Ivanti Connect Secure before 25.1.1.3 and 22.8R2.6 uses predictable filenames, allowing a remote authenticated attacker to write attacker-controlled content to a deterministic, known location on disk. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes an integrity-only impact with no confidentiality or availability effect. Despite the low base score, the flaw is confirmed actively exploited (CISA KEV); the exact upload endpoint and trigger are not described in the available sources, and patched builds are 25.1.1.3 and 22.8R2.6.
Ruby code execution in Elo (npm @enspirit/elo) through 1.0.0 lets an attacker who controls Elo source gain arbitrary Ruby and shell command execution whenever that source is compiled to the Ruby target and the emitted code is run. The Ruby backend in src/compilers/ruby.ts inserts string literals and labelled subtype-constraint messages into Ruby double-quoted strings without escaping '#', so payloads such as 'RES=#{`id`}' survive compilation intact and execute when the generated Ruby is evaluated; the server-side /try playground with the Ruby target, bin/eloc -t ruby -x, and library integrations that call a Ruby emission step on parsed input are all exposed. The network-facing playground surface needs no authentication or user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, 9.8), and the advisory ships working proof-of-concept Elo snippets; the same Elo source compiled to JavaScript, Python, or SQL is harmless, so only pipelines that emit and execute Ruby from untrusted Elo are exploitable, and no CISA KEV listing or independent confirmation of exploitation in the wild is present in the available data.
Code injection in the Lua Handler of Ziroom ZHOME A0101 (version 1.0.1.0, Build 202004151405) lets a remote attacker with high privileges pass attacker-controlled data into the Lua loadstring function through the zrUsb API controller, resulting in code execution with full confidentiality, integrity and availability impact on the device and on subsequent systems (CVSS 4.0 score 8.5, scope-changed). Exploitation requires an authenticated administrative session (PR:H) but needs no user interaction and is low complexity once that access is obtained, so exposure is greatest where the management interface is reachable from untrusted or multi-tenant networks. A public PoC reference has been published; it is not verified as working exploit code, and the vendor did not respond to disclosure so no vendor fix is available.
Deserialization of untrusted data in the Stanza lemmatizer allows arbitrary code execution when a downstream user loads an attacker-supplied lemma checkpoint (.pt) via the documented Pipeline API (lemma_model_path) or any custom registry path. Since version 1.14.0 the lemmatizer stores pos_dict as a gzip-compressed pickle inside the checkpoint's dicts field, and Trainer.load passes those bytes to an unrestricted pickle.loads after torch.load(weights_only=True) lets the bytes primitive through unexamined - the flaw was confirmed end-to-end against stanza 1.14.0 with PyTorch 2.13.0 and CPython 3.13.7. Exploitation is conditional: user interaction is mandatory, since the victim must actively load the malicious file, and only stanza 1.14.0 with the v2 dict format is affected; a public proof-of-concept reference exists in the advisory, but it is not verified as working exploit code against the full Pipeline path, and there is no confirmed active exploitation (no CISA KEV) at time of analysis.
Concurrent order requests to Bagisto's onepage checkout can redeem a single-use or usage-limited coupon multiple times, allowing an attacker to apply the same discount across multiple orders. The issue affects Bagisto before 2.3.16 and 2.4.x before 2.4.1 and stems from a race condition in manageCartRule(); impact is limited to coupon accounting and discount integrity, with no confidentiality or availability impact. A public PoC reference exists but is not verified as working exploit code, and there is no confirmed active exploitation (CISA KEV).
Command injection in SolarWinds Dameware lets an authenticated attacker with low-privilege credentials execute arbitrary commands on a remotely controlled host, with scope change and high confidentiality, integrity, and availability impact. The network-reachable flaw requires no user interaction, but valid Dameware authentication is the main limiting prerequisite; no public exploit identified at time of analysis, and no CISA KEV entry is present in the supplied data. The vuln.today decision label is act_now.
