Information Disclosure

Session hijacking in PHPGurukul Student Result Management System v2.0 stems from the /srms/change-password.php component failing to invalidate existing sessions after a password change, so an attacker holding a previously captured session token retains authenticated access even after the victim rotates their credentials. Publicly available exploit code exists on GitHub, though the flaw is not listed in CISA KEV and carries a modest EPSS score of 0.62% (45th percentile), indicating low observed exploitation activity. The vulnerability primarily undermines the account-recovery security guarantee that changing a password should terminate compromised sessions.

Session hijacking in PHPGurukul Online Library Management System v3.0 stems from improper session invalidation in /library/change-password.php, where sessions are not properly terminated after credential changes, allowing an attacker who obtains or reuses a still-valid session token to impersonate a victim. Publicly available exploit code exists (GitHub, VasilVK), though there is no public exploit identified as actively exploited in the wild and it is not listed in CISA KEV. EPSS is low at 0.39% (31st percentile), indicating limited predicted mass-exploitation activity despite the available POC.

Session hijacking in PHPGurukul Car Washing Management System v1.0 allows attackers to retain or reuse a doctor account session because the /doctor/change-password.php component fails to invalidate existing sessions after a credential change, publicly available exploit code exists (per the referenced GitHub PoC), though EPSS estimates only a 0.50% exploitation probability and the issue is not on CISA KEV. No public exploit identified as actively used in the wild; the flaw affects only the single unpatched v1.0 release of this niche PHP application.

Session hijacking in PHPGurukul Doctor Appointment Management System v1.0.0 stems from improper session invalidation in /doctor/change-password.php, where doctor account sessions are not terminated after a password change. A publicly available exploit code exists (GitHub, VasilVK), but there is no public exploit identified as actively exploited and it is not in CISA KEV. EPSS is low at 0.41% (33rd percentile), indicating limited real-world exploitation interest to date.

Session hijacking in PHPGurukul Student Result Management System v2.0 stems from improper session invalidation in the employee change-password handler (/elms/emp-changepassword.php), letting attackers reuse session tokens that should have been terminated to take over an authenticated account. A public proof-of-concept exists (VasilVK GitHub), but there is no public exploit identified as actively exploited; EPSS is low at 0.52% (40th percentile) and it is not on CISA KEV. This is a niche PHP educational application, so real-world exposure is limited despite the network-facing nature of the flaw.

Improper export of Android application components in bsc Peru Cocktails App 1.0.0 allows local authenticated attackers to access unexported activities, services, or broadcast receivers defined in AndroidManifest.xml, leading to information disclosure. The vulnerability has been publicly disclosed with exploit code available, though real-world risk is minimal given the low CVSS score (1.9) and EPSS exploitation probability (0.02%), indicating this affects only authenticated users with local device access and results in limited confidentiality impact.

Privilege escalation in Beamsec PhishPro before version 7.5.4.2 allows authenticated low-privileged users to abuse privileged API calls, resulting in full confidentiality, integrity, and availability compromise (CVSS 8.8). The root cause is CWE-648 (Incorrect Use of Privileged APIs), meaning the application exposes or incorrectly gates privileged API operations that low-privileged users can invoke directly. No public exploit exists at time of analysis, and EPSS sits at 0.25% (49th percentile), but the network-accessible, low-complexity attack path warrants prioritized remediation for any internet-facing PhishPro deployment.

A race condition in the Linux kernel's MPTCP (Multipath TCP) protocol implementation allows local attackers with limited privileges to trigger a kernel warning and denial of service by causing non-atomic fallback decisions and actions during connection establishment. The vulnerability (CWE-667: Improper Locking) arises from unsynchronized access to fallback state in mptcp_do_fallback() when processing incoming TCP options, enabling a local user to crash the system or hang connections via crafted MPTCP packets. EPSS score of 0.03% indicates low real-world exploitation probability despite moderate CVSS impact severity.

