Authentication Bypass
Monthly
Improper Authentication (CWE-287) in Dell Secure Connect Gateway (SCG) 5.0 enables a remote, low-privileged attacker to bypass protection mechanisms, potentially gaining access to sensitive telemetry or support data beyond their authorized scope. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are affected, as confirmed in Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector and low authentication bar make patching a clear priority.
Authentication bypass in the light0011 CMS Cookie Helper allows remote unauthenticated attackers to manipulate the Username argument in App/Home/Model/UserModel.class.php and impersonate arbitrary users without valid credentials. The vulnerability (CWE-287, Improper Authentication) affects all commits through at least c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930 of this PHP CMS. Publicly available exploit code exists; the project maintainer has not yet responded to disclosure, and no patch has been released.
Authentication bypass in Tenda AC9 firmware 15.03.05.14 allows unauthenticated remote attackers to circumvent the web management interface's R7WebsSecurityHandler authentication gating. Published PoC files demonstrate two concrete attack paths: unauthenticated product information disclosure via the getProduct endpoint and unauthenticated WiFi credential modification via the fast_setting_wifi_set endpoint. No public vendor patch has been identified, and exploit code is publicly available (CVSS 4.0 E:P).
Unauthenticated remote user deletion is possible in SourceCodester Simple Traffic Offense System 1.0 via the delete-user.php endpoint, which processes a user-supplied ID parameter without any session or privilege check. An attacker with HTTP access to the application can delete arbitrary user accounts without logging in, impacting data integrity and application availability. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified at time of analysis applies to KEV only - PoC is confirmed); the vulnerability is not listed in CISA KEV.
Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest.
IP address spoofing via X-Forwarded-For header manipulation in PrestaShop's Tools::getRemoteAddr() function allows unauthenticated remote attackers to impersonate arbitrary IP addresses when the application runs behind a reverse proxy, load balancer, or CDN. Affected versions include PrestaShop branches prior to 9.1.5 and prior to 8.2.8. Exploitation enables bypassing IP-based access controls such as maintenance mode allowlists, forging security and audit log entries, and evading third-party mechanisms like geolocation restrictions, fraud detection systems, and request throttling. No public exploit code or active exploitation has been identified at time of analysis.
The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint by exploiting incorrect file path validation logic (CWE-73), causing the privileged service to load attacker-controlled VPN configurations. The impact is integrity-focused: a successful bypass enables substitution of legitimate VPN configuration with a malicious one, potentially redirecting traffic, disabling certificate validation, or weakening encryption enforced by an administrator. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is limited to the local Windows context.
Unauthenticated IDOR (Insecure Direct Object Reference) in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to delete arbitrary exam records by manipulating the `ID` parameter in `delete_exam.php` without any authorization check. Any network-accessible attacker can iterate over exam IDs to destroy examination data belonging to other users or system administrators. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for opportunistic abuse.
Hard-coded database credentials embedded in db.php of SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allow unauthenticated remote attackers to obtain and reuse valid database credentials without any prior authentication. The credentials, baked directly into the PHP source file, are exposed to any party who can read or retrieve that file over the network. Publicly available exploit code has been published per the VulDB submission and a GitHub vulnerability report covering the same product, elevating this beyond a theoretical risk.
Missing authorization in projeto-siga Siga's authentication controller allows unauthenticated remote attackers to bypass access controls by manipulating the `cod` or `jwt` parameters submitted to the `ExAutenticacaoController.autenticar` function. Versions up to 11.0.2.10, 11.0.2.13, and 11.1.1 of this Brazilian judicial document management platform are affected. A proof-of-concept exploit has been publicly disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure at time of analysis.
Cookie validation key forgery in liufee FeehiCMS up to 2.1.1 allows unauthenticated remote attackers to craft arbitrary signed cookies by exploiting a hardcoded (or empty) `cookieValidationKey` in the production backend configuration file `environments/prod/backend/config/main-local.php`. Because FeehiCMS is built on the Yii2 framework, this key is used for HMAC-based cookie integrity verification; a known or empty key trivially breaks that guarantee, enabling session/cookie forgery that can lead to authentication bypass and backend access. A public proof-of-concept exploit exists (FEHI-003-Empty-cookieValidationKey), and no vendor patch has been issued despite responsible disclosure through a GitHub issue.
Authentication bypass in Mstfakts College-Management-System exposes the login endpoint at Front-end/login.php to manipulation of the email argument, enabling remote unauthenticated attackers to circumvent access controls entirely. A public proof-of-concept exploit has been disclosed (CVSS 4.0 E:P), and the project maintainer has not responded to the responsible disclosure report filed via GitHub. No patched release exists due to the rolling-release delivery model, leaving all current deployments without a vendor-supported fix.
Unauthorized role self-assignment in the B2BKing WooCommerce plugin before version 5.2.40 allows unauthenticated registrants to claim restricted B2B customer group memberships without admin approval by supplying arbitrary role parameters not bounded by server-side validation. The plugin fails to verify that a role submitted during account registration is actually one offered on the public registration form, enabling any user to bypass the manual account-approval workflow and gain access to wholesale pricing tiers or restricted catalogs. A publicly available proof-of-concept exists via WPScan, though no confirmed active exploitation has been identified in CISA KEV at time of analysis.
Unauthenticated account registration bypass in SureCart WordPress plugin before 4.7.0 allows remote attackers to create WordPress user accounts and obtain authenticated sessions even when the site administrator has explicitly disabled user registration. The plugin fails to consult WordPress's native `users_can_register` site option before processing account creation through its own checkout/registration flow. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available in version 4.7.0. No confirmed active exploitation (CISA KEV) at time of analysis.
Hard-coded WPA passphrase in Tenda CP3 version 27.5.57.101 exposes the device's SoftAP (software access point) mode to unauthorized WiFi access by any party who possesses the fixed credential value embedded in custom-x/softap/hostapd. Because the passphrase is statically compiled into the hostapd configuration rather than randomly generated per device, all units running this firmware version share an identical WPA key. A public proof-of-concept has been disclosed per the CVSS 4.0 exploit maturity indicator (E:P), lowering the barrier for adversaries who identify target devices in range.
SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-authentication phase by triggering a client-requested rekey, causing the server to advance directly into the connection protocol and accept session channel and exec requests. The result is unauthenticated file creation, overwrite, and exfiltration within the RouterOS managed file namespace - including support bundles containing configuration and diagnostic data. Publicly available exploit code exists, CERT-PL has published dedicated research, and a companion CERT-PL post titled 'vulnerabilities-in-mikrotik-routeros-actively-exploited' suggests observed exploitation in the wild, though CISA KEV listing is not confirmed in the available data.
Unauthenticated form action execution in the Grav Form Plugin before 9.1.22 allows anonymous visitors to trigger save, upload, email, or call actions defined on login-restricted or unpublished pages. The plugin resolves forms by name across all pages without verifying whether the requesting user is authorized to access the page where the form is defined, so an attacker can POST to any public page while referencing a restricted form by name to bypass access controls entirely. No public exploit or CISA KEV listing has been identified, but the zero-authentication, network-accessible vector makes this trivially exploitable once form names are known.
Rate limiting in AVideo's API is completely nullified when requests include a bot User-Agent header, exposing all eight rate-protected operations - most critically the login endpoint - to unlimited brute-force attempts from a single IP address. An unauthenticated remote attacker who sets any bot User-Agent string can bypass the application's only credential-stuffing defense and attempt unlimited password guesses against any account. No active exploitation (CISA KEV) or public proof-of-concept code has been identified at time of analysis.
Missing authorization on the EmbedPress WordPress plugin's review-loading action (versions 4.6.0-4.6.3) permits unauthenticated remote attackers to abuse the site's stored third-party API credentials - triggering repeated billable API calls against the site owner's account - while simultaneously injecting an unbounded number of attacker-controlled rows into the WordPress database. A publicly available PoC exploit was documented by WPScan. Although EPSS probability is low (0.14%), SSVC rates the attack as automatable, making mass targeting of vulnerable WordPress deployments feasible with minimal tooling.
Unauthenticated access to the Backend Conversation API in ramon-victor/freegpt-webui allows remote attackers to invoke the `_conversation` function without valid credentials by manipulating the `model` argument in HTTP requests to `server/backend.py`. The affected codebase is a rolling-release hobby project that has been abandoned by its maintainer, meaning no patch will be issued. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation against any instance still running.
Missing authentication in freegpt-webui's ChatCompletion.create function (g4f/__init__.py, up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc) permits unauthenticated remote callers to invoke AI chat completion requests directly against the backend providers without credentials. A public proof-of-concept is available on GitHub. The product is abandoned and no longer maintained, meaning no vendor patch will be issued, and remediation requires decommissioning or layered compensating controls.
Missing authentication on the admin WebSocket endpoint in trape 1.0.0 and 2.0 exposes operator tracking sessions to unauthenticated remote attackers. The `join_room` function in `core/sockets.py` performs no credential check before admitting a caller to the admin room, meaning any network-reachable party can connect to the socket and observe victim tracking data intended solely for the trape operator. A public exploit exists via a GitHub issue report; the project maintainer has not responded to the disclosure.
Unauthenticated access to the stats/login endpoint in jofpin trape 1.0.0 exposes collected tracking statistics to any remote party without credentials via the core/stats.py component. The missing authentication check (CWE-287) allows the statistics interface to be queried freely over the network, leaking data about tracked individuals - a meaningful privacy concern given trape's purpose as a people-tracking OSINT tool. A proof-of-concept exploit is publicly available, and the vendor has not responded to the GitHub issue report disclosing the flaw.
Remote authenticated attackers can bypass security restrictions in IBM i 7.3 through 7.6 by exploiting improper authentication logic during service-name matching (CWE-287). The flaw allows a low-privileged authenticated user to overstep their authorized service boundaries, achieving limited unauthorized reads and writes with no user interaction required. No public exploit code exists and this CVE does not appear in the CISA KEV catalog; IBM has released a patch via the support portal.
Security restriction bypass in IBM i versions 7.3, 7.4, 7.5, and 7.6 enables remote authenticated attackers to circumvent platform-level access controls by exploiting predictable server-generated seed values (CWE-330). The vulnerability stems from insufficient entropy in IBM i's seed generation process, allowing an attacker with a valid low-privilege account to predict protected values - such as session tokens, nonces, or challenge-response material - and leverage them to bypass enforced security boundaries. No public exploit code has been identified at time of analysis; a vendor-supplied patch is available through IBM's support portal.
