Monthly
Privilege escalation in the WebToffee 'Export and Import Users and Customers' plugin for WordPress (all versions up to and including 2.7.5) lets any authenticated user with Subscriber-level access or above plant a crafted value in the Biographical Info field that is later reinterpreted as a second CSV row during import, creating a brand-new account whose login, password, e-mail and role are fully attacker-chosen - including Administrator. Exploitation is conditional rather than automatic: the payload only detonates when a privileged operator runs the plugin's own export and then re-imports the generated file, so sites that never round-trip exported user data back through the importer are not exposed. No public exploit code or confirmed in-the-wild activity was identified at the time of analysis, but the 8.8 severity and the low Subscriber-level prerequisite make this a this-week remediation priority for any site that uses the plugin's export/import cycle.
Cypher injection in Flexible GraphRAG 0.6.0 through 0.8.1 lets attacker-influenced document content reach FalkorDB queries when GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured. A crafted ingested document can steer the extraction model into producing malicious entity or relationship values, and the broken _escape() helper fails to neutralize a quote, allowing injected Cypher clauses to modify or delete graph data and, if the calling code surfaces query results to the user or LLM, disclose graph data. The assessed vector is CVSS 3.1 7.1 with AC:H, PR:L and UI:R; the maintainer demonstrated a proof-of-concept against a live FalkorDB instance that deleted every node, and the vendor released 0.8.2 with parameterized queries and backtick stripping.
MongoDB Compass before 14.9.15 can execute arbitrary code with the privileges of the user running Compass when that user connects to a MongoDB deployment containing a specially crafted stored view and opens that view for editing. The underlying issue is improper escaping of BSON values while Compass converts a view's aggregation pipeline into editable source, so attacker-controlled view definitions can break out into executable code. The assessed CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis; exposure is concentrated in shared, hosted, or multi-tenant deployments where an attacker can create or modify views that a victim later opens.
XMPP stanza injection in Mozilla Thunderbird's chat feature lets a remote XMPP user send a crafted request that is echoed back in an automatic reply, causing arbitrary stanzas to be injected into the victim's connection and processed by the server as if sent by the user. This enables the attacker to send messages or change contact and subscription settings on the user's behalf without interaction. Only Thunderbird installations using the chat feature with an XMPP account are affected; the vendor fixed the flaw in Thunderbird 158.0.1, no public exploit is identified at time of analysis, and EPSS is 0.18% (percentile 7).
CSV record splitting in Text::CSV_XS before 1.65 allows an attacker-controlled field that has been used in a numeric context to be serialized without quotes, so an embedded newline, carriage return, or delimiter can terminate the record early and turn the remaining fields into a separate row. The flaw is limited to the combine()/print() write path in binary mode (the default) and requires the attacker to control that specific field plus the application to perform a numeric operation on it before serialization; the assessed vector is network-reachable but high-complexity, unauthenticated, with integrity-only impact. No public exploit was identified at time of analysis, and EPSS is 0.19% (8th percentile), indicating low predicted exploitation activity despite the serious record-splitting consequence.
Text::CSV_XS versions before 1.65 for Perl silently corrupt the final record written with print() when a UTF-8 flagged (decoded) field is followed by a field ending in bytes that are not valid UTF-8: the held-back trailing byte, any closing quote, and the line ending are never flushed, yet print() still returns true. The practical result is fused records - the next record lands on the same line, or, in the quoted case, the missing close quote makes downstream readers absorb every following row into that field - an integrity impact on generated CSV rather than code execution. According to CISA KEV no active exploitation is confirmed and no public exploit code was identified at time of analysis; EPSS is 0.19% (8th percentile), and the reported 9.8 AV:N/AC:L vector is not supported by the exploitation prerequisites, which require a specific mixed-encoding data condition.