A race condition in the Linux kernel's net/sched sch_qfq module allows local authenticated attackers to cause denial of service through NULL pointer dereference or use-after-free errors when concurrent threads modify queue aggregation structures during packet scheduling. The vulnerability requires low privileges and has a low real-world exploitation probability (EPSS 0.02%), though a vendor patch is available.

Use-after-free in Linux kernel TLS implementation allows local authenticated users to achieve high confidentiality, integrity, and availability impact through memory corruption. The vulnerability, triggered by aggressive TCP SKB compaction in net-next, causes TLS to operate on freed socket buffers when checking decrypt state. A vendor patch is available across multiple kernel versions (6.1-rc2 through 6.1-rc5 and later stable branches). No active exploitation confirmed, but CWE-416 use-after-free bugs are frequently targeted due to their code execution potential. EPSS data not provided.

Memory leak and refcount imbalance in Linux kernel VLAN 0 handling allows local attackers with low privileges to trigger denial of service via kernel panic when toggling the rx-vlan-filter feature at runtime on bonded or team interfaces. The vulnerability affects kernel versions 6.16-rc1 through rc3 and potentially earlier versions; vendor-released patches are available across affected stable branches.

Improper authorization in Vaelsys VaelsysV4 4.1.0 exposes the User Creation Handler at /grid/vgrid_server.php to potential unauthorized user creation via remote network requests. A publicly available proof-of-concept demonstrates the technique, though the vendor formally disputes the finding, asserting the endpoint enforces authenticated administrative context and no unauthorized escalation is possible. EPSS stands at 0.12% (30th percentile), no CISA KEV listing exists, and the real-world exploitability remains contested - making this a low-confidence finding that nonetheless warrants verification by affected operators.

Weak cryptographic hashing (CWE-327) in VaelsysV4's PHP web interface exposes sensitive information to authenticated remote attackers who can manipulate the xajaxargs parameter of /grid/vgrid_server.php. Affected versions span the 5.1.0 and 5.4.0 release lines; patched releases 5.1.1 and 5.4.1 are available. No public exploit identified at time of analysis per CISA KEV, but a public proof-of-concept exists, and the EPSS score of 0.03% confirms very limited real-world exploitation activity to date.

Cool Mo Maigcal Number App versions 1.0.0 through 1.0.3 on Android contain improper export of application components in AndroidManifest.xml, allowing local authenticated attackers to access sensitive functionality of the com.sdmagic.number component. While CVSS severity is minimal (1.9), publicly available exploit code exists; exploitation requires local device access and authenticated privileges but carries information disclosure impact.

Improper export of Android application components in Lobby Universe Lobby App versions 2.0 through 2.8.0 allows local attackers with user-level privileges to access sensitive functionality via the com.maverick.lobby component. The vulnerability stems from AndroidManifest.xml misconfiguration that exposes internal application activities without proper permission protection, enabling local privilege escalation or information disclosure. Publicly available exploit code exists, though exploitation requires local device access and authenticated user privileges.

ChanCMS up to version 3.1.2 permits information disclosure through improper validation of accessKey and secretKey parameters in the /sysApp/find endpoint, allowing authenticated remote attackers to access sensitive data. The vulnerability has a low CVSS score of 2.1 (CVSS:4.0/AV:N/AC:L/PR:L) reflecting limited confidentiality impact and requirement for low-privilege authentication, but publicly available exploit code exists and exploitation probability (EPSS 0.09%) is extremely low, suggesting this is a narrow-scope, low-urgency issue despite public disclosure.

Memory leak in GNU Binutils 2.44 DWARF section handler allows local authenticated users to consume memory resources, potentially leading to denial of service. The vulnerability exists in the process_debug_info function of binutils/dwarf.c and is triggered during DWARF debug information parsing. Publicly available exploit code exists, and a vendor patch has been released.

Improper export of Android application components in Yeelink Yeelight App up to version 3.5.4 allows local attackers with user-level privileges to access sensitive application functions through the AndroidManifest.xml configuration of the com.yeelight.cherry component. The vulnerability has a very low real-world impact (CVSS 1.9, EPSS 0.03%) despite public exploit availability, as exploitation requires local device access and user-level privileges, limiting practical attack scenarios to compromised or physically accessible devices.