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts When {de,en}crypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page containing the buffer is wholly owned by KVM, i.e. won't be concurrently allocated and accessed by other kernel code while KVM is using the buffer to {de,en}crypt memory. On SNP-enabled platforms, when sending SEV/SEV-ES commands that trigger firmware writes to memory, the to-be-written page(s) must be (temporarily) assigned to Firmware (as required by the SNP architecture, to guard against using such commands as gadgets to attack SNP guests). See snp_map_cmd_buf_desc() and friends. Unfortunately, transferring ownership of a page to Firmware makes the page inaccessible to software, and thus writes generate RMP #PF violations. If KVM uses a sub-page allocation for its temporary buffer, some other actor in the kernel can allocate and use the other portions of the page, and thus trigger unexpected (and seemingly spurious) RMP #PF violations due to software attempting to access a Firmware-owned page. BUG: unable to handle page fault for address: ffff906ae30f0300 #PF: supervisor write access in kernel mode #PF: error_code(0x80000003) - RMP violation PGD 6b1b80d067 P4D 6b1b80d067 PUD 100231e2063 PMD 10055a88063 PTE 80000100630f0163 SEV-SNP: PFN 0x100630f0 unassigned, dumping non-zero entries in 2M PFN region: [0x10063000 - 0x10063200] Oops: Oops: 0003 [#1] SMP CPU: 70 UID: 0 PID: 10658 Comm: svw_WaiterThrea Tainted: G U W O 7.1.0-smp--c22293789940-seanjc-next #1 PREEMPTLAZY Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026 RIP: 0010:memset+0xf/0x20 Call Trace: <TASK> __kvmalloc_node_noprof+0x2a4/0x710 do_getxattr+0x4e/0x130 path_getxattrat+0x125/0x1b0 do_syscall_64+0x10a/0x480 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f3a22cb6daa </TASK> Modules linked in: kvm_amd kvm irqbypass vfat fat ccp k10temp sha3 libsha3 i2c_piix4 gq(O) cdc_acm xhci_pci xhci_hcd gsmi: Log Shutdown Reason 0x03 CR2: ffff906ae30f0300 ---[ end trace 0000000000000000 ]--- RIP: 0010:memset+0xf/0x20 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x39e00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) gsmi: Log Shutdown Reason 0x02
IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 005 embeds hard-coded credentials - passwords or cryptographic keys - used for internal authentication, outbound component communication, or internal data encryption. A high-privileged local attacker who discovers and extracts these static credentials could leverage them to access protected internal services, decrypt stored security event data, or authenticate to downstream components without per-user authorization. IBM has issued a patch via advisory 7285277; no public exploit code or CISA KEV listing exists at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable DAX on new encrypted files Currently, when a new encrypted regular file is created, the call to ext4_set_inode_flags(inode, init=true) in __ext4_new_inode() is made before EXT4_INODE_ENCRYPT is set. As a result, it can set S_DAX if the filesystem is mounted with "-o dax=always". EXT4_INODE_ENCRYPT then actually gets set a bit later in __ext4_new_inode(), when it calls fscrypt_set_context() which calls ext4_set_context(). ext4_set_context() sets EXT4_INODE_ENCRYPT and calls ext4_set_inode_flags(inode, init=false) to set S_ENCRYPTED too. This was intended to clear S_DAX as well. However, this was broken by commit 043546e46dc7 ("fs/ext4: Only change S_DAX on inode load"). This causes data written to the file to bypass encryption, also causing xfstests failures such as generic/548 (when "-o dax=always" is used). Fix this by simplifying the flow by making __ext4_new_inode() set EXT4_INODE_ENCRYPT earlier. This makes it take effect in ext4_set_inode_flags(inode, init=true), making S_DAX never be set. Similarly, make EXT4_STATE_MAY_INLINE_DATA never be set in the first place on new encrypted inodes. Then it doesn't need to be cleared. As a result of these simplifications, ext4_set_context() no longer needs to change inode flags or state when 'handle != NULL'. Remove that too.
Arbitrary IDE configuration file writes in IBM Langflow OSS 1.0.0 through 1.11.2 are achievable by authenticated remote attackers who spoof the X-Forwarded-For HTTP header to impersonate a localhost connection, bypassing the platform's IP-based restriction on MCP (Model Context Protocol) server configuration installation. The direct impact is unauthorized writes to files such as ~/.cursor/mcp.json, which define MCP server endpoints loaded by AI-integrated IDEs; a malicious entry in these files can redirect the IDE to an attacker-controlled MCP server, enabling downstream code execution within the developer's environment. No public exploit has been identified at time of analysis; a vendor-released patch is available per IBM advisory 7285646.
Authorization bypass in phpMyFAQ before 4.1.8 allows unauthenticated network attackers to submit questions through the question/create API endpoint regardless of guest-restriction settings. The root cause is an incomplete two-setting access control check: isAddingQuestionsAllowed() enforces only the main.enableAskQuestions feature flag while silently ignoring the records.allowQuestionsForGuests restriction, nullifying administrator intent. The practical result is spam injection into the admin moderation queue; no code execution or data exfiltration is achievable through this path alone. No public exploit code has been identified at time of analysis.
mTLS certificate reuse in Checkmk before 2.5.0p10 enables a relay or push agent to authenticate against agent receiver endpoints using a peer component's certificate, provided both share the same UUID. The agent receiver endpoints fail to verify that a presented client certificate was issued by their own root CA, breaking the intended role-based trust boundary between relay and push agent components. No public exploit has been identified, and exploitation requires an attacker to already control one of the affected agent components (PR:L), limiting realistic risk despite the network-reachable vector.
Missing Authorization in MarketKing WordPress plugin (≤2.1.60) allows unauthenticated remote attackers to perform integrity-affecting actions by exploiting incorrectly configured access control security levels. The CVSS vector (PR:N/UI:N/AV:N) confirms no authentication or user interaction is required. No public exploit or CISA KEV listing identified at time of analysis; impact is limited to partial integrity (C:N/A:N) per CVSS.
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor to send emails from the affected site to arbitrary recipients with arbitrary subjects. The opt-in submission handler accepts notification recipients and email subject lines directly from HTTP request parameters without performing authorization checks or WordPress nonce validation, turning the site's trusted mail infrastructure into an open relay. A publicly available exploit exists via WPScan; vendor-released patch 3.13.0 closes the gap.
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured order bump discount to any purchasable WooCommerce product rather than only the specific product the discount was intended for, causing the fraudulently reduced price to carry through to the completed order total. The vulnerability stems from absent server-side validation of the product-to-discount pairing during order bump processing, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available exploit exists via WPScan, and a vendor-released patch is available in version 3.13.0.
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remote attackers to register user accounts on sites where WordPress registration is explicitly disabled. The plugin trusts a client-supplied boolean in the opt-in form submission request rather than querying the server-side registration setting, making the site-level restriction trivially bypassable. This is an incomplete patch for CVE-2025-12353 - the fix applied in 3.6.3 closed only one of three registration code paths, leaving sites that updated to 3.6.3 through 3.12.x still vulnerable and falsely believing they were protected.
Improper access control in Dolibarr's Legacy File Manager connector allows any authenticated user - regardless of assigned module permissions - to access and interact with the medias directory. Affected versions span up to 21.0.4, 22.0.5, and 23.0.3. A public exploit exists via GitHub issue #38963, and the patch commit (ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec) confirms that the vulnerable file (htdocs/core/filemanagerdol/connectors/php/config.inc.php) entirely lacked an authorization gate, meaning even zero-privilege authenticated accounts could reach the file manager. No active exploitation (CISA KEV) has been confirmed.
Hard-coded SFTP credentials embedded in SmartIT Desktop Manager (by Lightstar) allow unauthenticated remote attackers to extract credentials from application source code and authenticate directly to the SmartIT Agent's SFTP service, enabling arbitrary file system browsing on the victim host. The vulnerability is CVSS 4.0-scored at 6.9 with no-privilege, network-accessible exploitation, though real-world impact is limited to read-only directory traversal rather than full compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken access control in the web management interface (wwwugw.cgi) of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote attacker holding only the low-privileged Standard role to change the password of arbitrary accounts, including administrative ones. Successful exploitation yields account takeover and, by resetting an administrator's credentials, effective full control of the gateway. No public exploit identified at time of analysis and EPSS probability is low (0.24%, 15th percentile); the flaw is not listed in CISA KEV, so real-world exploitation is not confirmed.
Authorization bypass in the light0011 cms PHP application allows unauthenticated remote attackers to circumvent access controls enforced by the Chapter Controller's initialization hook. The vulnerability resides in the `AuthController::_initialize` method within `App/Admin/Controller/ChapterController.class.php`, where the per-request authorization gate fails to enforce access control before handling chapter administration requests. Publicly available exploit code exists (confirmed by CVSS 4.0 E:P modifier), and the project maintainer has not responded to the responsible disclosure report, leaving the flaw unpatched.
Key-ID (kid) bypass in the jwcrypto Python JOSE library allows an attacker who holds any valid key within a JWK set to forge a General JSON Serialization JWS that satisfies verification for a different kid, effectively impersonating another tenant, user, or service. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 7-10, Red Hat OpenShift AI (RHOAI), and Red Hat OpenStack Platform 16.2, wherever jwcrypto performs JWS signature verification with kid-based authorization. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score is not provided, but the integrity impact is high for multi-tenant architectures.
Unauthenticated IDOR in the Business Directory WordPress plugin (versions <= 6.4.26) allows remote attackers to access or modify directory listing objects belonging to other users without authentication. The flaw stems from missing authorization checks on direct object references, enabling both unauthorized data reads and writes against business listing records. No public exploit code or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and low attack complexity lower the barrier to opportunistic exploitation.
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. The vendor CPE attributes this to Nexcess (cpe:2.3:a:nexcess:bookit). No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in FluentBooking Pro (WordPress plugin) versions 2.2.1 and earlier allows unauthenticated remote attackers to circumvent booking authentication controls and achieve high integrity impact. The vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), carries a network-accessible attack vector with high complexity (AC:H), meaning exploitation requires specific conditions to be met. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 5.9 Medium score reflects the AC:H constraint that limits mass exploitation risk.
