated medium severity (CVSS 5.3) and is not confirmed as actively exploited (not in CISA KEV) and no public exploit was identified at time of analysis; EPSS is low at 0.13% (3rd percentile) and SSVC marks exploitation as none and non-automatable. A vendor patch is available in 2.10.1, so real-world exposure is concentrated on sites that deliberately extend front-end editing rights to low-privilege roles.
Cross-site request forgery in the Drupal Advanced Filesystem contrib module (versions 0.0.0 through 1.0.28) allows an attacker to induce a logged-in Drupal user into submitting a forged request that performs an Advanced Filesystem action with that user's privileges, yielding a limited integrity impact. The official CVSS 3.1 base score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), but the assessed vector corrects the user-interaction metric to UI:R, because a victim holding an authenticated session and sufficient permissions must be tricked into loading attacker-controlled content (a web page, ad, or email) for the forged request to fire; no attacker credentials are required, but the attack cannot succeed without that active session and victim interaction. This is a moderate-severity, low-priority issue in practice: EPSS is 0.10% (1st percentile), SSVC records Exploitation: none with Automatable: yes and Technical Impact: partial, and no public exploit has been identified at time of analysis.
Local file disclosure in Stirling-PDF 2.13.1: the SVG-to-PDF converter (POST /api/v1/convert/svg/pdf) renders attacker-supplied SVG through Apache Batik with a hard-coded file:///input.svg document base, so an image reference written as a scheme-less root-relative path (for example /C:/Users/.../secret.svg) defeats both the SVG sanitizer's external-URL check and Batik's same-origin resource policy, and any server file Batik can decode as an image is embedded into the PDF returned to the caller. The flaw works in the default configuration (disableSanitize=false) and requires no admin role; it is fully unauthenticated on login-disabled deployments, while with login enabled any authenticated non-admin user can trigger it because the controller carries no role check. Impact is bounded: only PNG/JPG/GIF/SVG paths can be read, text/binary files, directories, XInclude text and external entities do not leak, and the existence oracle distinguishes only decodable images - reflected in the CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/C:L). The issue is fixed in 2.13.2; a public proof-of-concept is published in the GHSA advisory and was reproduced end-to-end against a source build, and no confirmed active exploitation is reported.
An unauthenticated authorization bypass in the WordPress plugin YITH WooCommerce Product Add-Ons through version 4.34.0 can let remote attackers use a user-controlled key to bypass an access-control decision, with limited integrity impact and no confidentiality or availability impact (CVSS 5.3). The supplied intelligence shows no public exploit identified at time of analysis and no CISA KEV confirmation, and the vuln.today priority is this_month rather than an emergency.
Missing authorization in FluentCRM through 3.2.6 lets remote, unauthenticated attackers make limited unauthorized modifications on affected WordPress sites; confidentiality and availability are not impacted. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and the exact endpoint or action lacking the access-control check is not described in the available sources. No public exploit identified at time of analysis and no CISA KEV entry is provided.
Content injection in the GIFTiT - Free Gifts for WooCommerce WordPress plugin, in all versions through 4.5, allows attacker-supplied script-related HTML to reach a rendered page without neutralization (CWE-80). The assessed impact is bounded - low confidentiality and low integrity with a scope change - meaning limited data exposure or tampering within the affected site rather than code execution on the server; the vendor-reported CVSS 3.1 base score is 5.3. No CISA KEV entry or public exploit code is associated with this CVE, and the privilege and interaction prerequisites are not fully settled: the assessed vector lists PR:L (authenticated) while the originally supplied vector lists PR:N with UI:N, so the practical prerequisites should be confirmed against the Patchstack advisory before relying on either.
The WordPress plugin Divi Contact Form 7 (slug cf7-styler-for-divi) through version 4.1.0 fails to neutralize script-related HTML tags in the output it renders, allowing content/script injection (CWE-80, basic XSS) with a CVSS 3.1 base score of 5.3. Only sites that run this styler plugin alongside the Divi theme and Contact Form 7 are exposed, and a successful attack requires injected markup to be rendered in a victim's browser. The vendor score asserts a network-reachable, unauthenticated attack with no user interaction (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), while the assessed vector instead requires authenticated access and victim interaction with changed scope (PR:L/UI:R/S:C), so the true privilege and interaction preconditions are not confirmed by the available sources. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is prioritized for remediation within the current monthly cycle rather than as an emergency.
Missing authorization in the Arraytics Booktics WordPress plugin (all versions through 1.0.31) lets unauthenticated remote attackers invoke a plugin action that should be gated behind an access-control check, with integrity-only impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) indicates no credentials or user interaction are required, but the flaw permits only limited modification of data - no disclosure of information and no loss of availability. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the assessed priority is 'this_month', and the practical exposure is bounded by the plugin's relatively narrow deployment footprint.