Improper export of Android application components in Canara ai1 Mobile Banking App version 3.6.23 allows local attackers with user-level privileges to access sensitive exported components via AndroidManifest.xml misconfigurations. The vulnerability enables information disclosure with low confidentiality impact. Public exploit code exists but real-world exploitation risk is minimal (EPSS 0.03%, CVSS 1.9) due to requirement for local device access and authenticated user privileges.

Comodo Dragon up to version 134.0.6998.179 transmits sensitive DNS information in cleartext via its IP DNS Leakage Detector component, allowing remote attackers to intercept and read this data. The vulnerability has a low CVSS score of 2.9 (limited confidentiality impact) but is marked as having publicly available exploit code with difficult exploitation complexity. The vendor was notified but did not respond, and active exploitation is not confirmed despite public disclosure.

Comodo Dragon browser versions up to 134.0.6998.179 contain an HSTS Handler vulnerability that bypasses security checks for standard compliance, allowing remote attackers with user interaction to disclose sensitive information. The CVSS score of 1.3 reflects high attack complexity and limited integrity impact, but public exploit code is available and the vendor did not respond to early disclosure, leaving affected users without official patches.

Weak password requirements in Tenda AC18 firmware version 15.03.05.19 allow remote attackers to conduct brute-force attacks against Samba authentication via the /etc_ro/smb.conf configuration file. The vulnerability requires high attack complexity and has been publicly disclosed, though exploitation difficulty remains elevated. CVSS 2.9 and EPSS 0.07% (20th percentile) indicate low real-world risk despite proof-of-concept availability.

Remote root access in Gardyn Home Kit Firmware via SSH private key compromise allows authenticated remote attackers with high privileges to execute arbitrary commands as root on affected devices. The vulnerability stems from improper cryptographic key management (CWE-321) and carries a CVSS score of 6.6; no public exploit code or active exploitation has been independently confirmed at the time of analysis.

Linux kernel uprobes implementation allows local privileged users to cause denial of service by placing probes at invalid instruction boundaries, exploiting variable-length instruction decoding and mixing of data in text segments on architectures like ARM64. The vulnerability requires CAP_SYS_ADMIN capability, limiting exposure to privileged local attackers. Patch available across multiple stable kernel branches (6.16-rc1 through rc4 and earlier versions).

Integer wraparound in Linux kernel netlink socket receive buffer accounting allows local authenticated attackers to exhaust kernel memory by bypassing receive buffer limits via integer overflow in sk_rmem_alloc comparison. An attacker with local access can set SO_RCVBUFFORCE to INT_MAX, causing the receive buffer check to always evaluate false and permitting unlimited socket buffer allocation until out-of-memory conditions occur. CVSS 5.5 indicates local denial of service with potential system-wide impact; no active exploitation confirmed but vulnerability affects all Linux distributions.

Denial of service in Linux kernel traffic control (qdisc) subsystem allows local authenticated attackers to crash the system by creating or modifying queue disciplines with invalid parent class references. When certain qdiscs (fq, hhf, choke, etc.) invoke qdisc_tree_reduce_backlog during initialization with a null parent class, they trigger an unhandled null pointer dereference. No active exploitation confirmed (KEV not listed), but CVSS 5.5 reflects local privilege requirement with high availability impact.

A general protection fault (GPF) in the Linux kernel's md-bitmap module affects the bitmap_get_stats() function when reading bitmap statistics for RAID devices with external bitmaps. Local users with sufficient privileges can trigger a kernel panic by accessing bitmap statistics through the /proc interface, causing denial of service. The vulnerability stems from incomplete validation of bitmap storage configuration introduced by a prior fix that failed to properly check superblock validity for both internal and external bitmap modes.

Linux kernel DRM scheduler fails to signal scheduled fences when killing job entities, causing dependent applications to hang indefinitely waiting for unresolved dependencies. Authenticated local users can trigger this denial of service by terminating applications whose job dependencies are not properly cleared during entity kill operations. The vulnerability affects multiple Linux kernel versions and has been patched upstream.