WP EasyPay WordPress plugin versions up to and including 4.5.3 allow unauthenticated remote attackers to bypass access controls by manipulating web parameters the plugin treats as server-authoritative and immutable. The flaw (CWE-472) results in a low-level integrity impact - attackers can alter application state without credentials - but carries no confidentiality or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis, consistent with its Medium CVSS score of 5.3.
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint.
Unauthenticated authentication bypass in the Pre-Orders for WooCommerce WordPress plugin (versions <=2.3) allows remote attackers to spoof identity or session context and gain limited read and write access to pre-order functionality without credentials. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables network-accessible exploitation with no user interaction required, resulting in partial confidentiality and integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized write access to a MongoDB key vault collection allows an attacker to inject maliciously crafted key metadata into libmongocrypt, causing a legitimate authorized application client to issue arbitrary Google Cloud KMS API calls authenticated under the victim client's GCP identity. All versions of libmongocrypt are listed as affected via CPE wildcard (`cpe:2.3:a:mongodb:libmongocrypt:*`), with impact limited to deployments using MongoDB Client-Side Field Level Encryption (CSFLE) or Queryable Encryption configured with a Google Cloud KMS key provider. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Identity injection in Rancher Manager before 2.15.1 allows a privileged Rancher user to hijack any other user's account by overwriting immutable identity provider fields. The /v3/users update API failed to strip principalIds and username from update payloads, so a user holding the update verb on users.management.cattle.io could inject an external IdP principal they control into any target account. The next time the attacker authenticates via that injected IdP principal, Rancher binds the session to the victim's account and the attacker inherits all its role bindings. No public exploit is identified at time of analysis, and a vendor patch is available in version 2.15.1.
Unauthenticated access to the first-run Super-Admin bootstrap endpoint (/api/v1/bootstrap/setup) and all 17 admin/DPO console pages in tsi-coop tsi-dpdp-cms ≤0.5.0 allows remote attackers to claim full administrative control of any fresh or reset deployment and to retrieve page source containing internal API endpoints, function names, and request schemas. The root cause is CWE-306: console pages relied solely on client-side JavaScript redirects with no server-side session gate, and the bootstrap endpoint imposed no token or expiry requirement. A publicly available proof-of-concept exploit exists on GitHub; the vendor has released v0.5.1 which adds server-side session enforcement and a required deployment token.
Missing server-side authentication on all 17 admin and DPO compliance console pages in tsi-dpdp-cms ≤0.5.0 allows any unauthenticated network client to retrieve complete console page source, including internal API endpoint paths, function names, and request schemas. The root cause is exclusive reliance on client-side JavaScript redirects as the sole access gate - a plain curl request to any console URL receives full page content with no credentials. A public POC exploit exists on GitHub, and vendor-released patch v0.5.1 is available.
CRLF injection in httpx2 (pydantic's next-generation Python HTTP client) before v2.11.0 allows manipulation of multipart/form-data part headers when attacker-controlled data reaches the `content_type` or custom headers fields of the `files=` parameter. `FileField.render_headers()` in `_multipart.py` interpolates these values directly into raw header bytes without stripping CR or LF characters, enabling injection of fabricated headers into multipart parts. No public exploit is identified at time of analysis; the vendor-released patch is v2.11.0.
Base-path prefix bypass in Astro prior to 7.2.4 allows unauthenticated remote attackers to reach protected server-side routes by exploiting a missing path-segment boundary check in the framework's base-stripping logic. When a non-root base (e.g., '/app') is configured, a request to '/appX/admin' passes the router's prefix check and resolves to the internal '/admin' route while middleware still observes '/appX/admin' in context.url.pathname, causing pathname-based authorization rules to silently fail. Version 7.2.4 patches the flaw across all four affected subsystems; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Agent configuration takeover in Jenkins 2.579 and earlier allows an attacker holding Agent/Configure permission on any single agent to overwrite any other agent's configuration by embedding the target agent's name in a crafted XML document submitted to the REST API or CLI update endpoints. Successful exploitation grants the attacker full control of the victim agent's configuration and exposes its inbound agent secret and environment variables - primitives that enable agent impersonation and lateral movement within the CI/CD infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; patches are available as Jenkins 2.580 and LTS 2.568.3.
Incomplete credential cleanup in Elastic Cloud on Kubernetes (ECK Operator) allows a low-privileged tenant to retain unauthorized read access to an associated Elasticsearch cluster after a cross-namespace association attempt has been denied by Kubernetes RBAC enforcement. The root cause is CWE-459: when RBAC rejects the cross-namespace binding, ECK fails to revoke the authentication credentials it provisioned, leaving them valid and usable. With CVSS 3.5 and scope-changed vector (S:C), the vendor advisory ESA-2026-146 identifies the fix in ECK 3.5.0.
Unauthenticated information disclosure in the Wp Edit Password Protected WordPress plugin (before 1.3.5) exposes password-protected page and post content via the WordPress REST API. The plugin enforces content protection on standard page views but fails to apply the same restriction to REST API endpoints, allowing any remote unauthenticated requester to retrieve the full content of pages the site owner intended to keep gated behind a password. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV. The CVSS score of 5.3 reflects the limited scope - confidentiality only, no integrity or availability impact.
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attackers to access password-protected content by submitting crafted URLs that circumvent the plugin's site-wide protection checks. Because Passster's entire purpose is content gating, this vulnerability entirely nullifies the plugin's security guarantee for affected sites. A publicly available PoC exists, reported by WPScan, making automated scanning and exploitation straightforward.
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.
Unauthenticated information disclosure in the Notification Bar for WordPress plugin (through v1.1.8) allows any remote attacker to retrieve the full subscriber email list via an exposed CSV export script that performs no authentication or capability check. A publicly available proof-of-concept published by WPScan confirms trivial exploitation requiring only a single HTTP request. The vulnerability is not currently in CISA KEV, but the zero-friction exploitation path creates meaningful privacy and regulatory exposure (GDPR, CAN-SPAM) for any WordPress site running this plugin.
Unauthenticated attackers can bypass WordPress nonce validation in the HIPAA FORMS plugin (all versions before 3.2.0) by including a hardcoded parameter in any AJAX request, which causes the server to skip its nonce check entirely. Because the plugin handles HIPAA-regulated healthcare intake forms, this exposes protected AJAX endpoints to unauthorized read and write operations without any credentials. A public exploit is available via WPScan, and no exploitation complexity is required beyond knowledge of the hardcoded value.
Unauthenticated post creation and publication is possible in the User Frontend WordPress plugin before 4.3.11 due to a server-side enforcement gap in its subscription-gating logic. The plugin validates subscription status only at form-render time, not during form submission processing, so an attacker who bypasses the rendered form and submits directly to the backend endpoint can create - and depending on form configuration, immediately publish - posts that should be restricted to paying subscribers. A publicly available proof-of-concept exists and was disclosed through WPScan. No public exploit in CISA KEV at time of analysis.
Broken object-level authorization in the Timetics WordPress plugin through version 1.0.61 allows authenticated users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members via the REST API. The endpoint accepts appointment identifiers without validating ownership, enabling lateral privilege abuse among staff peers. A public WPScan PoC confirms exploitability, though real-world impact is bounded by the PR:H prerequisite of a pre-existing staff account.
The Drupal contributed module 'Disable Login Page' fails to fully suppress access to Drupal's login interface, allowing its security control to be bypassed via an alternate path or channel (CWE-288). Affected versions span 0.0.0 through 1.1.4 (exclusive), targeting Drupal sites that rely on this module to hide their login page - typically to enforce SSO or obscure attack surface. The vendor-assessed CVSS vector (PR:H, S:C, C:L) indicates scope change into Drupal core's login component, with low confidentiality exposure and no patch-related active exploitation identified; EPSS at 0.19% (9th percentile) reflects negligible current threat activity.
Authentication bypass in the Drupal CAPTCHA Protected Page contributed module (versions before 1.0.2) allows unauthenticated network attackers to access pages that should be gated behind a CAPTCHA challenge by using an alternate access path or channel that circumvents the protection logic. The confidentiality impact is limited - only the content of the CAPTCHA-protected pages is exposed, and the CVSS high-complexity rating indicates the bypass requires specific conditions to execute. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog. A vendor patch is available at version 1.0.2.
Unauthenticated IDOR in PublishPress Permissions WordPress plugin versions 4.8.3 and below allows remote attackers to access restricted content objects by manipulating user-controlled identifiers in requests. The flaw (CWE-639) bypasses the plugin's content access controls without any credentials, exposing data that should be permission-gated. CVSS 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability risk; no public exploit or KEV listing identified at time of analysis.
Account takeover in Keycloak's first-broker-login flow allows a network attacker with their own account on a social identity provider to hijack a victim's active account-linking session and bind their own social identity to the victim's local Keycloak profile. The verification proof generated during the social IdP linking handshake is not cryptographically bound to the specific upstream identity being verified, enabling a substitution attack that grants the attacker persistent authenticated access to the victim's local account and any downstream SSO-protected services. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated arbitrary file upload in Casdoor's /api/upload-resource endpoint (controllers/resource.go) exposes all versions through 4.0.0 to remote file-write with no authentication required. The CWE-306 flaw means any network-reachable attacker can deposit attacker-controlled content into the platform's resource storage without credentials or user interaction. A public proof-of-concept has been disclosed by researcher geo-chen; the vendor deleted the GitHub issue without comment and did not respond to coordinated disclosure email, leaving patch status unconfirmed.
Unauthenticated HMAC token forgery in WWBN AVideo through commit 9c39d8c8 exposes a cryptographic oracle via encryptPass.json.php, allowing any remote attacker to compute valid authentication tokens using only the publicly known site base URL as the HMAC key. The endpoint accepts arbitrary plaintext passwords and returns AVideo-formatted encrypted hashes, functioning as an unrestricted hash oracle that enables offline precomputation attacks - particularly dangerous when combined with a separately stolen AVideo credential database. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Header-value interpretation conflict in the Ruby mail gem (mikel/mail) before 2.9.1 allows remote attackers to craft malformed RFC 2047 encoded-words that cause Mail::Utilities.q_value_decode and b_value_decode to produce decoded From, To, and Reply-To values that differ materially from the raw wire values seen by human reviewers or downstream parsers. Because the old implementation used String#match with an overly greedy charset capture (.+? crossing ? delimiters) rather than a global gsub with a constrained character class, a single crafted encoded-word could swallow surrounding text, enabling apparent sender spoofing, phishing, and authorization-check bypass in any Ruby application relying on these decoded values for trust decisions. No public exploit or KEV listing is present at time of analysis, and the fix is confirmed in version 2.9.1.