Authentication bypass in WSO2 API Manager allows a self-registered user to gain access to the product's System REST APIs when WSO2 Identity Server is configured as a Resident Key Manager with a shared database. The vendor rates this 9.8 critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is PR:L because the described flow starts from a self-registered account; a token obtained from the Identity Server token endpoint is improperly honored by API Manager. Affected deployments are limited to that Resident Key Manager plus database-sharing architecture; no public exploit identified at time of analysis.
Unauthenticated attackers can invoke arbitrary WordPress functions with attacker-controlled arguments through the render_field method in the Advanced Custom Fields: Extended PRO plugin for WordPress, affecting all versions up to and including 0.9.2.6. Exploitation is not unconditional: it requires either the non-default 'shortcode_preview' setting to be enabled on the targeted form, or a server environment lacking OpenSSL functions so that ACF Pro's acf_decrypt falls back to unverified base64 decoding - default installations with shortcode_preview disabled and OpenSSL present are not exploitable. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the vendor-reported severity is critical and the priority decision is act_now, so exposed sites running the PRO plugin should be triaged promptly.
Hardcoded command-line credentials in HPE Networking Fabric Composer let an unauthenticated remote attacker log in with administrative privileges, giving full control of the affected appliance. The flaw is rated CVSS 9.8 and requires only network reachability of the management CLI; no special configuration or enabled feature is needed, so default deployments are exposed. No public exploit has been identified at time of analysis, but the static credentials make exploitation trivial once they are disclosed or reverse-engineered, and the issue is tracked as act_now priority.
Elo 1.0.0 and earlier - a purely functional expression language used as a rule-engine, config and form-builder DSL - lets an attacker who controls a plain Elo source string reach the JavaScript `Function` constructor and run arbitrary code in the host runtime. The vulnerable string can arrive through `defaultFormats.elo.parse()`, the `bin/elo` CLI (including the `-f elo` flag documented to pass user files as data), or the auto-running `elo-lang.org/try?code=...&run=1` playground, where a shared link yields 0-click script execution and session compromise in the visitor's browser. The vendor advisory ships proof-of-concept payloads for all three entry points, and the issue is fixed in 1.0.1; no CISA KEV entry was provided in the source data, and the priority decision is act_now.
Zip Slip path traversal in codeskyblue gohttpserver through v1.3.0 lets remote attackers reach the /upload endpoint and write arbitrary files outside the intended upload/extraction directory by submitting a crafted Zip archive whose entry names contain traversal sequences. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes unauthenticated, low-complexity exploitation of a default instance that exposes uploads, and CISA's SSVC framework rates it Automatable: yes with Technical Impact: total, producing an act_now priority; SSVC records exploitation as proof-of-concept and the references include a public research advisory, so a public PoC reference exists but is not verified as working exploit code, and no CISA KEV entry is present. Real-world exposure is bounded by whether uploads are enabled, whether the service is reachable directly, and the filesystem write permissions of the account running the server, which determine where written files land and whether the write escalates to code execution.
Out-of-bounds write in Google Chrome's WebGL implementation on Android before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction to open the page (UI:R) and is not automatable per SSVC; no public exploit was identified at time of analysis. A vendor patch is available and the priority decision is act_now.
Use-after-free in the Browser process of Google Chrome prior to 157.0.8103.38 lets a remote, unauthenticated attacker execute arbitrary code outside the sandbox if a victim visits a crafted HTML page. Exploitation requires user interaction (UI:R) and default configurations are affected; the specific trigger mechanism is not described in the available sources, and Google rates the Chromium severity as Low despite a CVSS score of 9.6. No public exploit code is identified in the supplied intelligence (SSVC Exploitation: none) and there is no KEV confirmation, but the vuln.today decision label is act_now and the vendor has released a fix in 157.0.8103.38.
Sandbox escape in Google Chrome Mobile before 157.0.8103.38: a use-after-free reachable from a crafted HTML page can, once a victim is socially engineered into opening it, potentially lead to arbitrary code execution outside the browser sandbox. Severity signals conflict and must be read together - Chromium rates the issue Medium, while the CVSS 3.1 score of 9.6 derives from the scope change (S:C) combined with high confidentiality, integrity and availability impact. No public exploit identified at time of analysis, and a vendor-released patch exists in 157.0.8103.38.