Denial of service in Linux kernel nfsd (NFS server daemon) allows local authenticated attackers to crash the system by triggering undefined behavior in nfsd4_spo_must_allow() when non-v4 compound RPC requests are processed. The vulnerability stems from missing validation that incoming RPC procedures are NFSv4 COMPOUND requests before examining internal state structures, causing memory access violations and system unavailability.

Linux kernel NFS subsystem fails to clean up /proc/net/rpc/nfs directory when nfs_fs_proc_net_init() encounters a memory allocation failure, causing a warning when rpc_proc_exit() later attempts to remove the non-empty parent directory. The vulnerability affects kernel versions 6.16-rc1 through 6.16-rc3 and likely earlier versions, and requires local privileges to trigger via fault injection or memory pressure. While marked as availability impact (DoS via kernel warning), the practical severity is limited as it primarily causes a procfs resource leak rather than direct system compromise.

Race condition in Linux kernel NFSv4/pNFS layout draining allows local authenticated users to trigger denial of service through system hangs in writeback operations. The vulnerability exists in pnfs_update_layout() where a waiter on the NFS_LAYOUT_DRAIN bit can race with the waker when plh_outstanding count reaches zero, causing threads to block indefinitely on page locks. Patch available from upstream kernel stable branches.

Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Firefox and Thunderbird URL truncation flaw enables spoofing attacks by displaying misleading origins in the address bar. Affects all Firefox versions prior to 141 and corresponding Thunderbird releases. Attackers can craft URLs that hide the true destination, tricking users into visiting malicious sites. Publicly available exploit code exists. CVSS 9.8 critical rating reflects network-based attack requiring no authentication, though real-world exploitation requires social engineering (user interaction despite UI:N vector).

Search term leakage in Mozilla Firefox and Thunderbird URL bars exposes sensitive user queries to unauthorized parties when URLs are shared or logged. Firefox versions prior to 141 (regular) and 140.1 (ESR), and Thunderbird versions prior to 141 (regular) and 140.1 (ESR) fail to properly clear search parameters from the URL bar after navigation, enabling information disclosure through shoulder surfing, screenshot sharing, browser history exports, or URL-based tracking. No public exploit identified at time of analysis, though the attack requires only user interaction (EPSS data not provided). CVSS 8.1 reflects high confidentiality and integrity impact despite requiring user interaction.

Frame navigation validation bypass in Mozilla Firefox and Thunderbird allows unauthenticated remote attackers to violate security boundaries due to improper path checking (CWE-345). Affects Firefox <141, Firefox ESR <140.1, Thunderbird <141, and Thunderbird ESR <140.1. The CVSS 9.8 critical score reflects network-based exploitation with no user interaction required, enabling potential unauthorized access, data manipulation, and service disruption. No public exploit identified at time of analysis, though the network attack vector (AV:N) and low complexity (AC:L) suggest straightforward exploitation once technical details emerge.

Cookie shadowing in Mozilla Firefox (versions prior to 141 and ESR prior to 140.1) and Thunderbird (versions prior to 141 and ESR prior to 140.1) allows remote unauthenticated attackers to bypass Secure cookie protections and access or modify session data. A nameless cookie containing an equals sign set over insecure HTTP can override cookies with the Secure attribute, enabling session hijacking or authentication bypass. No public exploit identified at time of analysis, though the attack complexity is low (CVSS AC:L) with network-based attack vector requiring no user interaction.

DNS rebinding attacks can bypass Cross-Origin Resource Sharing (CORS) protections in Mozilla Firefox and Thunderbird due to improper cache invalidation of CORS preflight responses when target IP addresses change. Remote attackers can exploit this via malicious websites to access confidential cross-origin data without user authentication (CVSS: PR:N, UI:R). No public exploit identified at time of analysis, though CERT VU#652514 provides technical disclosure. EPSS data not provided, but the combination of network-accessible attack vector, low complexity, and no required privileges warrants attention for organizations using affected Mozilla products.