Source address spoofing in HPE Networking Fabric Composer allows an authenticated low-privilege operator to forge the origin address recorded for their API requests, corrupting the audit trail for affected system actions. The attacker cannot read sensitive data or disrupt availability; the sole impact is integrity of attribution records, confirmed by the CVSS vector (C:N/I:L/A:N). No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Authenticated low-privilege information disclosure in HPE Networking Fabric Composer's API permits operator-level users to read system files outside their authorized scope. The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a bounded, post-authentication flaw with limited confidentiality impact. No public exploit code exists and the vulnerability is not listed in CISA KEV, placing real-world risk at low priority absent privileged insider threat scenarios.
HPE Networking Fabric Composer's API authentication controls can be circumvented by an already-authenticated low-privilege operator, allowing that user to retain access even after administrative revocation. This is an access-persistence flaw rather than an initial-access bypass - a direct insider-threat concern in environments that rely on Fabric Composer's own revocation mechanisms for offboarding or role changes. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Authenticated low-privilege API access in HPE Networking Fabric Composer allows operator-level users to retrieve sensitive data beyond their authorized scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms any valid operator account can exploit this over the network with no user interaction, obtaining high-confidentiality-impact data such as network topology, service credentials, or configuration details. Per the vendor advisory, the exfiltrated data could serve as a pivot to gain further unauthorized access to network services managed by Fabric Composer. No public exploit or CISA KEV listing is present at time of analysis.
Authentication bypass in HPE Networking Fabric Composer exposes enterprise network orchestration environments to unauthenticated administrative takeover by adjacent network actors. The vulnerability resides in the underlying operating system layer of the appliance, allowing an attacker with network adjacency to circumvent authentication controls without credentials, gaining full administrative access. Successful exploitation enables configuration tampering and sensitive data access or manipulation across the orchestration platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in Snipe-IT before v8.7.0 allows authenticated users holding only the `assets.edit` permission to restore soft-deleted assets via the bulk restore endpoint, directly reversing administrator deletions they are not authorized to undo. The `POST /hardware/bulkrestore` handler in `BulkAssetsController` incorrectly gated on `authorize('update', Asset::class)` rather than `authorize('delete', Asset::class)`, the check used by every other restore path in the codebase. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified, but the attack surface is any authenticated edit-permission holder in an affected deployment.
Directory namespace isolation failure in Erlang/OTP's inets httpd mod_auth module allows an authenticated low-privilege user to bypass access controls on protected directories they were never granted access to. Servers using dets or mnesia persistence backends with multiple directory configuration blocks across OTP 17.x through 29.x are affected, with patched releases available for all three supported branches. No active exploitation has been confirmed and no public exploit code exists at time of analysis, but the horizontal privilege escalation within a running inets instance poses a meaningful risk to any deployment using per-directory access tiering.
SAML Authentication bypass in Cleo Harmony versions up to 5.8.1.10 allows remote attackers with low-privilege access to manipulate the Email argument within the LocalUserUtil.getNativeUserByAssertions function, circumventing authentication controls and potentially impersonating other users. The flaw is classified as CWE-287 (Improper Authentication) and a public proof-of-concept has been disclosed. Vendor-released patch version 5.8.1.11 is available and upgrade is recommended.
Silent acceptance of malformed XML end tags in xmldom's DOMParser allows crafted input to bypass parse-before-trust well-formedness gates in security-sensitive Node.js applications. The flaw affects @xmldom/xmldom prior to 0.8.15 and 0.9.12, as well as all versions of the legacy xmldom package (0.6.0 and earlier), for which no patch exists. No public exploit has been identified at time of analysis, but the parser differential is exploitable in any pipeline - SAML processors, XML signature verifiers, API validators - that treats a clean xmldom parse as a validity certificate.
Unrestricted authentication attempts against Schneider Electric PowerChute™ Serial Shutdown expose user accounts to brute-force compromise when redirect handling is disabled in the application configuration. The absence of any rate-limiting or account-lockout mechanism (CWE-307) allows an attacker to submit unlimited credential-guessing requests over the network until valid credentials are found. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to manipulate the router's primary station list by sending a crafted MQTT message directly to the cs_broker component. The updatePriStaList function performs no authentication check before processing requests, enabling arbitrary refresh or overwrite of station associations. A proof-of-concept exists per SSVC assessment; the attack is automatable with no user interaction required.
Unauthenticated remote exploitation of the discoverWan function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes WAN configuration data through a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The CWE-284 (Improper Access Control) root cause means the CGI handler performs no authentication check before executing WAN discovery logic, returning configuration details to any network-reachable caller. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network exposure on consumer router hardware makes this a meaningful reconnaissance risk.
Administrator account takeover in the Simple Membership plugin for WordPress (versions up to and including 4.8.0) is achievable by unauthenticated remote attackers targeting WordPress Multisite networks with public registration enabled. The plugin's registration flow binds new membership records to existing global WordPress users using only username and email matching - no password or ownership proof - and fails to detect Administrator roles on child sites, allowing attackers to subsequently overwrite the victim's global WordPress password via the profile-edit feature. No public exploit has been identified at time of analysis, but the attack mechanics are low-complexity and the CVSS score of 5.3 severely understates the actual Administrator-level impact.
Authorization bypass in the Cozy Blocks WordPress plugin (all versions through 2.2.17) exposes WooCommerce product metadata intentionally hidden from the public - including names, prices, stock status, and image URLs of draft, pending, private, and catalog-hidden products - to unauthenticated visitors. The root cause is that multiple block renderers unconditionally emit a sidebarNonce into public page HTML regardless of visitor authentication state, allowing anyone to harvest a valid nonce and satisfy the AJAX handler's sole authorization check. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation mechanics are trivially simple given that the credential is embedded in publicly readable HTML.
Incorrect authorization in ash-project/ash (Elixir data framework) versions 3.13.2 through 3.32.1 causes relationship scoping filters that reference parent() expressions to silently widen when the parent field cannot be resolved. The function resolve_parent_in_filter/3 defaulted the unresolvable expression to nil rather than failing, converting a guard such as org_id == parent(org_id) into an org_id IS NULL match, or activating the unrestricted branch of is_nil(parent(org_id)) or org_id == parent(org_id), thereby returning records the scope was designed to exclude. No public exploit has been identified at time of analysis; a vendor-released patch is available in ash 3.32.2.
Ash.Reactor's ChangeStep component in the Elixir Ash framework silently bypasses security-relevant change operations when a `where` guard raises an exception, instead of halting the step with an error. Applications built on ash versions 3.0.0-rc.17 through 3.32.1 that use Ash.Reactor pipelines with `where`-gated changes are affected. An attacker who can supply crafted input triggering a guard exception may cause the guarded change to be silently skipped, potentially circumventing authentication, authorization, or mandatory data transformations depending on what that change enforces. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Type confusion in Ash Framework's union type storage allows attackers to persist a crafted map value whose data belongs to one union member but whose tag names a different member, bypassing that member's constraints and any tag-based authorization policies. Affected versions span ash 2.14.18 through 3.32.2 (exclusive). This exploits `Ash.Type.Union.dump_to_native/2` only when union fields are configured with `storage: :map_with_tag`, a non-default specialization. No public exploit is identified and the issue carries a very low CVSS 4.0 base score of 2.1, but the authentication bypass impact is notable in policy-sensitive applications.
Constraint bypass in ash_typescript typed-controller routes allows remote attackers to submit argument values outside declared allowlists or bounds by exploiting a missing validation step in the Ash type pipeline. Affected versions 0.15.0 through 0.17.x call Ash.Type.cast_input/3 but never invoke Ash.Type.apply_constraints/3, leaving constraints such as one_of, max_length, min, max, and match silently unenforced at runtime. Where these constraints gate role membership, status transitions, or other security-relevant decisions in the route handler, the bypass enables privilege escalation or state-machine abuse; a vendor-released patch is available in 0.18.0. No public exploit identified at time of analysis.
Unauthenticated firmware-flash triggering in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows network-accessible attackers to initiate a firmware re-flash cycle by sending crafted MQTT messages to the cs_broker component targeting the meshSlaveUpgfw handler, without any credentials. The root cause is a missing access-control check in the mesh slave upgrade function, enabling any caller on the MQTT network segment to invoke privileged firmware operations. No public exploit code has been identified and CISA SSVC rates exploitation as none with no current KEV listing, but the unauthenticated network vector represents a meaningful operational risk.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the updateLanIp function to arbitrary invocation by any attacker who can reach the router's MQTT broker. By publishing a crafted MQTT message to the cs_broker component, a remote unauthenticated attacker can force the device to refresh its LAN address state, enabling network disruption without any credentials. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the zero-authentication requirement materially lowers the exploitation bar.
Unauthenticated integrity manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to overwrite the master device's stored slave inventory records by sending crafted MQTT messages to the cs_broker component. The sendStaticInfoToMaster function performs no authentication or authorization check before processing incoming updates, exposing the internal device-management protocol to arbitrary writes. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to trigger the staticInfoSend function by sending a crafted MQTT message to the cs_broker component, causing the device to report its static configuration data to the configured master server. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Improper Authentication (CWE-287) in Dell Secure Connect Gateway (SCG) 5.0 enables a remote, low-privileged attacker to bypass protection mechanisms, potentially gaining access to sensitive telemetry or support data beyond their authorized scope. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are affected, as confirmed in Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis, but the network-accessible attack vector and low authentication bar make patching a clear priority.
Authentication bypass in the light0011 CMS Cookie Helper allows remote unauthenticated attackers to manipulate the Username argument in App/Home/Model/UserModel.class.php and impersonate arbitrary users without valid credentials. The vulnerability (CWE-287, Improper Authentication) affects all commits through at least c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930 of this PHP CMS. Publicly available exploit code exists; the project maintainer has not yet responded to disclosure, and no patch has been released.
Authentication bypass in Tenda AC9 firmware 15.03.05.14 allows unauthenticated remote attackers to circumvent the web management interface's R7WebsSecurityHandler authentication gating. Published PoC files demonstrate two concrete attack paths: unauthenticated product information disclosure via the getProduct endpoint and unauthenticated WiFi credential modification via the fast_setting_wifi_set endpoint. No public vendor patch has been identified, and exploit code is publicly available (CVSS 4.0 E:P).