Arbitrary code execution outside the sandbox is possible in Google Chrome builds before 157.0.8103.38 because of a use-after-free in Autofill that is reached when a user is socially engineered into opening a crafted HTML page. The issue is rated CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), so it is remote and unauthenticated but requires user interaction; the affected population is Chrome desktop builds below the fixed version. Vendor patch 157.0.8103.38 is available, no public exploit was identified at time of analysis, and the current vuln.today decision is act_now even though SSVC records exploitation as none and automatable as no.
Sandbox escape in Google Chrome's DevTools affects builds prior to 157.0.8103.38, allowing a remote, unauthenticated attacker who persuades a user to open and interact with a crafted HTML page to execute arbitrary code outside the sandbox (CVSS 3.1 base 9.6, scope changed, high confidentiality/integrity/availability impact). The signals here diverge sharply and must be weighed against each other: Google assigns only Chromium severity Medium and SSVC records Exploitation: none and Automatable: no, while the vuln.today decision label is act_now and the reference tags describe authentication bypass and RCE. No public exploit identified at time of analysis, and the mandatory user interaction (UI:R) keeps this from being a silent drive-by compromise.
Google Chrome releases before 157.0.8103.38 contain an incorrect reference resolution defect in DevTools that can potentially let a remote, unauthenticated attacker execute arbitrary code outside the browser sandbox, but only after socially engineering a victim into opening a crafted HTML page and interacting with DevTools. The vendor rates the Chromium security severity as Medium while the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) scores 9.6 because of the scope change and high confidentiality, integrity and availability impact; the specific feature state or sequence that triggers the flaw is not described in the available sources. No public exploit was identified at the time of analysis, SSVC records exploitation as none and automatable as no, yet the vuln.today decision label is act_now, technical impact is total, and a vendor patch exists in Chrome 157.0.8103.38.
Privilege elevation in Google Chrome for Android allows a crafted HTML page to execute arbitrary code outside the browser sandbox, and the signals here conflict sharply - that tension is the headline: a 9.6 CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) sits alongside a 'Medium' Chromium security severity rating, an SSVC exploitation status of none, and an SSVC 'not automatable' determination. Only the Android build at versions prior to 157.0.8103.38 is affected; the attack is remote and unauthenticated, but it is gated on the victim opening attacker-controlled content (UI:R), so there is no drive-by guarantee without that interaction. No public exploit has been identified at time of analysis, and the flaw is not reported as actively exploited in the supplied intelligence (SSVC Exploitation: none), despite a vuln.today decision label of act_now and an SSVC technical impact of total.
Use-after-free in Google Chrome's WebXR implementation allows a remote attacker to execute arbitrary code outside the browser sandbox by convincing a victim to open a crafted HTML page, affecting Chrome builds prior to 157.0.8103.38. Exploitation requires no authentication or prior privilege (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) but does depend on user interaction with the page and the WebXR code path being exercised, and the vendor severity is High with a scope change indicating sandbox escape. There is no CISA KEV listing and no public exploit identified at time of analysis, but the priority assessment is act_now given the pre-auth, cross-boundary code execution potential; the vendor-released patch is Chrome 157.0.8103.38.
Incorrect authorization in the FileSystem component of Google Chrome before 157.0.8103.38 lets a remote attacker who socially engineers a victim into opening a crafted HTML page potentially execute arbitrary code outside the browser sandbox. The flaw is rated Chromium security severity High and carries a CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), with the sandbox-escape scope change being the main driver of that score; the only prerequisite is that the target runs an unpatched Chrome build, since 157.0.8103.38 and later are not affected. It is tagged act_now by vuln.today priority and no public exploit or CISA KEV confirmation is present in the supplied data; the vendor has released a fix, and the precise FileSystem configuration or feature state needed to trigger the authorization error is not described in the available sources.