WebAssembly JIT compiler on ARM64 architectures incorrectly calculates branch addresses when processing WASM br_table instructions with numerous entries, enabling remote code execution in Firefox <141, Firefox ESR <115.26/128.13/140.1, and Thunderbird <141/128.13/140.1. The vulnerability requires no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), allowing network-based attackers to potentially execute arbitrary code through malicious WASM content. Vendor-released patches are available across all affected product lines. No public exploit identified at time of analysis, though the CVSS 9.8 critical rating reflects the theoretical severity of unauthenticated remote code execution.

Information disclosure in Mozilla Firefox and Thunderbird on 64-bit platforms allows remote attackers to leak sensitive memory contents via specially crafted web content. The IonMonkey JIT compiler writes only 32 bits of the 64-bit return value space on the stack, while the Baseline JIT reads the entire 64 bits, exposing uninitialized stack memory. Exploitation requires user interaction (UI:R) and no authentication. Fixes are available: Firefox 141+, Firefox ESR 115.26+, Firefox ESR 128.13+, Firefox ESR 140.1+, Thunderbird 141+, Thunderbird 128.13+, and Thunderbird 140.1+.

Uninitialized variable in libssh's privatekey_from_file() function can cause heap corruption or signing failures when a non-existent key file is specified, allowing local authenticated attackers to trigger memory corruption with potential for information disclosure. CVSS 3.6 reflects local attack vector and high complexity; exploitation requires authenticated access and specific file conditions.

HTTP Response Splitting in HotelRunner's B2B hospitality platform stems from improper certificate-host mismatch validation (CWE-297), enabling an authenticated low-privilege attacker to inject crafted headers into HTTP responses when a victim user interacts with the vulnerable flow. Successful exploitation can lead to cache poisoning, session hijacking, or content injection with limited confidentiality and integrity impact (C:L/I:L). No public exploit exists and EPSS sits at 0.07% (21st percentile), indicating no observed widespread exploitation at time of analysis.

Weak password recovery in jshERP up to version 3.5 allows authenticated remote attackers to compromise user accounts via the /jshERP-boot/user/updatePwd endpoint. The vulnerability enables password reset functionality without adequate protection mechanisms, classified as problematic with CVSS 2.1 and EPSS 0.06%. Publicly available exploit code exists but active exploitation remains unconfirmed.

Improper authorization in jshERP up to version 3.5 allows authenticated remote attackers to modify or delete user accounts via manipulation of the ID parameter in the /user/delete endpoint, potentially resulting in unauthorized account manipulation and information disclosure. Publicly available exploit code exists for this vulnerability.

Improper export of Android application components in Genshin Albedo Cat House App 1.0.2 allows local attackers with user privileges to access sensitive information through AndroidManifest.xml misconfigurations in the com.house.auscat component. The vulnerability requires local access and authenticated user privileges but carries minimal real-world risk due to low EPSS (0.02%) and the constraint of local-only exploitation.

Cleartext identity exposure in the TRENDnet TEW-WLC100P wireless controller (firmware 2.03b03) stems from its bundled racoon IKE daemon shipping with aggressive mode as the first exchange_mode entry. Because IKE Phase 1 aggressive mode transmits identity payloads in plaintext and sends a hash of the pre-shared key that can be captured, any party observing or initiating a negotiation can harvest identities and mount offline dictionary attacks against the PSK. No public exploit identified at time of analysis and the EPSS probability is low (0.27%, 19th percentile), consistent with a configuration-hardening weakness rather than a mass-exploited flaw.

Pre-Shared Key hash disclosure affects the TRENDnet TEW-WLC100P wireless LAN controller running firmware 2.03b03, whose bundled strongSwan configuration ships with the i_dont_care_about_security_and_use_aggressive_mode_psk option enabled by default. Because the IKE responder accepts IKEv1 Aggressive Mode with PSK, it transmits the PSK hash in the clear during negotiation, letting a network-positioned attacker capture it and mount an offline dictionary/brute-force crack to recover the VPN pre-shared secret. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low (0.36%), reflecting an information-disclosure weakness rather than direct remote code execution.