Unauthenticated remote user deletion is possible in SourceCodester Simple Traffic Offense System 1.0 via the delete-user.php endpoint, which processes a user-supplied ID parameter without any session or privilege check. An attacker with HTTP access to the application can delete arbitrary user accounts without logging in, impacting data integrity and application availability. A publicly available proof-of-concept exploit exists on GitHub (no public exploit identified at time of analysis applies to KEV only - PoC is confirmed); the vulnerability is not listed in CISA KEV.
Missing authentication in SourceCodester Simple Traffic Offense System 1.0 allows unauthenticated remote attackers to create arbitrary user accounts by manipulating the `position` argument in `saveuser.php`. The user-creation endpoint fails to enforce any authentication gate (CWE-306), exposing it to direct network exploitation with no prerequisites. A public proof-of-concept exploit exists, raising the practical risk beyond what the moderate CVSS 4.0 score of 6.9 might suggest.
IP address spoofing via X-Forwarded-For header manipulation in PrestaShop's Tools::getRemoteAddr() function allows unauthenticated remote attackers to impersonate arbitrary IP addresses when the application runs behind a reverse proxy, load balancer, or CDN. Affected versions include PrestaShop branches prior to 9.1.5 and prior to 8.2.8. Exploitation enables bypassing IP-based access controls such as maintenance mode allowlists, forging security and audit log entries, and evading third-party mechanisms like geolocation restrictions, fraud detection systems, and request throttling. No public exploit code or active exploitation has been identified at time of analysis.
The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint by exploiting incorrect file path validation logic (CWE-73), causing the privileged service to load attacker-controlled VPN configurations. The impact is integrity-focused: a successful bypass enables substitution of legitimate VPN configuration with a malicious one, potentially redirecting traffic, disabling certificate validation, or weakening encryption enforced by an administrator. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is limited to the local Windows context.
Unauthenticated IDOR (Insecure Direct Object Reference) in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allows remote attackers to delete arbitrary exam records by manipulating the `ID` parameter in `delete_exam.php` without any authorization check. Any network-accessible attacker can iterate over exam IDs to destroy examination data belonging to other users or system administrators. A public proof-of-concept exploit has been disclosed on GitHub, lowering the bar for opportunistic abuse.
Hard-coded database credentials embedded in db.php of SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 allow unauthenticated remote attackers to obtain and reuse valid database credentials without any prior authentication. The credentials, baked directly into the PHP source file, are exposed to any party who can read or retrieve that file over the network. Publicly available exploit code has been published per the VulDB submission and a GitHub vulnerability report covering the same product, elevating this beyond a theoretical risk.
Missing authorization in projeto-siga Siga's authentication controller allows unauthenticated remote attackers to bypass access controls by manipulating the `cod` or `jwt` parameters submitted to the `ExAutenticacaoController.autenticar` function. Versions up to 11.0.2.10, 11.0.2.13, and 11.1.1 of this Brazilian judicial document management platform are affected. A proof-of-concept exploit has been publicly disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure at time of analysis.
Cookie validation key forgery in liufee FeehiCMS up to 2.1.1 allows unauthenticated remote attackers to craft arbitrary signed cookies by exploiting a hardcoded (or empty) `cookieValidationKey` in the production backend configuration file `environments/prod/backend/config/main-local.php`. Because FeehiCMS is built on the Yii2 framework, this key is used for HMAC-based cookie integrity verification; a known or empty key trivially breaks that guarantee, enabling session/cookie forgery that can lead to authentication bypass and backend access. A public proof-of-concept exploit exists (FEHI-003-Empty-cookieValidationKey), and no vendor patch has been issued despite responsible disclosure through a GitHub issue.
Authentication bypass in Mstfakts College-Management-System exposes the login endpoint at Front-end/login.php to manipulation of the email argument, enabling remote unauthenticated attackers to circumvent access controls entirely. A public proof-of-concept exploit has been disclosed (CVSS 4.0 E:P), and the project maintainer has not responded to the responsible disclosure report filed via GitHub. No patched release exists due to the rolling-release delivery model, leaving all current deployments without a vendor-supported fix.
Unauthorized role self-assignment in the B2BKing WooCommerce plugin before version 5.2.40 allows unauthenticated registrants to claim restricted B2B customer group memberships without admin approval by supplying arbitrary role parameters not bounded by server-side validation. The plugin fails to verify that a role submitted during account registration is actually one offered on the public registration form, enabling any user to bypass the manual account-approval workflow and gain access to wholesale pricing tiers or restricted catalogs. A publicly available proof-of-concept exists via WPScan, though no confirmed active exploitation has been identified in CISA KEV at time of analysis.
Unauthenticated account registration bypass in SureCart WordPress plugin before 4.7.0 allows remote attackers to create WordPress user accounts and obtain authenticated sessions even when the site administrator has explicitly disabled user registration. The plugin fails to consult WordPress's native `users_can_register` site option before processing account creation through its own checkout/registration flow. A publicly available proof-of-concept exists per WPScan, and a vendor patch is available in version 4.7.0. No confirmed active exploitation (CISA KEV) at time of analysis.
Hard-coded WPA passphrase in Tenda CP3 version 27.5.57.101 exposes the device's SoftAP (software access point) mode to unauthorized WiFi access by any party who possesses the fixed credential value embedded in custom-x/softap/hostapd. Because the passphrase is statically compiled into the hostapd configuration rather than randomly generated per device, all units running this firmware version share an identical WPA key. A public proof-of-concept has been disclosed per the CVSS 4.0 exploit maturity indicator (E:P), lowering the barrier for adversaries who identify target devices in range.
SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-authentication phase by triggering a client-requested rekey, causing the server to advance directly into the connection protocol and accept session channel and exec requests. The result is unauthenticated file creation, overwrite, and exfiltration within the RouterOS managed file namespace - including support bundles containing configuration and diagnostic data. Publicly available exploit code exists, CERT-PL has published dedicated research, and a companion CERT-PL post titled 'vulnerabilities-in-mikrotik-routeros-actively-exploited' suggests observed exploitation in the wild, though CISA KEV listing is not confirmed in the available data.
Unauthenticated form action execution in the Grav Form Plugin before 9.1.22 allows anonymous visitors to trigger save, upload, email, or call actions defined on login-restricted or unpublished pages. The plugin resolves forms by name across all pages without verifying whether the requesting user is authorized to access the page where the form is defined, so an attacker can POST to any public page while referencing a restricted form by name to bypass access controls entirely. No public exploit or CISA KEV listing has been identified, but the zero-authentication, network-accessible vector makes this trivially exploitable once form names are known.
Rate limiting in AVideo's API is completely nullified when requests include a bot User-Agent header, exposing all eight rate-protected operations - most critically the login endpoint - to unlimited brute-force attempts from a single IP address. An unauthenticated remote attacker who sets any bot User-Agent string can bypass the application's only credential-stuffing defense and attempt unlimited password guesses against any account. No active exploitation (CISA KEV) or public proof-of-concept code has been identified at time of analysis.
Missing authorization on the EmbedPress WordPress plugin's review-loading action (versions 4.6.0-4.6.3) permits unauthenticated remote attackers to abuse the site's stored third-party API credentials - triggering repeated billable API calls against the site owner's account - while simultaneously injecting an unbounded number of attacker-controlled rows into the WordPress database. A publicly available PoC exploit was documented by WPScan. Although EPSS probability is low (0.14%), SSVC rates the attack as automatable, making mass targeting of vulnerable WordPress deployments feasible with minimal tooling.
Unauthenticated access to the Backend Conversation API in ramon-victor/freegpt-webui allows remote attackers to invoke the `_conversation` function without valid credentials by manipulating the `model` argument in HTTP requests to `server/backend.py`. The affected codebase is a rolling-release hobby project that has been abandoned by its maintainer, meaning no patch will be issued. A public proof-of-concept exploit exists on GitHub, lowering the bar for exploitation against any instance still running.
Missing authentication in freegpt-webui's ChatCompletion.create function (g4f/__init__.py, up to commit 098db3dfeb41555c2ca9269df0f13e10ec1c35dc) permits unauthenticated remote callers to invoke AI chat completion requests directly against the backend providers without credentials. A public proof-of-concept is available on GitHub. The product is abandoned and no longer maintained, meaning no vendor patch will be issued, and remediation requires decommissioning or layered compensating controls.
Missing authentication on the admin WebSocket endpoint in trape 1.0.0 and 2.0 exposes operator tracking sessions to unauthenticated remote attackers. The `join_room` function in `core/sockets.py` performs no credential check before admitting a caller to the admin room, meaning any network-reachable party can connect to the socket and observe victim tracking data intended solely for the trape operator. A public exploit exists via a GitHub issue report; the project maintainer has not responded to the disclosure.
Unauthenticated access to the stats/login endpoint in jofpin trape 1.0.0 exposes collected tracking statistics to any remote party without credentials via the core/stats.py component. The missing authentication check (CWE-287) allows the statistics interface to be queried freely over the network, leaking data about tracked individuals - a meaningful privacy concern given trape's purpose as a people-tracking OSINT tool. A proof-of-concept exploit is publicly available, and the vendor has not responded to the GitHub issue report disclosing the flaw.
Remote authenticated attackers can bypass security restrictions in IBM i 7.3 through 7.6 by exploiting improper authentication logic during service-name matching (CWE-287). The flaw allows a low-privileged authenticated user to overstep their authorized service boundaries, achieving limited unauthorized reads and writes with no user interaction required. No public exploit code exists and this CVE does not appear in the CISA KEV catalog; IBM has released a patch via the support portal.
Security restriction bypass in IBM i versions 7.3, 7.4, 7.5, and 7.6 enables remote authenticated attackers to circumvent platform-level access controls by exploiting predictable server-generated seed values (CWE-330). The vulnerability stems from insufficient entropy in IBM i's seed generation process, allowing an attacker with a valid low-privilege account to predict protected values - such as session tokens, nonces, or challenge-response material - and leverage them to bypass enforced security boundaries. No public exploit code has been identified at time of analysis; a vendor-supplied patch is available through IBM's support portal.