Use-after-free in the Views component of Google Chrome on Windows before 157.0.8103.38 lets a remote attacker who persuades a user to open a crafted HTML page execute arbitrary code outside the browser sandbox. The flaw is unauthenticated over the network but requires user interaction (UI:R), and its scope change (S:C) reflects that the impact crosses a security boundary; Chromium rates it High with a CVSS base of 9.6. No public exploit code has been identified at time of analysis and it is not in CISA KEV, but the vendor patch 157.0.8103.38 is available and the issue is prioritized as act_now.
Incorrect authorization in the FileSystem component of Google Chrome (all desktop versions prior to 157.0.8103.38) allows a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox, provided the victim is socially engineered into visiting or opening a crafted HTML page. The attack is not self-propagating: exploitation is gated entirely by the required user interaction (UI:R), but against a lured victim it works on default configurations and, per the CVSS scope-change metric, can compromise resources beyond Chrome's security boundary. Google rates the issue High and has released a stable-channel fix in 157.0.8103.38; no public exploit code has been identified at time of analysis, and the issue carries an act_now priority with a 9.6 CVSS score reflecting the sandbox escape potential.
Use-after-free in Chrome for Android's Navigation component allows an unauthenticated remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page, affecting Android builds prior to 157.0.8103.38. Exploitation requires user interaction and is limited to the Android version; no public exploit identified at time of analysis, and the vuln.today decision label is act_now with a CVSS score of 9.6. Vendor-released patch: 157.0.8103.38.
A stack buffer overflow in ANGLE, Chrome's default graphics abstraction layer, allows remote code execution outside the browser sandbox when a victim renders a crafted HTML page. All Chrome builds prior to 157.0.8103.38 are affected; exploitation requires the target to navigate to attacker-controlled content (UI:R), so delivery is drive-by or social-engineering based rather than autonomous. No public exploit is identified at time of analysis and SSVC records Exploitation: none, but technical impact is total and the vendor rates the issue High, so patching to 157.0.8103.38 should be treated as urgent for any fleet running older builds.
Use-after-free in Google Chrome's built-in Passwords component lets a crafted HTML page corrupt freed memory and potentially achieve code execution outside the browser sandbox; the CVSS vector carries S:C, reflecting that the impact crosses a security boundary rather than staying confined to the renderer. Every Chrome build prior to 157.0.8103.38 is affected, and because the password manager is a standard built-in feature, default installations are in scope - exploitation requires only that a victim load attacker-controlled content (UI:R), with no authentication or prior privileges (PR:N). No public exploit code has been identified at time of analysis (SSVC exploitation: none), but the vendor has shipped a patched release and the case is prioritized act_now on the strength of total technical impact, with high confidentiality, integrity and availability consequences.
Use-after-free in the TabStrip component of Google Chrome before 157.0.8103.38 allows a remote attacker to execute arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction to load attacker-controlled content, but no authentication or non-default configuration is needed, and the sandbox escape makes the impact total across confidentiality, integrity, and availability. This is a high-priority issue; no public exploit or confirmed active exploitation was identified at time of analysis, and the vendor has released build 157.0.8103.38 with an act_now priority.
Use after free in Google Chrome's WebGPU implementation before 157.0.8103.38 allows a remote attacker who persuades a user to load a crafted HTML page to potentially execute arbitrary code outside the browser sandbox. The issue is rated 9.6 CVSS with scope change and high confidentiality, integrity, and availability impact, but it requires user interaction and SSVC marks it not automatable; the decision label is act_now, and no public exploit has been identified at the time of analysis.
Use-after-free in ANGLE, the graphics translation layer used by Google Chrome, lets a remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any Chrome build prior to 157.0.8103.38. No authentication is required, but successful exploitation depends on the target rendering the attacker's page (UI:R), and because the CVSS scope is changed (S:C), the resulting code execution is not contained by renderer sandboxing, giving high confidentiality, integrity and availability impact. Severity is rated 9.6 with a priority label of act_now, although CISA SSVC records no known exploitation, marking it automatable: no; no public exploit code was identified at time of analysis. This is a genuine high priority rather than an inflated-CVSS artifact, and the only complete fix stated in the available evidence is upgrading to Chrome 157.0.8103.38 or later.