RuoYi up to version 4.8.1 uses hardcoded default credentials in the Druid database configuration file (application-druid.yml), allowing authenticated remote attackers to gain low-impact information disclosure. The vulnerability requires prior authentication (PR:L per CVSS 4.0) and has been publicly disclosed with exploit details available, though EPSS scoring (0.05%) and the low CVSS impact (VC:L only) suggest limited real-world exploitation risk despite the proof-of-concept availability.

Foresight News App for Android versions up to 2.6.4 improperly exports application components via AndroidManifest.xml, allowing local attackers with limited privileges to access sensitive information. The CVSS 1.9 score reflects low actual impact (information disclosure only, no integrity or availability loss), though the vulnerability is publicly exploitable. EPSS percentile of 13% indicates minimal real-world exploitation likelihood despite public POC availability, suggesting this is a low-priority issue for most deployments.

IDnow App for Android up to version 9.6.0 improperly exports application components via AndroidManifest.xml misconfiguration, allowing local attackers with user-level privileges to access sensitive functionality or information disclosure. The vulnerability is classified as low severity (CVSS 1.9) with publicly available exploit code, but the vendor has not responded to disclosure and no patch has been released. While exploitation requires local device access and legitimate app installation, the improper component export could enable privilege escalation or data theft when combined with other vulnerabilities.

InstantBits Web Video Cast on Android versions up to 5.12.4 improperly exports application components via AndroidManifest.xml configuration, allowing local attackers with user privileges to access sensitive functionality without authentication. The vulnerability has a CVSS score of 1.9 with low confidentiality impact and no integrity or availability impact, but is rated problematic due to the disclosure of exploitation techniques and vendor non-responsiveness. This is a local, low-severity information disclosure issue affecting only users with direct device access.

Dunamu StockPlus Android app versions up to 7.62.10 improperly export application components via AndroidManifest.xml configuration, allowing local attackers with low privileges to access sensitive functionality. The vulnerability requires local device access and affects the com.dunamu.stockplus component, resulting in limited information disclosure. Publicly available exploit code exists, and the vendor did not respond to early disclosure notification.

CallApp Caller ID App versions up to 2.0.4 on Android improperly export application components via AndroidManifest.xml misconfiguration, allowing local authenticated attackers to access sensitive functionality with limited information disclosure impact. The vulnerability has been publicly disclosed with exploit code available, though the CVSS score of 1.9 and EPSS of 0.03% indicate minimal real-world exploitation risk despite public POC availability.

Eluktronics Control Center 5.23.51.41 permits local authenticated users to bypass data authenticity verification in the REG File Handler component, resulting in potential information disclosure. The vulnerability requires local access and authenticated privileges but carries minimal real-world impact given the CVSS 1.9 score and EPSS exploitation probability of 0.01% (third percentile). Public exploit code has been disclosed, though vendor has not responded to disclosure notifications.

Improper brute-force protection in the Mercusys MW301R router allows local network attackers to conduct excessive authentication attempts against the login component without rate limiting. The vulnerability affects firmware version 1.0.2 Build 190726 Rel.59423n and permits attackers to bypass authentication attempt restrictions, though actual credential compromise requires additional attack complexity. Public exploit code exists, but the vendor has not responded to disclosure and provided no patch.

Weak password recovery in Mercusys MW301R 1.0.2 Build 190726 allows high-privileged authenticated attackers to manipulate the code argument in the web interface to disclose or modify password recovery mechanisms, with publicly available exploit code. The vendor has not responded to early disclosure notification. EPSS exploitation probability is 0.04% (13th percentile), indicating minimal real-world exploitation likelihood despite public POC availability.

Use-after-free in Linux Kernel traffic control (qdisc) subsystem allows local authenticated attackers to execute arbitrary code, escalate privileges, or cause denial of service. Affects Linux Kernel versions prior to vendor-released patches across multiple stable branches (6.6.x, 6.12.x, 6.15, 6.16-rc1). Triggered when classful qdiscs like DRR and HFSC incorrectly handle child class deactivation during enqueue operations, leaving stale class pointers that can be exploited after deletion. Vendor patches available from kernel.org git stable tree; no active exploitation confirmed (not in CISA KEV), but PoC reproducer exists in public advisory.