Stored cross-site scripting in the Audit Logs component of Crafty Controller (the crafty-4 project by Arcadia Technology, LLC) allows an unauthenticated remote attacker to plant script payloads through attacker-influenced HTTP header values that the panel writes into its audit entries, with the payload executing in the browser of a privileged administrator who later opens the Audit Logs view. Per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), the planting step requires no authentication, but realistic impact depends on the web interface being reachable from the attacker's network path and on an administrator actually viewing the poisoned log entry, which is the primary limiting factor. No public exploit identified at time of analysis, no CISA KEV listing is present in the supplied data, and no EPSS score was provided; exact affected and fixed versions are not stated in the available data.
Remote code execution in Visual Studio Code versions 1.0.0 through 1.141.1 allows an unauthenticated, network-positioned attacker to execute arbitrary code when a victim opens attacker-controlled content (e.g., a crafted workspace, folder, or repository), due to improper output encoding/escaping (CWE-116). Exploitation requires user interaction, and no public exploit code has been identified at time of analysis. The vendor has released a patch in version 1.141.1.
Privilege escalation in MariaDB Server affects releases from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, where the view FRM parser fails to safely encode embedded newline characters in an account name. An authenticated attacker who already holds both CREATE USER and CREATE VIEW WITH GRANT OPTION (CVSS vector PR:H, so not an anonymous path) can create a username containing forged view metadata and then create a view, causing the parser to read part of the username as security fields such as definer_host and suid and thereby escalates database privileges. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the 7.2 High base score reflects a conditional, insider-style privilege-boundary bypass rather than a remote unauthenticated attack, and environments that restrict these administrative grants to trusted administrators have substantially reduced exposure.
Stored cross-site scripting in GLPI 11.0.6 through 11.0.8 allows an authenticated technician to inject active markup into supplier website fields, which executes in the browser of any user who opens the suppliers list for the affected contact or contract. The vulnerability is fixed in version 11.0.8, and no public exploit identified at time of analysis. Successful exploitation requires a privileged account (PR:H) and user interaction from a victim (UI:P), and the impact is limited to the victim's session context (CVSS 4.0 score 8.5).
Privilege escalation in the WebToffee 'Export and Import Users and Customers' plugin for WordPress (all versions up to and including 2.7.5) lets any authenticated user with Subscriber-level access or above plant a crafted value in the Biographical Info field that is later reinterpreted as a second CSV row during import, creating a brand-new account whose login, password, e-mail and role are fully attacker-chosen - including Administrator. Exploitation is conditional rather than automatic: the payload only detonates when a privileged operator runs the plugin's own export and then re-imports the generated file, so sites that never round-trip exported user data back through the importer are not exposed. No public exploit code or confirmed in-the-wild activity was identified at the time of analysis, but the 8.8 severity and the low Subscriber-level prerequisite make this a this-week remediation priority for any site that uses the plugin's export/import cycle.
Cypher injection in Flexible GraphRAG 0.6.0 through 0.8.1 lets attacker-influenced document content reach FalkorDB queries when GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured. A crafted ingested document can steer the extraction model into producing malicious entity or relationship values, and the broken _escape() helper fails to neutralize a quote, allowing injected Cypher clauses to modify or delete graph data and, if the calling code surfaces query results to the user or LLM, disclose graph data. The assessed vector is CVSS 3.1 7.1 with AC:H, PR:L and UI:R; the maintainer demonstrated a proof-of-concept against a live FalkorDB instance that deleted every node, and the vendor released 0.8.2 with parameterized queries and backtick stripping.
MongoDB Compass before 14.9.15 can execute arbitrary code with the privileges of the user running Compass when that user connects to a MongoDB deployment containing a specially crafted stored view and opens that view for editing. The underlying issue is improper escaping of BSON values while Compass converts a view's aggregation pipeline into editable source, so attacker-controlled view definitions can break out into executable code. The assessed CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and no public exploit code or confirmed active exploitation was identified at time of analysis; exposure is concentrated in shared, hosted, or multi-tenant deployments where an attacker can create or modify views that a victim later opens.