Stored cross-site scripting in Axigen Mail Server WebMail (versions before 10.6.39 and before 10.7.1) lets an unauthenticated remote attacker embed HTML and script in the From display name of an email; the payload executes when the victim opens the affected folder/conversation view. Successful exploitation is confined to the victim's authenticated webmail session, enabling mailbox content theft or redirection rather than server compromise. CVSS 4.0 base is 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P), reflecting that victim interaction is required; no confirmed active exploitation (CISA KEV) and no verified working exploit code were identified at time of analysis, and the maintainer-advisory references indicate the flaw is fixed in 10.6.39 and 10.7.1.
Frappe Learning Management System (LMS) prior to 2.54.2 lets authenticated low-privileged users retrieve and view certificate records that were never published, exposing certificate details belonging to other users instead of restricting them to the certificate owner and authorized staff. The flaw is a missing-authorization problem (CWE-862) in the LMS Certificate permission handling, scored 5.3 with a confidentiality-only impact - no data modification or privilege gain is possible, and lookups of published certificates (the mechanism third parties use for verification) continue to work as intended. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, which carries a this_month priority label.
Missing server-side authorization on quiz submission records in Frappe Learning Management System (LMS) lets an authenticated student write quiz results directly through the Frappe REST API, recording a passing or perfect score without their answers being verified and thereby unlocking course completion and certificates. The same gap allows a student to create a submission attributed to another user, consuming that user's allowed attempts and blocking their legitimate submissions. The vendor fixed the issue in version 2.54.0 and states there are no workarounds; no public exploit code has been identified at time of analysis, and the impact is confined to quiz-result integrity and availability - no other users' data is exposed and no elevated roles are granted.
Authenticated users of Frappe LMS can complete a paid course or certificate purchase for an arbitrary amount in versions prior to 2.52.1, because the checkout flow accepts client-supplied pricing instead of recomputing the price on the server. The impact is confined to business-logic and financial integrity - no other users' data is exposed and no elevated privileges are granted - and it only matters on sites that actually sell paid courses or certificates through the payment flow. Version 2.52.1 fixes the issue by deriving all pricing server-side via get_order_summary; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Best Practical Solutions' Request Tracker lets an attacker plant script inside a ticket, which then executes in the session of any RT user who opens that ticket's history. The flaw is in RT's automatic URL-to-link conversion for HTML ticket content, which fails to HTML-escape the URL it writes into the link, so a crafted URL breaks out of the address and injects script. Anyone who can add HTML content to a ticket can plant it - including an unauthenticated sender of HTML email to a queue that grants CreateTicket or ReplyToTicket to Everyone, which removes any authentication requirement (the assessed vector carries PR:N); the script then acts with the viewing user's RT authority, not system-level access. Fixed in 5.0.11 and 6.0.4; no public exploit identified at time of analysis, and no CISA KEV listing.
Stored cross-site scripting in RTIR 6.x before 6.0.4 allows an unauthenticated sender of an emailed Incident Report to plant script in a ticket subject that executes in an incident handler's RT session. Because RTIR grants everyone the right to create Incident Reports by default, the attacker controls the subject without any credentials; the payload fires only when an authenticated handler opens the ticket-split form or the create-incident-from-report form, which render that subject without HTML escaping. Impact is therefore limited to the acting handler's RT authority, and the vendor states the issue is fully fixed by upgrading to RTIR 6.0.4, with RTIR 5.0 explicitly unaffected; no public exploit code was identified at time of analysis and the source is not listed as actively exploited (no CISA KEV entry).
Stored cross-site scripting in RTIR (RT for Incident Response) allows an attacker to persist a crafted javascript: link in an RT ticket because RTIR's internal-link placeholder whitelist accepts any link containing the placeholder, and the script executes in a logged-in user's RT session when that user clicks it. Once RTIR is installed the weakened scrubber applies to the whole RT instance, so anyone able to add HTML ticket content, including an unauthenticated sender to the default-open Incident Reports queue, can store the link; the CVSS:4.0 vector has PR:N but UI:P, and the impact is bounded by the clicking user's RT authority. The vendor-released fix is in 5.0.11 and 6.0.4; no public exploit identified at time of analysis.
Clickjacking in NocoDB before 2026.08.0 lets any external origin embed the authenticated web interface in a frame and overlay it with attacker-controlled content, so a signed-in user can be induced into clicking through to actions in their own session - modifying or deleting records, changing sharing settings, or inviting a collaborator. The enabling weakness is that no X-Frame-Options header and no Content-Security-Policy frame-ancestors directive was emitted on any response, including the application shell served by gui.middleware.ts and API responses from global.middleware.ts, so nothing told a browser which origins may frame a signed-in session. Exploitation requires a victim who holds an active NocoDB session to visit an attacker-hosted page (the attacker needs no authentication of their own); the vendor scores it 5.3 under CVSS 4.0, no public exploit code has been identified at time of analysis, and impact is confined to integrity actions the victim's own account could already perform.