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts When {de,en}crypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page containing the buffer is wholly owned by KVM, i.e. won't be concurrently allocated and accessed by other kernel code while KVM is using the buffer to {de,en}crypt memory. On SNP-enabled platforms, when sending SEV/SEV-ES commands that trigger firmware writes to memory, the to-be-written page(s) must be (temporarily) assigned to Firmware (as required by the SNP architecture, to guard against using such commands as gadgets to attack SNP guests). See snp_map_cmd_buf_desc() and friends. Unfortunately, transferring ownership of a page to Firmware makes the page inaccessible to software, and thus writes generate RMP #PF violations. If KVM uses a sub-page allocation for its temporary buffer, some other actor in the kernel can allocate and use the other portions of the page, and thus trigger unexpected (and seemingly spurious) RMP #PF violations due to software attempting to access a Firmware-owned page. BUG: unable to handle page fault for address: ffff906ae30f0300 #PF: supervisor write access in kernel mode #PF: error_code(0x80000003) - RMP violation PGD 6b1b80d067 P4D 6b1b80d067 PUD 100231e2063 PMD 10055a88063 PTE 80000100630f0163 SEV-SNP: PFN 0x100630f0 unassigned, dumping non-zero entries in 2M PFN region: [0x10063000 - 0x10063200] Oops: Oops: 0003 [#1] SMP CPU: 70 UID: 0 PID: 10658 Comm: svw_WaiterThrea Tainted: G U W O 7.1.0-smp--c22293789940-seanjc-next #1 PREEMPTLAZY Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026 RIP: 0010:memset+0xf/0x20 Call Trace: <TASK> __kvmalloc_node_noprof+0x2a4/0x710 do_getxattr+0x4e/0x130 path_getxattrat+0x125/0x1b0 do_syscall_64+0x10a/0x480 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f3a22cb6daa </TASK> Modules linked in: kvm_amd kvm irqbypass vfat fat ccp k10temp sha3 libsha3 i2c_piix4 gq(O) cdc_acm xhci_pci xhci_hcd gsmi: Log Shutdown Reason 0x03 CR2: ffff906ae30f0300 ---[ end trace 0000000000000000 ]--- RIP: 0010:memset+0xf/0x20 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x39e00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) gsmi: Log Shutdown Reason 0x02
IBM QRadar SIEM 7.5.0 through 7.5.0 UP15 Interim Fix 005 embeds hard-coded credentials - passwords or cryptographic keys - used for internal authentication, outbound component communication, or internal data encryption. A high-privileged local attacker who discovers and extracts these static credentials could leverage them to access protected internal services, decrypt stored security event data, or authenticate to downstream components without per-user authorization. IBM has issued a patch via advisory 7285277; no public exploit code or CISA KEV listing exists at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable DAX on new encrypted files Currently, when a new encrypted regular file is created, the call to ext4_set_inode_flags(inode, init=true) in __ext4_new_inode() is made before EXT4_INODE_ENCRYPT is set. As a result, it can set S_DAX if the filesystem is mounted with "-o dax=always". EXT4_INODE_ENCRYPT then actually gets set a bit later in __ext4_new_inode(), when it calls fscrypt_set_context() which calls ext4_set_context(). ext4_set_context() sets EXT4_INODE_ENCRYPT and calls ext4_set_inode_flags(inode, init=false) to set S_ENCRYPTED too. This was intended to clear S_DAX as well. However, this was broken by commit 043546e46dc7 ("fs/ext4: Only change S_DAX on inode load"). This causes data written to the file to bypass encryption, also causing xfstests failures such as generic/548 (when "-o dax=always" is used). Fix this by simplifying the flow by making __ext4_new_inode() set EXT4_INODE_ENCRYPT earlier. This makes it take effect in ext4_set_inode_flags(inode, init=true), making S_DAX never be set. Similarly, make EXT4_STATE_MAY_INLINE_DATA never be set in the first place on new encrypted inodes. Then it doesn't need to be cleared. As a result of these simplifications, ext4_set_context() no longer needs to change inode flags or state when 'handle != NULL'. Remove that too.
Arbitrary IDE configuration file writes in IBM Langflow OSS 1.0.0 through 1.11.2 are achievable by authenticated remote attackers who spoof the X-Forwarded-For HTTP header to impersonate a localhost connection, bypassing the platform's IP-based restriction on MCP (Model Context Protocol) server configuration installation. The direct impact is unauthorized writes to files such as ~/.cursor/mcp.json, which define MCP server endpoints loaded by AI-integrated IDEs; a malicious entry in these files can redirect the IDE to an attacker-controlled MCP server, enabling downstream code execution within the developer's environment. No public exploit has been identified at time of analysis; a vendor-released patch is available per IBM advisory 7285646.
Authorization bypass in phpMyFAQ before 4.1.8 allows unauthenticated network attackers to submit questions through the question/create API endpoint regardless of guest-restriction settings. The root cause is an incomplete two-setting access control check: isAddingQuestionsAllowed() enforces only the main.enableAskQuestions feature flag while silently ignoring the records.allowQuestionsForGuests restriction, nullifying administrator intent. The practical result is spam injection into the admin moderation queue; no code execution or data exfiltration is achievable through this path alone. No public exploit code has been identified at time of analysis.
mTLS certificate reuse in Checkmk before 2.5.0p10 enables a relay or push agent to authenticate against agent receiver endpoints using a peer component's certificate, provided both share the same UUID. The agent receiver endpoints fail to verify that a presented client certificate was issued by their own root CA, breaking the intended role-based trust boundary between relay and push agent components. No public exploit has been identified, and exploitation requires an attacker to already control one of the affected agent components (PR:L), limiting realistic risk despite the network-reachable vector.
Missing Authorization in MarketKing WordPress plugin (≤2.1.60) allows unauthenticated remote attackers to perform integrity-affecting actions by exploiting incorrectly configured access control security levels. The CVSS vector (PR:N/UI:N/AV:N) confirms no authentication or user interaction is required. No public exploit or CISA KEV listing identified at time of analysis; impact is limited to partial integrity (C:N/A:N) per CVSS.
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor to send emails from the affected site to arbitrary recipients with arbitrary subjects. The opt-in submission handler accepts notification recipients and email subject lines directly from HTTP request parameters without performing authorization checks or WordPress nonce validation, turning the site's trusted mail infrastructure into an open relay. A publicly available exploit exists via WPScan; vendor-released patch 3.13.0 closes the gap.
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured order bump discount to any purchasable WooCommerce product rather than only the specific product the discount was intended for, causing the fraudulently reduced price to carry through to the completed order total. The vulnerability stems from absent server-side validation of the product-to-discount pairing during order bump processing, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available exploit exists via WPScan, and a vendor-released patch is available in version 3.13.0.
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remote attackers to register user accounts on sites where WordPress registration is explicitly disabled. The plugin trusts a client-supplied boolean in the opt-in form submission request rather than querying the server-side registration setting, making the site-level restriction trivially bypassable. This is an incomplete patch for CVE-2025-12353 - the fix applied in 3.6.3 closed only one of three registration code paths, leaving sites that updated to 3.6.3 through 3.12.x still vulnerable and falsely believing they were protected.
Improper access control in Dolibarr's Legacy File Manager connector allows any authenticated user - regardless of assigned module permissions - to access and interact with the medias directory. Affected versions span up to 21.0.4, 22.0.5, and 23.0.3. A public exploit exists via GitHub issue #38963, and the patch commit (ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec) confirms that the vulnerable file (htdocs/core/filemanagerdol/connectors/php/config.inc.php) entirely lacked an authorization gate, meaning even zero-privilege authenticated accounts could reach the file manager. No active exploitation (CISA KEV) has been confirmed.
Hard-coded SFTP credentials embedded in SmartIT Desktop Manager (by Lightstar) allow unauthenticated remote attackers to extract credentials from application source code and authenticate directly to the SmartIT Agent's SFTP service, enabling arbitrary file system browsing on the victim host. The vulnerability is CVSS 4.0-scored at 6.9 with no-privilege, network-accessible exploitation, though real-world impact is limited to read-only directory traversal rather than full compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Broken access control in the web management interface (wwwugw.cgi) of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote attacker holding only the low-privileged Standard role to change the password of arbitrary accounts, including administrative ones. Successful exploitation yields account takeover and, by resetting an administrator's credentials, effective full control of the gateway. No public exploit identified at time of analysis and EPSS probability is low (0.24%, 15th percentile); the flaw is not listed in CISA KEV, so real-world exploitation is not confirmed.
Authorization bypass in the light0011 cms PHP application allows unauthenticated remote attackers to circumvent access controls enforced by the Chapter Controller's initialization hook. The vulnerability resides in the `AuthController::_initialize` method within `App/Admin/Controller/ChapterController.class.php`, where the per-request authorization gate fails to enforce access control before handling chapter administration requests. Publicly available exploit code exists (confirmed by CVSS 4.0 E:P modifier), and the project maintainer has not responded to the responsible disclosure report, leaving the flaw unpatched.
Key-ID (kid) bypass in the jwcrypto Python JOSE library allows an attacker who holds any valid key within a JWK set to forge a General JSON Serialization JWS that satisfies verification for a different kid, effectively impersonating another tenant, user, or service. Affected deployments include Red Hat Ansible Automation Platform 2, RHEL 7-10, Red Hat OpenShift AI (RHOAI), and Red Hat OpenStack Platform 16.2, wherever jwcrypto performs JWS signature verification with kid-based authorization. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS score is not provided, but the integrity impact is high for multi-tenant architectures.
Unauthenticated IDOR in the Business Directory WordPress plugin (versions <= 6.4.26) allows remote attackers to access or modify directory listing objects belonging to other users without authentication. The flaw stems from missing authorization checks on direct object references, enabling both unauthorized data reads and writes against business listing records. No public exploit code or CISA KEV listing is identified at time of analysis, but the unauthenticated network vector and low attack complexity lower the barrier to opportunistic exploitation.
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. The vendor CPE attributes this to Nexcess (cpe:2.3:a:nexcess:bookit). No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in FluentBooking Pro (WordPress plugin) versions 2.2.1 and earlier allows unauthenticated remote attackers to circumvent booking authentication controls and achieve high integrity impact. The vulnerability, classified as CWE-290 (Authentication Bypass by Spoofing), carries a network-accessible attack vector with high complexity (AC:H), meaning exploitation requires specific conditions to be met. No public exploit or active exploitation has been identified at time of analysis, and the CVSS 5.9 Medium score reflects the AC:H constraint that limits mass exploitation risk.