XMPP stanza injection in Mozilla Thunderbird's chat feature lets a remote XMPP user send a crafted request that is echoed back in an automatic reply, causing arbitrary stanzas to be injected into the victim's connection and processed by the server as if sent by the user. This enables the attacker to send messages or change contact and subscription settings on the user's behalf without interaction. Only Thunderbird installations using the chat feature with an XMPP account are affected; the vendor fixed the flaw in Thunderbird 158.0.1, no public exploit is identified at time of analysis, and EPSS is 0.18% (percentile 7).
CSV record splitting in Text::CSV_XS before 1.65 allows an attacker-controlled field that has been used in a numeric context to be serialized without quotes, so an embedded newline, carriage return, or delimiter can terminate the record early and turn the remaining fields into a separate row. The flaw is limited to the combine()/print() write path in binary mode (the default) and requires the attacker to control that specific field plus the application to perform a numeric operation on it before serialization; the assessed vector is network-reachable but high-complexity, unauthenticated, with integrity-only impact. No public exploit was identified at time of analysis, and EPSS is 0.19% (8th percentile), indicating low predicted exploitation activity despite the serious record-splitting consequence.
Text::CSV_XS versions before 1.65 for Perl silently corrupt the final record written with print() when a UTF-8 flagged (decoded) field is followed by a field ending in bytes that are not valid UTF-8: the held-back trailing byte, any closing quote, and the line ending are never flushed, yet print() still returns true. The practical result is fused records - the next record lands on the same line, or, in the quoted case, the missing close quote makes downstream readers absorb every following row into that field - an integrity impact on generated CSV rather than code execution. According to CISA KEV no active exploitation is confirmed and no public exploit code was identified at time of analysis; EPSS is 0.19% (8th percentile), and the reported 9.8 AV:N/AC:L vector is not supported by the exploitation prerequisites, which require a specific mixed-encoding data condition.
Stored cross-site scripting in the Audit Logs component of Crafty Controller (the crafty-4 project by Arcadia Technology, LLC) allows an unauthenticated remote attacker to plant script payloads through attacker-influenced HTTP header values that the panel writes into its audit entries, with the payload executing in the browser of a privileged administrator who later opens the Audit Logs view. Per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), the planting step requires no authentication, but realistic impact depends on the web interface being reachable from the attacker's network path and on an administrator actually viewing the poisoned log entry, which is the primary limiting factor. No public exploit identified at time of analysis, no CISA KEV listing is present in the supplied data, and no EPSS score was provided; exact affected and fixed versions are not stated in the available data.
Remote code execution in Visual Studio Code versions 1.0.0 through 1.141.1 allows an unauthenticated, network-positioned attacker to execute arbitrary code when a victim opens attacker-controlled content (e.g., a crafted workspace, folder, or repository), due to improper output encoding/escaping (CWE-116). Exploitation requires user interaction, and no public exploit code has been identified at time of analysis. The vendor has released a patch in version 1.141.1.
Privilege escalation in MariaDB Server affects releases from 10.6.1 up to (but not including) 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, where the view FRM parser fails to safely encode embedded newline characters in an account name. An authenticated attacker who already holds both CREATE USER and CREATE VIEW WITH GRANT OPTION (CVSS vector PR:H, so not an anonymous path) can create a username containing forged view metadata and then create a view, causing the parser to read part of the username as security fields such as definer_host and suid and thereby escalates database privileges. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the 7.2 High base score reflects a conditional, insider-style privilege-boundary bypass rather than a remote unauthenticated attack, and environments that restrict these administrative grants to trusted administrators have substantially reduced exposure.
Stored cross-site scripting in GLPI 11.0.6 through 11.0.8 allows an authenticated technician to inject active markup into supplier website fields, which executes in the browser of any user who opens the suppliers list for the affected contact or contract. The vulnerability is fixed in version 11.0.8, and no public exploit identified at time of analysis. Successful exploitation requires a privileged account (PR:H) and user interaction from a victim (UI:P), and the impact is limited to the victim's session context (CVSS 4.0 score 8.5).