CWE-306

Missing authentication on the edit endpoint in cu silicon up to version 0.1.5 allows unauthenticated remote attackers to interact with the `create_app` function in `views.py` without any credentials. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms exploitation requires no special conditions against a network-accessible deployment, and a publicly available proof-of-concept exploit (E:P) reduces the barrier to abuse. No vendor patch exists; the vendor did not respond to coordinated disclosure, leaving users without an official fix.

Unauthenticated remote execution of database schema migrations in Wallos prior to version 4.9.4 allows any attacker with HTTP access to trigger pending SQLite migration files against the live database by calling endpoints/db/migrate.php directly. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this requires zero authentication, zero complexity, and no user interaction against default-configured instances. No public exploit has been identified at time of analysis, but the trivial attack surface makes this a straightforward integrity threat to any internet-exposed Wallos deployment.

Missing authentication on the DownloadPublic endpoint in sdcb chats through version 1.12.0 exposes signed file downloads to unauthenticated remote access, representing a CWE-306 failure in the .NET FileController. The flaw is network-exploitable but carries a CVSS 4.0 score of 2.9 due to high attack complexity and limited confidentiality impact. A proof-of-concept exploit has been publicly released, and the vendor has not responded to disclosure, leaving no official patch available.

Unauthenticated remote attackers can trigger a full MySQL database dump on any WordPress site running Keep Backup Daily before version 2.1.4 by invoking the publicly exposed `kbd_cron_process` parameter with no credentials required. The generated dump file is stored in the publicly accessible uploads directory with a partially predictable filename derived from the database name, a limited random value, and the current Unix timestamp - making retrieval via brute-force enumeration feasible. No active exploitation is confirmed in CISA KEV at time of analysis, but the attack requires no privileges or special tooling, making it an immediate data-exposure priority for affected deployments.

Unauthenticated remote code execution in the ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 lets remote attackers install and activate arbitrary plugins, yielding PHP execution as the web-server user. The flaw stems from the ppress_connect_process AJAX handler trusting a guessable 32-bit connect token, which an attacker brute-forces before supplying a caller-controlled URL via the file parameter to trigger silent plugin installation. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, though the low token entropy makes weaponization straightforward.

Missing authentication on the Telnet Handler of the Tenda AC18 router (firmware 15.03.05.19) lets remote, unauthenticated attackers reach the /goform/telnet endpoint and enable/access a telnet service without credentials, exposing full device control. Publicly available exploit code exists, and with a CVSS 4.0 base of 9.3 the flaw grants complete confidentiality, integrity, and availability impact over the network. No CISA KEV listing or EPSS score is provided, so real-world exploitation is unconfirmed despite the released PoC.

Missing authentication in the Tenda AC1206 (firmware 15.03.06.23) lets remote attackers reach the /goform/ate endpoint of the web UI without any credentials because the R7WebsSecurityHandler function fails to enforce access control. Any attacker with network reachability to the device's web interface can invoke the protected functionality directly, and publicly available exploit code exists. This is a VulDB-reported issue with a CVSS 4.0 base score of 9.3; it is not listed in CISA KEV and no EPSS score was provided.

Authentication bypass in the Tenda AC1206 router (firmware 15.03.06.23) lets remote, unauthenticated attackers reach the TendaTelnet handler at the /goform/telnet Web UI endpoint, which enables the device's telnet service without any credentials. Because CVSS records PR:N/UI:N over the network, an attacker on a reachable network path can turn on telnet and pivot to shell-level control of the device; publicly available exploit code exists, though it is not listed in CISA KEV. The flaw is classic missing authentication (CWE-306) on an administrative router function.

Unauthenticated information disclosure in Dell PowerStore T-series storage appliances allows an attacker with network access to the restricted management interface to read arbitrary internal system information from the appliance filesystem, including stored credentials that grant full administrative control of the array. Tracked as CWE-306 (Missing Authentication for Critical Function) with a CVSS 9.8, it affects PowerStore 500T through 9200T models and is fixed per Dell advisory DSA-2026-330. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Unauthenticated exposure of live TLS session keys in Keploy 3.1.0-3.6.25 allows any network-reachable attacker to decrypt recorded application TLS traffic by calling the agent control-plane's /agent/pcap/keylog endpoint, which streams NSS keylog lines without any authentication gate. The root cause is the agent HTTP server binding to 0.0.0.0 (all interfaces) rather than loopback, as confirmed by the patch commit diff. Additional endpoints /agent/stop and /agent/storemocks allow unauthenticated manipulation of test recording sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation requires only a standard HTTP client.