WP EasyPay WordPress plugin versions up to and including 4.5.3 allow unauthenticated remote attackers to bypass access controls by manipulating web parameters the plugin treats as server-authoritative and immutable. The flaw (CWE-472) results in a low-level integrity impact - attackers can alter application state without credentials - but carries no confidentiality or availability consequence. No public exploit code and no CISA KEV listing have been identified at time of analysis, consistent with its Medium CVSS score of 5.3.
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint.
Unauthenticated authentication bypass in the Pre-Orders for WooCommerce WordPress plugin (versions <=2.3) allows remote attackers to spoof identity or session context and gain limited read and write access to pre-order functionality without credentials. Classified under CWE-290 (Authentication Bypass by Spoofing), the flaw enables network-accessible exploitation with no user interaction required, resulting in partial confidentiality and integrity impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized write access to a MongoDB key vault collection allows an attacker to inject maliciously crafted key metadata into libmongocrypt, causing a legitimate authorized application client to issue arbitrary Google Cloud KMS API calls authenticated under the victim client's GCP identity. All versions of libmongocrypt are listed as affected via CPE wildcard (`cpe:2.3:a:mongodb:libmongocrypt:*`), with impact limited to deployments using MongoDB Client-Side Field Level Encryption (CSFLE) or Queryable Encryption configured with a Google Cloud KMS key provider. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Identity injection in Rancher Manager before 2.15.1 allows a privileged Rancher user to hijack any other user's account by overwriting immutable identity provider fields. The /v3/users update API failed to strip principalIds and username from update payloads, so a user holding the update verb on users.management.cattle.io could inject an external IdP principal they control into any target account. The next time the attacker authenticates via that injected IdP principal, Rancher binds the session to the victim's account and the attacker inherits all its role bindings. No public exploit is identified at time of analysis, and a vendor patch is available in version 2.15.1.
Unauthenticated access to the first-run Super-Admin bootstrap endpoint (/api/v1/bootstrap/setup) and all 17 admin/DPO console pages in tsi-coop tsi-dpdp-cms ≤0.5.0 allows remote attackers to claim full administrative control of any fresh or reset deployment and to retrieve page source containing internal API endpoints, function names, and request schemas. The root cause is CWE-306: console pages relied solely on client-side JavaScript redirects with no server-side session gate, and the bootstrap endpoint imposed no token or expiry requirement. A publicly available proof-of-concept exploit exists on GitHub; the vendor has released v0.5.1 which adds server-side session enforcement and a required deployment token.
Missing server-side authentication on all 17 admin and DPO compliance console pages in tsi-dpdp-cms ≤0.5.0 allows any unauthenticated network client to retrieve complete console page source, including internal API endpoint paths, function names, and request schemas. The root cause is exclusive reliance on client-side JavaScript redirects as the sole access gate - a plain curl request to any console URL receives full page content with no credentials. A public POC exploit exists on GitHub, and vendor-released patch v0.5.1 is available.
CRLF injection in httpx2 (pydantic's next-generation Python HTTP client) before v2.11.0 allows manipulation of multipart/form-data part headers when attacker-controlled data reaches the `content_type` or custom headers fields of the `files=` parameter. `FileField.render_headers()` in `_multipart.py` interpolates these values directly into raw header bytes without stripping CR or LF characters, enabling injection of fabricated headers into multipart parts. No public exploit is identified at time of analysis; the vendor-released patch is v2.11.0.
Base-path prefix bypass in Astro prior to 7.2.4 allows unauthenticated remote attackers to reach protected server-side routes by exploiting a missing path-segment boundary check in the framework's base-stripping logic. When a non-root base (e.g., '/app') is configured, a request to '/appX/admin' passes the router's prefix check and resolves to the internal '/admin' route while middleware still observes '/appX/admin' in context.url.pathname, causing pathname-based authorization rules to silently fail. Version 7.2.4 patches the flaw across all four affected subsystems; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Agent configuration takeover in Jenkins 2.579 and earlier allows an attacker holding Agent/Configure permission on any single agent to overwrite any other agent's configuration by embedding the target agent's name in a crafted XML document submitted to the REST API or CLI update endpoints. Successful exploitation grants the attacker full control of the victim agent's configuration and exposes its inbound agent secret and environment variables - primitives that enable agent impersonation and lateral movement within the CI/CD infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis; patches are available as Jenkins 2.580 and LTS 2.568.3.
Incomplete credential cleanup in Elastic Cloud on Kubernetes (ECK Operator) allows a low-privileged tenant to retain unauthorized read access to an associated Elasticsearch cluster after a cross-namespace association attempt has been denied by Kubernetes RBAC enforcement. The root cause is CWE-459: when RBAC rejects the cross-namespace binding, ECK fails to revoke the authentication credentials it provisioned, leaving them valid and usable. With CVSS 3.5 and scope-changed vector (S:C), the vendor advisory ESA-2026-146 identifies the fix in ECK 3.5.0.
Unauthenticated information disclosure in the Wp Edit Password Protected WordPress plugin (before 1.3.5) exposes password-protected page and post content via the WordPress REST API. The plugin enforces content protection on standard page views but fails to apply the same restriction to REST API endpoints, allowing any remote unauthenticated requester to retrieve the full content of pages the site owner intended to keep gated behind a password. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV. The CVSS score of 5.3 reflects the limited scope - confidentiality only, no integrity or availability impact.
Global protection bypass in the Passster WordPress plugin (versions before 4.2.26) allows unauthenticated remote attackers to access password-protected content by submitting crafted URLs that circumvent the plugin's site-wide protection checks. Because Passster's entire purpose is content gating, this vulnerability entirely nullifies the plugin's security guarantee for affected sites. A publicly available PoC exists, reported by WPScan, making automated scanning and exploitation straightforward.
Unauthenticated information disclosure in the Passster WordPress plugin (versions before 4.2.24) allows remote attackers to retrieve the values of password-protected content via an improperly handled AJAX action. Because Passster's sole function is gating content behind passwords, this flaw entirely negates its intended protection guarantee. A public exploit is available via WPScan, and the zero-prerequisite attack vector makes this trivially exploitable against any affected installation.
Unauthenticated information disclosure in the Notification Bar for WordPress plugin (through v1.1.8) allows any remote attacker to retrieve the full subscriber email list via an exposed CSV export script that performs no authentication or capability check. A publicly available proof-of-concept published by WPScan confirms trivial exploitation requiring only a single HTTP request. The vulnerability is not currently in CISA KEV, but the zero-friction exploitation path creates meaningful privacy and regulatory exposure (GDPR, CAN-SPAM) for any WordPress site running this plugin.
Unauthenticated attackers can bypass WordPress nonce validation in the HIPAA FORMS plugin (all versions before 3.2.0) by including a hardcoded parameter in any AJAX request, which causes the server to skip its nonce check entirely. Because the plugin handles HIPAA-regulated healthcare intake forms, this exposes protected AJAX endpoints to unauthorized read and write operations without any credentials. A public exploit is available via WPScan, and no exploitation complexity is required beyond knowledge of the hardcoded value.
Unauthenticated post creation and publication is possible in the User Frontend WordPress plugin before 4.3.11 due to a server-side enforcement gap in its subscription-gating logic. The plugin validates subscription status only at form-render time, not during form submission processing, so an attacker who bypasses the rendered form and submits directly to the backend endpoint can create - and depending on form configuration, immediately publish - posts that should be restricted to paying subscribers. A publicly available proof-of-concept exists and was disclosed through WPScan. No public exploit in CISA KEV at time of analysis.
Broken object-level authorization in the Timetics WordPress plugin through version 1.0.61 allows authenticated users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members via the REST API. The endpoint accepts appointment identifiers without validating ownership, enabling lateral privilege abuse among staff peers. A public WPScan PoC confirms exploitability, though real-world impact is bounded by the PR:H prerequisite of a pre-existing staff account.
The Drupal contributed module 'Disable Login Page' fails to fully suppress access to Drupal's login interface, allowing its security control to be bypassed via an alternate path or channel (CWE-288). Affected versions span 0.0.0 through 1.1.4 (exclusive), targeting Drupal sites that rely on this module to hide their login page - typically to enforce SSO or obscure attack surface. The vendor-assessed CVSS vector (PR:H, S:C, C:L) indicates scope change into Drupal core's login component, with low confidentiality exposure and no patch-related active exploitation identified; EPSS at 0.19% (9th percentile) reflects negligible current threat activity.
Authentication bypass in the Drupal CAPTCHA Protected Page contributed module (versions before 1.0.2) allows unauthenticated network attackers to access pages that should be gated behind a CAPTCHA challenge by using an alternate access path or channel that circumvents the protection logic. The confidentiality impact is limited - only the content of the CAPTCHA-protected pages is exposed, and the CVSS high-complexity rating indicates the bypass requires specific conditions to execute. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog. A vendor patch is available at version 1.0.2.
Unauthenticated IDOR in PublishPress Permissions WordPress plugin versions 4.8.3 and below allows remote attackers to access restricted content objects by manipulating user-controlled identifiers in requests. The flaw (CWE-639) bypasses the plugin's content access controls without any credentials, exposing data that should be permission-gated. CVSS 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability risk; no public exploit or KEV listing identified at time of analysis.
Account takeover in Keycloak's first-broker-login flow allows a network attacker with their own account on a social identity provider to hijack a victim's active account-linking session and bind their own social identity to the victim's local Keycloak profile. The verification proof generated during the social IdP linking handshake is not cryptographically bound to the specific upstream identity being verified, enabling a substitution attack that grants the attacker persistent authenticated access to the victim's local account and any downstream SSO-protected services. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated arbitrary file upload in Casdoor's /api/upload-resource endpoint (controllers/resource.go) exposes all versions through 4.0.0 to remote file-write with no authentication required. The CWE-306 flaw means any network-reachable attacker can deposit attacker-controlled content into the platform's resource storage without credentials or user interaction. A public proof-of-concept has been disclosed by researcher geo-chen; the vendor deleted the GitHub issue without comment and did not respond to coordinated disclosure email, leaving patch status unconfirmed.