Server-side request forgery in PipesHub's document indexing pipeline lets anyone who can place content in front of the indexer make the server issue HTTP GETs to addresses of their choosing. Image URLs embedded in the body of an uploaded Markdown or HTML file, an email delivered to a connector-synced mailbox, or a page pulled in by the web/RSS connector are checked only for scheme and image file extension before ImageParser._fetch_single_url calls aiohttp with allow_redirects=True, so loopback, private-network and cloud instance-metadata targets are reachable despite the blocked-host policy the same codebase applies to other user-supplied fetches. The documented proof-of-concept in the public advisory confirms the service's own aiohttp client fetching a loopback URL that existed only inside an uploaded file; reading the response back into persisted indexed content was inferred from code rather than demonstrated, because the test host had no model provider configured. Exploitation status is not confirmed actively exploited (no CISA KEV listing) and no independently verified exploit tooling has been published, though the advisory's executed walkthrough gives attackers a clear template; the vendor fix is PipesHub 0.10.0, and priority is a this-month remediation cadence rather than a drop-everything emergency.
Jailed users on Bastille through 1.4.4 can plant symlinks inside their own jail so that administrator-run cp.sh, rcp.sh or jcp.sh copies follow those links and read or overwrite host files with root privileges, breaking jail isolation. Exploitation is not remote: it requires an account with write access inside a jail plus a host administrator later running one of the affected subcommands against that jail, which places the flaw at medium severity rather than an emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has published an upstream fix that resolves paths before copying.
Cross-site scripting (CWE-80, basic XSS) in Crocoblock JetFormBuilder through 3.6.7.1 allows a remote attacker to inject script-related HTML into plugin-handled form content, which executes in the browser of a user who views the crafted page. The assessed CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (CVSS 5.3), so victim interaction is required and impact is limited to the browser session; the vendor advisory is a Patchstack entry. No CISA KEV listing or public exploit code is identified in the supplied data; the precise form field or endpoint is not described in the available sources.
Missing authorization in The Events Calendar WordPress plugin through 6.18.2 allows unauthenticated remote attackers to access restricted data, with the assessed impact limited to low confidentiality loss (CVSS 5.3, C:L only). The supplied sources do not identify the exact endpoint or action that lacks the access-control check, no public exploit was identified at time of analysis, and the CVE is not in CISA KEV; Patchstack's priority is this-month rather than emergency action.
Missing authorization in Crocoblock JetFormBuilder through 3.6.7.1 allows remote unauthenticated attackers to perform a limited integrity-impacting action on WordPress sites running the plugin. The issue is CWE-862 broken access control, rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N); confidentiality and availability are not affected. No public exploit was identified at time of analysis, and the specific vulnerable action is not described in the available sources.
Missing authorization (CWE-862) in the Arraytics Timetics WordPress plugin through version 1.0.65 lets unauthenticated remote attackers reach functionality that should be access-controlled and make unauthorized changes to site data, rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Because the CVSS vector carries PR:N and UI:N, no credentials or user interaction are indicated as prerequisites, and only a low integrity impact is assessed - confidentiality and availability are unaffected. No public exploit code is identified at time of analysis and the flaw is not in CISA KEV, so exposure is bounded to sites running the plugin at or below 1.0.65.
Missing authorization in WHartTest 2.2.0 through 2.8.1 allows any authenticated user to reach scheduled tasks and execution logs belonging to other projects by supplying a foreign project's sequential numeric ID in the project_pk parameter, enabling modification, deletion, run-now triggering and log disclosure across project boundaries. The flaw sits in the default behavior of the task_center ScheduledTaskViewSet and TaskExecutionViewSet endpoints, so no elevated role, special configuration or user interaction is required beyond holding any valid account on an instance that hosts more than one project. It is not listed in CISA KEV and no confirmed public exploit code was identified at time of analysis; a public technical writeup of the issue exists, and the vendor issue tracker is referenced for status.
An authorization bypass in Tamery (formerly Conar) cloud sync lets an authenticated Pro subscriber write messages into another user's AI chat history by supplying a victim's chatId to the chatsMessages.update handler, which never verifies that the caller owns the chat. Versions 0.26.1 through 0.98.x are affected, and the flaw is an integrity-only primitive (CVSS 4.0: 5.3 medium; independently assessed CVSS 3.1: 5.3, VC:N/VI:L/VA:N) that grants no read access to victim data. A public technical writeup describing the cross-user write exists; it is not verified as working exploit code, and no CISA KEV entry or confirmed active exploitation was provided. Fix is available in 0.99.0.