Remote code execution outside the sandbox in Google Chrome before 157.0.8103.38 stems from a heap buffer overflow in the Skia graphics library and is triggered when a victim loads a crafted HTML page. A remote, unauthenticated attacker can exploit it only if the victim loads attacker-controlled HTML, and the 9.6 CVSS score reflects high confidentiality, integrity, and availability impact with scope change; no public exploit has been identified at time of analysis. Google has released Chrome 157.0.8103.38 as the vendor fix, and the vulnerability is prioritized as act_now.
Chrome on Windows prior to 157.0.8103.38 contains an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer, which a remote attacker can trigger by getting a victim to render a crafted HTML page, potentially achieving code execution outside the browser sandbox. The issue is rated high severity by Chromium, carries a CVSS score of 9.6 (scope-changed, high confidentiality, integrity, and availability impact), and affects Windows deployments only. No public exploit code and no active exploitation have been identified at time of analysis, though the prioritization signal is act_now and Chrome's stable-channel advisory provides the fix; the mandatory user interaction and browser-context prerequisites temper real-world risk somewhat.
Use-after-free in Google Chrome's Picture-in-Picture component allows remote attackers to execute arbitrary code outside the renderer sandbox by luring a victim to a crafted HTML page; the vulnerability affects all Chrome builds prior to 157.0.8103.38 and carries a Chromium security severity of High with a CVSS score of 9.6. Because the CVSS vector shows sandbox escape scope change (S:C) alongside PR:N and internet-vector access, a successful exploit is not confined to the compromised renderer, and the attacker only needs to persuade the target to open attacker-controlled web content and perform the socially engineered interaction (UI:R). No public exploit code or confirmed active exploitation is identified in the available intelligence, but the vendor patch is available and the priority decision is act_now given the sandbox-escape impact of a memory-corruption RCE.
Incorrect authorization in Google Chrome's FileSystem component before 157.0.8103.38 can let a remote attacker potentially execute arbitrary code outside the browser sandbox after convincing a victim to open a crafted HTML page. Exploitation requires user interaction and is not automatable at scale per SSVC, and no public exploit has been identified at time of analysis. Google has released Chrome 157.0.8103.38, and the vulnerability carries an act_now priority.
Memory corruption in the GPU component of Google Chrome for Android before 157.0.8103.38 lets a remote, unauthenticated attacker who convinces a victim to open a crafted HTML page potentially execute arbitrary code outside the browser sandbox. Only Android builds below 157.0.8103.38 are affected, and the scope-changing (S:C) rating reflects that successful exploitation escapes Chrome's sandbox rather than staying confined to the renderer. No public exploit has been identified at time of analysis (SSVC exploitation: none, no PoC or KEV entry in the supplied data), but the vendor-assigned Chromium severity is High and the vulnerability is flagged act_now in priority scoring given total technical impact.
Arbitrary code execution outside the sandbox is possible in Google Chrome versions prior to 157.0.8103.38 because of a use-after-free in the Core component that is triggered when a victim loads a crafted HTML page. The flaw is rated CVSS 9.6 Critical and is network-reachable without authentication, but exploitation requires user interaction and affects only unpatched Chrome builds; CISA SSVC lists exploitation as none, and no public exploit was identified at time of analysis. The vuln.today priority decision is act_now, and the vendor has released Chrome 157.0.8103.38 as the fixed version.
Heap-based buffer overflow in Dawn, the WebGPU implementation shipped with Google Chrome on Android before 157.0.8103.38, allows a remote attacker to execute arbitrary code outside the browser sandbox if a user opens a crafted HTML page. According to the supplied assessment, the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) confirms that no authentication is required, but exploitation depends on the victim visiting or being redirected to the attacker's page, and the page must actually exercise the Dawn component. Exploitation status is currently none per the SSVC data, with no public exploit code or PoC reference in the supplied feeds; the vulnerability is nonetheless tracked as an act_now priority with a Chromium severity of Critical because of the potential sandbox escape. The input does not include an EPSS value, so no EPSS-based risk figure can be given.