Unauthenticated HMAC token forgery in WWBN AVideo through commit 9c39d8c8 exposes a cryptographic oracle via encryptPass.json.php, allowing any remote attacker to compute valid authentication tokens using only the publicly known site base URL as the HMAC key. The endpoint accepts arbitrary plaintext passwords and returns AVideo-formatted encrypted hashes, functioning as an unrestricted hash oracle that enables offline precomputation attacks - particularly dangerous when combined with a separately stolen AVideo credential database. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Header-value interpretation conflict in the Ruby mail gem (mikel/mail) before 2.9.1 allows remote attackers to craft malformed RFC 2047 encoded-words that cause Mail::Utilities.q_value_decode and b_value_decode to produce decoded From, To, and Reply-To values that differ materially from the raw wire values seen by human reviewers or downstream parsers. Because the old implementation used String#match with an overly greedy charset capture (.+? crossing ? delimiters) rather than a global gsub with a constrained character class, a single crafted encoded-word could swallow surrounding text, enabling apparent sender spoofing, phishing, and authorization-check bypass in any Ruby application relying on these decoded values for trust decisions. No public exploit or KEV listing is present at time of analysis, and the fix is confirmed in version 2.9.1.
Source address spoofing in HPE Networking Fabric Composer allows an authenticated low-privilege operator to forge the origin address recorded for their API requests, corrupting the audit trail for affected system actions. The attacker cannot read sensitive data or disrupt availability; the sole impact is integrity of attribution records, confirmed by the CVSS vector (C:N/I:L/A:N). No public exploit has been identified and this CVE is not listed in the CISA KEV catalog.
Authenticated low-privilege information disclosure in HPE Networking Fabric Composer's API permits operator-level users to read system files outside their authorized scope. The CVSS 4.3 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a bounded, post-authentication flaw with limited confidentiality impact. No public exploit code exists and the vulnerability is not listed in CISA KEV, placing real-world risk at low priority absent privileged insider threat scenarios.
HPE Networking Fabric Composer's API authentication controls can be circumvented by an already-authenticated low-privilege operator, allowing that user to retain access even after administrative revocation. This is an access-persistence flaw rather than an initial-access bypass - a direct insider-threat concern in environments that rely on Fabric Composer's own revocation mechanisms for offboarding or role changes. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Authenticated low-privilege API access in HPE Networking Fabric Composer allows operator-level users to retrieve sensitive data beyond their authorized scope. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms any valid operator account can exploit this over the network with no user interaction, obtaining high-confidentiality-impact data such as network topology, service credentials, or configuration details. Per the vendor advisory, the exfiltrated data could serve as a pivot to gain further unauthorized access to network services managed by Fabric Composer. No public exploit or CISA KEV listing is present at time of analysis.
Authentication bypass in HPE Networking Fabric Composer exposes enterprise network orchestration environments to unauthenticated administrative takeover by adjacent network actors. The vulnerability resides in the underlying operating system layer of the appliance, allowing an attacker with network adjacency to circumvent authentication controls without credentials, gaining full administrative access. Successful exploitation enables configuration tampering and sensitive data access or manipulation across the orchestration platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
Broken access control in Snipe-IT before v8.7.0 allows authenticated users holding only the `assets.edit` permission to restore soft-deleted assets via the bulk restore endpoint, directly reversing administrator deletions they are not authorized to undo. The `POST /hardware/bulkrestore` handler in `BulkAssetsController` incorrectly gated on `authorize('update', Asset::class)` rather than `authorize('delete', Asset::class)`, the check used by every other restore path in the codebase. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified, but the attack surface is any authenticated edit-permission holder in an affected deployment.
Directory namespace isolation failure in Erlang/OTP's inets httpd mod_auth module allows an authenticated low-privilege user to bypass access controls on protected directories they were never granted access to. Servers using dets or mnesia persistence backends with multiple directory configuration blocks across OTP 17.x through 29.x are affected, with patched releases available for all three supported branches. No active exploitation has been confirmed and no public exploit code exists at time of analysis, but the horizontal privilege escalation within a running inets instance poses a meaningful risk to any deployment using per-directory access tiering.
SAML Authentication bypass in Cleo Harmony versions up to 5.8.1.10 allows remote attackers with low-privilege access to manipulate the Email argument within the LocalUserUtil.getNativeUserByAssertions function, circumventing authentication controls and potentially impersonating other users. The flaw is classified as CWE-287 (Improper Authentication) and a public proof-of-concept has been disclosed. Vendor-released patch version 5.8.1.11 is available and upgrade is recommended.
Silent acceptance of malformed XML end tags in xmldom's DOMParser allows crafted input to bypass parse-before-trust well-formedness gates in security-sensitive Node.js applications. The flaw affects @xmldom/xmldom prior to 0.8.15 and 0.9.12, as well as all versions of the legacy xmldom package (0.6.0 and earlier), for which no patch exists. No public exploit has been identified at time of analysis, but the parser differential is exploitable in any pipeline - SAML processors, XML signature verifiers, API validators - that treats a clean xmldom parse as a validity certificate.
Unrestricted authentication attempts against Schneider Electric PowerChute™ Serial Shutdown expose user accounts to brute-force compromise when redirect handling is disabled in the application configuration. The absence of any rate-limiting or account-lockout mechanism (CWE-307) allows an attacker to submit unlimited credential-guessing requests over the network until valid credentials are found. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows remote attackers to manipulate the router's primary station list by sending a crafted MQTT message directly to the cs_broker component. The updatePriStaList function performs no authentication check before processing requests, enabling arbitrary refresh or overwrite of station associations. A proof-of-concept exists per SSVC assessment; the attack is automatable with no user interaction required.
Unauthenticated remote exploitation of the discoverWan function in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes WAN configuration data through a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint. The CWE-284 (Improper Access Control) root cause means the CGI handler performs no authentication check before executing WAN discovery logic, returning configuration details to any network-reachable caller. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network exposure on consumer router hardware makes this a meaningful reconnaissance risk.
Administrator account takeover in the Simple Membership plugin for WordPress (versions up to and including 4.8.0) is achievable by unauthenticated remote attackers targeting WordPress Multisite networks with public registration enabled. The plugin's registration flow binds new membership records to existing global WordPress users using only username and email matching - no password or ownership proof - and fails to detect Administrator roles on child sites, allowing attackers to subsequently overwrite the victim's global WordPress password via the profile-edit feature. No public exploit has been identified at time of analysis, but the attack mechanics are low-complexity and the CVSS score of 5.3 severely understates the actual Administrator-level impact.
Authorization bypass in the Cozy Blocks WordPress plugin (all versions through 2.2.17) exposes WooCommerce product metadata intentionally hidden from the public - including names, prices, stock status, and image URLs of draft, pending, private, and catalog-hidden products - to unauthenticated visitors. The root cause is that multiple block renderers unconditionally emit a sidebarNonce into public page HTML regardless of visitor authentication state, allowing anyone to harvest a valid nonce and satisfy the AJAX handler's sole authorization check. No public exploit code or CISA KEV listing has been identified at time of analysis, though exploitation mechanics are trivially simple given that the credential is embedded in publicly readable HTML.
Incorrect authorization in ash-project/ash (Elixir data framework) versions 3.13.2 through 3.32.1 causes relationship scoping filters that reference parent() expressions to silently widen when the parent field cannot be resolved. The function resolve_parent_in_filter/3 defaulted the unresolvable expression to nil rather than failing, converting a guard such as org_id == parent(org_id) into an org_id IS NULL match, or activating the unrestricted branch of is_nil(parent(org_id)) or org_id == parent(org_id), thereby returning records the scope was designed to exclude. No public exploit has been identified at time of analysis; a vendor-released patch is available in ash 3.32.2.
Ash.Reactor's ChangeStep component in the Elixir Ash framework silently bypasses security-relevant change operations when a `where` guard raises an exception, instead of halting the step with an error. Applications built on ash versions 3.0.0-rc.17 through 3.32.1 that use Ash.Reactor pipelines with `where`-gated changes are affected. An attacker who can supply crafted input triggering a guard exception may cause the guarded change to be silently skipped, potentially circumventing authentication, authorization, or mandatory data transformations depending on what that change enforces. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Type confusion in Ash Framework's union type storage allows attackers to persist a crafted map value whose data belongs to one union member but whose tag names a different member, bypassing that member's constraints and any tag-based authorization policies. Affected versions span ash 2.14.18 through 3.32.2 (exclusive). This exploits `Ash.Type.Union.dump_to_native/2` only when union fields are configured with `storage: :map_with_tag`, a non-default specialization. No public exploit is identified and the issue carries a very low CVSS 4.0 base score of 2.1, but the authentication bypass impact is notable in policy-sensitive applications.
Constraint bypass in ash_typescript typed-controller routes allows remote attackers to submit argument values outside declared allowlists or bounds by exploiting a missing validation step in the Ash type pipeline. Affected versions 0.15.0 through 0.17.x call Ash.Type.cast_input/3 but never invoke Ash.Type.apply_constraints/3, leaving constraints such as one_of, max_length, min, max, and match silently unenforced at runtime. Where these constraints gate role membership, status transitions, or other security-relevant decisions in the route handler, the bypass enables privilege escalation or state-machine abuse; a vendor-released patch is available in 0.18.0. No public exploit identified at time of analysis.
Unauthenticated firmware-flash triggering in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows network-accessible attackers to initiate a firmware re-flash cycle by sending crafted MQTT messages to the cs_broker component targeting the meshSlaveUpgfw handler, without any credentials. The root cause is a missing access-control check in the mesh slave upgrade function, enabling any caller on the MQTT network segment to invoke privileged firmware operations. No public exploit code has been identified and CISA SSVC rates exploitation as none with no current KEV listing, but the unauthenticated network vector represents a meaningful operational risk.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 exposes the updateLanIp function to arbitrary invocation by any attacker who can reach the router's MQTT broker. By publishing a crafted MQTT message to the cs_broker component, a remote unauthenticated attacker can force the device to refresh its LAN address state, enabling network disruption without any credentials. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the zero-authentication requirement materially lowers the exploitation bar.
Unauthenticated integrity manipulation in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to overwrite the master device's stored slave inventory records by sending crafted MQTT messages to the cs_broker component. The sendStaticInfoToMaster function performs no authentication or authorization check before processing incoming updates, exposing the internal device-management protocol to arbitrary writes. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated access control bypass in TOTOLINK T6 firmware 4.1.5cu.748_B20211015 allows any network-accessible attacker to trigger the staticInfoSend function by sending a crafted MQTT message to the cs_broker component, causing the device to report its static configuration data to the configured master server. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.