Broken object ownership enforcement in Tamery's cloud sync API lets an authenticated user who owns at least one connection attach attacker-named resource rows to another user's connection, so the injected rows appear in the victim's client. Tamery (formerly Conar) releases from 0.32.0 up to but not including 0.99.0 are affected; the flaw is integrity-only, granting no read access to victim data and no availability impact, and requires valid credentials plus knowledge of the victim's connectionId. No public exploit code has been confirmed - a public technical writeup (HackMD) describing the issue exists - and vendor fixes are available in 0.99.0; priority is this_month, not emergency.
An authenticated authorization bypass (IDOR) in Blossom through 1.17.1 lets any registered user act on folders belonging to other users by supplying a foreign folder id to the /folder/info, /folder/upd, /folder/open or /folder/del endpoints, exposing storage paths, enabling renames, visibility toggling and deletion. Exploitation requires a valid account on a multi-user instance (PR:L, per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) plus knowledge of a victim's folder id; single-user deployments have no cross-user victim. The result is a medium-severity integrity and confidentiality issue scoped to folder metadata rather than a critical remote compromise, and no public working exploit code was identified at time of analysis, though a public technical write-up reference exists.
PowerDNS-Admin through 2026.08.1 lets an authenticated User-role account that is already authorized for one zone trigger AXFR retrievals against other users' secondary (Slave) zones, and infer whether those zones exist, by supplying a different 'domain' value in the JSON body of a POST to /domain/<authorized-zone>/update. The route authorizes the zone in the URL path, but pre-patch code then replaced the zone name with the body-supplied value before issuing the backend call, so a cross-tenant key substitution slips past the per-zone access check. Severity is moderate (CVSS 5.3 / assessed CVSS:3.1 5.3, this-month priority), the flaw is not listed in CISA KEV, and no confirmed working exploit code is referenced, although a public technical writeup of the issue and its mechanism is available.
Any authenticated Nging backend user can enumerate host directories and confirm the existence of specific files through the public-tagged /user/autocomplete_path endpoint in versions through 5.3.5, even without file-manager or administrative permission. Supplying arbitrary paths in the endpoint's query parameter returns filesystem matches readable by the Nging process account, exposing directory structure and file names but not file contents. Exploitation requires a valid low-privileged backend login (CVSS 4.0 base 5.3, CWE-862 missing authorization); no public exploit code was identified at time of analysis, and the vendor has published a fix commit.
An insecure direct object reference in HuLa-Server through 3.0.7 lets any authenticated user read other users' friend lists by sending a GET request to /user/friend/page with a victim's uid, because FriendController.friendList performs no owner or administrator check on the supplied identifier. The impact is read-only disclosure of contact lists (CWE-639, low confidentiality impact, no integrity or availability effect), so the practical exposure is social-graph and privacy leakage rather than account takeover. Exploitation requires a valid logged-in account (CVSS PR:L) plus knowledge or enumeration of victim uids; no verified working exploit code is identified in the available data, though a public technical writeup of the flaw is referenced, and the priority label places remediation within the current month rather than in an emergency window.
Authenticated users of HuLa-Server through 3.0.7 can delete other users' moments and their attached media, comments and likes by posting an arbitrary feedId to the /feed/del endpoint, because FeedController.delFeed never verifies that the caller owns the feed it deletes. The flaw is an insecure direct object reference (CWE-639) rated 5.3 that requires only a standard account and knowledge or enumeration of a victim's feedId, with impact confined to integrity and availability of feed content rather than data disclosure. It is a genuine but moderate-priority issue, not a top-tier emergency: no CISA KEV listing or confirmed active exploitation is present in the supplied intelligence, though public technical write-up references describing the attack exist and are not verified as working exploit code.
HuLa-Server through 3.0.7 contains an insecure direct object reference (IDOR) in PrivacyController that lets any authenticated user supply another user's uid to the /privacy endpoint and read or overwrite that user's UserPrivacy settings. The flaw is a server-side ownership-check failure (CWE-639), rated moderate severity (CVSS 5.3), with low confidentiality and integrity impact and no availability or code-execution impact. Exploitation requires a valid account (PR:L) but no admin or victim credentials; no CISA KEV entry or confirmed public exploit code is reported in the supplied intelligence.
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 lets any holder of a valid account read host records belonging to other businesses by posting crafted search conditions to /api/v3/hosts/search/asstdetail, because that route is mapped to SkipAction and SearchHostWithAsstDetail never calls AuthorizeSearchHost. The result is read-only cross-tenant disclosure of host attributes and topology associations; integrity and availability are unaffected (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-862). The exposure is bounded by the need for existing credentials and matters mainly in multi-business deployments where business-level isolation is the control being relied upon; no public exploit code has been confirmed at time of analysis, and no KEV or EPSS signal accompanies this record.