Use-after-free in the Prerender component of Google Chrome allows a remote attacker to execute arbitrary code outside the renderer sandbox by getting a victim to open a crafted HTML page in any build prior to 157.0.8103.38. Exploitation requires user interaction (UI:R) - the victim must navigate to the attacker's page - but no credentials (PR:N), and the scope change in the CVSS vector (S:C, 9.6) reflects that a successful attack escapes the sandbox to the host rather than staying contained in the renderer. No exploitation has been observed and no public exploit code has been identified at time of analysis per the SSVC assessment (Exploitation: none, Automatable: no), yet the combination of remote reach, total technical impact, and pre-auth attack surface makes this a genuine high-priority issue rather than a high-CVSS/low-real-risk case.
Use-after-free in WebGL in Google Chrome on Android before 157.0.8103.38 can let an unauthenticated remote attacker potentially execute arbitrary code outside the browser sandbox when a victim opens a crafted HTML page. Google assigns the Chromium security severity Critical and the issue scores CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), the scope change reflecting impact that can cross the renderer sandbox boundary as stated in the description. No public exploit code or active exploitation is identified at time of analysis and CISA SSVC assesses it as not automatable, but the vuln.today decision is act_now and a vendor patch (build 157.0.8103.38) is available.
Memory corruption in ANGLE, Chrome's default graphics abstraction layer, affects Google Chrome builds prior to 157.0.8103.38 and is rated Critical by Chromium security severity with a CVSS of 9.6. A remote attacker who gets a victim to load a crafted HTML page could potentially achieve code execution outside the browser sandbox, requiring user interaction but no authentication or non-default configuration. No public exploit code and no confirmed active exploitation were identified at time of analysis, and SSVC marks the issue as not automatable; the trigger within ANGLE is not described in the available sources.
A heap-based buffer overflow in the Dawn (WebGPU) component of Google Chrome before 157.0.8103.38 lets a remote, unauthenticated attacker potentially execute arbitrary code outside the renderer sandbox when a victim opens a crafted HTML page. The issue is rated CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and is prioritized act_now; Chrome 157.0.8103.38 is the vendor-released fix. No public exploit was identified at time of analysis, though the required user interaction and the sandbox escape potential keep the impact high.
HPE Networking Fabric Composer exposes a high-severity code execution path to an unauthenticated attacker who can reach the management plane from an adjacent network segment. Successful exploitation allows arbitrary code execution with scope change and high impact to confidentiality, integrity, and availability, reflected in a CVSS score of 9.6. No CISA KEV entry or public exploit was identified in the supplied data at time of analysis, but the vuln.today priority decision is act_now because the prerequisite is adjacency rather than authentication or user interaction.
Arbitrary code execution on HPE Networking Fabric Composer follows an authentication bypass in the appliance's underlying operating system, allowing an unauthenticated attacker on a logically adjacent network to compromise the system. The CVSS 3.1 score is 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and exploitation requires an adjacent network position such as the same L2 or management segment rather than arbitrary internet access. No public exploit was identified at time of analysis, but the vuln.today decision label is act_now.
SQL injection in the parent_Login.php endpoint of the sumiie24 School-Management-System (all code up to commit d946d649c7c95e101fc5679ecd91999533bb10d7) lets remote, unauthenticated attackers manipulate the 'email' argument of the Public Search Feature to alter the backend SQL query. Because the vector is PR:N/UI:N, the vulnerable endpoint is reachable pre-authentication from any internet-exposed deployment, with low impact to confidentiality, integrity and availability (CVSS 4.0 score 6.9, medium). A public PoC reference exists (a GitHub issue linked from the VulDB entry) but is not verified as working exploit code, and the vendor did not respond to disclosure; the project uses a rolling release model, so no fixed version or advisory confirms the affected range.
Unauthenticated information disclosure in Headless CMS Plugin through version 2.0.4 allows remote attackers to read draft, private, and scheduled WordPress post content through the /wp-json/rae/v1/post REST endpoint by manipulating the post_id or post_slug argument handled by get_required_post_data. The plugin's default REST route is reachable without credentials or user interaction when the plugin is installed and active, so exposure is limited mainly by whether a site uses this plugin. This is a genuine but moderate-priority issue rather than a critical emergency: the supplied intelligence does not confirm active exploitation, and a public PoC reference exists but is not verified as working exploit code.
SQL injection in mathurvishal CloudClassroom-PHP-Project allows remote attackers to manipulate the deleteid argument of facultydetails.php and alter the database query it feeds. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates the endpoint can be reached over the network with no authentication or user interaction stated as required, though impact is bounded to low confidentiality, integrity and availability effects. A public PoC reference exists (an advisory write-up) but is not verified as working exploit code, and there is no CISA KEV confirmation of active exploitation; the project uses a rolling release model, so no specific affected or fixed version can be identified.
Incorrect type conversion in phpMyAdmin SQL-Parser 6.0.0 and 6.0.1 allows remote attackers to degrade availability when attacker-controlled SQL containing an EXPLAIN statement reaches ExplainStatement::parse with a manipulated nextToken argument. Only applications embedding these two library versions and passing untrusted SQL into the parser are exposed; the parser itself imposes no authentication requirement, but exploitability depends entirely on whether the consuming application parses untrusted input. A public PoC reference (a GitHub gist) has been published but is not verified as working exploit code, and the vendor did not respond to the disclosure; impact is limited to availability with no confidentiality or integrity effect.
Remote code execution in the report-processing code of Puppet Server (shipped in Puppet Enterprise) lets a client holding any CA-signed agent certificate run arbitrary commands as the Puppet Server service user by sending a PUT request whose report body contains a crafted rich-data type. The authentication bar is real but conditional: in a properly configured CA the attacker must already control a legitimately enrolled agent, whereas a CA that autosigns certificate requests without strong verification lets an unauthenticated network attacker obtain a valid certificate on demand and effectively erase that requirement. The multi-source decision is act_now, no public exploit code was identified in the available data, and a fixed version is not stated in the supplied sources - the Puppet security page is the reference to monitor.
Missing access-control enforcement in Zoho ManageEngine Log360 and EventLog Analyzer 13062 and below lets remote attackers reach product functionality without authorization, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicating no credentials, privileges, or user interaction are needed against an exposed instance, and high confidentiality and integrity impact but no availability impact. Both the SIEM/log-management products share the affected build range, so internet-facing or otherwise reachable management interfaces are the exposure that matters. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the priority decision for this CVE is act_now given the unauthenticated network vector and the sensitivity of the data these products aggregate.
Unauthenticated attackers can forge payment-confirmation webhook requests to the Eupago Gateway For WooCommerce WordPress plugin (versions 4.5.0 through 4.7.5) when the store runs a configuration in which the plugin fails to verify webhook authenticity, letting them mark a pending order as paid without actually paying. Impact is integrity-only (no data exposure or availability loss) at CVSS 5.3, and the flaw is scoped to 'some configurations,' so properly validated deployments are not affected. A public PoC reference exists via the WPScan advisory, but it is not verified as working exploit code; there is no KEV listing and exploitation has not been confirmed in the wild.
Unauthenticated attackers can forge CryptoCloud payment notifications to mark arbitrary WooCommerce/WordPress orders as paid or failed without any cryptocurrency payment being made, affecting plugin versions 3.0.0 through 3.0.1. The gateway callback skips its payment-notification authenticity check whenever the webhook secret is still at its empty default, so the flaw is exploitable only on default or unconfigured installs; sites where an administrator has set a non-empty secret retain the integrity check and are unaffected. Severity is moderate and integrity-only (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and a public PoC reference exists at the WPScan advisory though it is not verified as working exploit code; there is no CISA KEV entry and no public exploit identified at time of analysis.
Etrel INCH AC charging station management web interfaces running firmware prior to 7.1.2 or 8.0.1 expose a factory-default administrator account, a high-priority issue that lets remote attackers log in over cleartext HTTP and gain full administrative control. Successful access reveals charger configuration, OCPP ChargePoint Identity, and CSMS WebSocket connection details, with exploitation limited mainly by whether the default account remains unchanged and the interface is network-reachable. No public exploit identified at time of analysis.