Server-Side Request Forgery in Agorum core open's TunnelServlet component exposes internal and external network resources to unauthenticated remote attackers through crafted HTTP requests. Affected versions are 11.9.2 and 11.10.1 of the agorum Software GmbH document management platform. No active exploitation is confirmed and the EPSS score sits at the 10th percentile (0.20%), indicating low observed exploitation pressure at time of analysis, though the zero-authentication requirement lowers the barrier for opportunistic scanning.

Plaintext credential storage in agorum core open versions 11.9.2 and 11.10.1 exposes stored account credentials to anyone able to read the underlying storage, undermining the confidentiality of any account whose secrets are persisted by this German enterprise content and document management platform. The flaw, tracked as CWE-256 and reported in usd HeroLab advisory usd-2025-0023, carries a vendor/NVD CVSS of 8.2 but no public exploit identified at time of analysis and no CISA KEV listing. Disclosed credentials can be reused to impersonate users or pivot into connected systems.

XML External Entity (XXE) injection in agorum core open's RSSReader endpoint enables remote attackers to exfiltrate sensitive server-side data by submitting crafted XML payloads. Affected versions are v11.9.2 and v11.10.1 of this document management platform. EPSS exploitation probability sits at 0.22% (13th percentile), no public exploit code has been identified, and the vulnerability is not listed in CISA's KEV catalog - indicating low observed exploitation pressure despite the network-accessible, unauthenticated attack surface described by the CVSS vector.

Splashin iOS v2.0 fails to enforce server-side rate limiting on location update frequency for free-tier accounts, allowing free users to bypass tier-based restrictions and submit location updates at an unrestricted rate. Confirmed by CPE (cpe:2.3:a:splashin:splashin:2.0:*:*:*:*:iphone_os:*:*), this business logic flaw exposes the platform's API to abuse by any free-tier account holder. A publicly available proof-of-concept is referenced via NVD exploit tag; EPSS sits at 0.36% (28th percentile), indicating low probability of widespread automated exploitation.

Token generation in Xuxueli xxl-job up to version 3.1.1 uses password hashing with insufficient computational effort (weak bcrypt configuration or equivalent), allowing attackers to crack authentication tokens through brute force. The vulnerability affects the makeToken function in IndexController.java and has low practical impact (confidentiality impact only, no integrity or availability damage), but exploitation requires high attack complexity and is not known to be actively exploited at scale despite public disclosure of the vulnerability.

Local privilege escalation in the Linux kernel’s eventpoll subsystem allows a local attacker to trigger a use-after-free by exploiting a race condition in reference counting, potentially leading to arbitrary code execution or system crash. Affected Linux kernel versions up to 6.16-rc5 are vulnerable; a vendor patch is available. No active exploitation is known, but the flaw is easily exploitable by an unprivileged local user.

Weak cryptography in Brocade Active Support Connectivity Gateway (ASCG) versions prior to 3.3.0 exposes local communications on internal ports 9000 and 8036 to potential decryption and tampering. Local attackers with no privileges can compromise confidentiality and integrity of data transmitted through these internal service ports. No public exploit identified at time of analysis. EPSS data not available, but the local attack vector (AV:L) limits remote exploitation risk despite the 8.6 CVSS score.

JSON Web Token exposure in Brocade Active Support Connectivity Gateway (ASCG) prior to version 3.3.0 enables high-privileged local attackers to extract unencrypted authentication tokens from log files, leading to unauthorized access and session hijacking. This CWE-532 (insertion of sensitive information into log file) vulnerability requires local access with high privileges but presents low attack complexity. EPSS data not provided; no confirmed active exploitation (not present in CISA KEV); no public exploit code identified at time of analysis. The CVSS 4.0 score of 7.1 reflects significant confidentiality and integrity impact within the vulnerable component scope.

Local file inclusion vulnerability in HT Contact Form 7 plugin version 2.0.0 and earlier allows unauthenticated attackers to read arbitrary files from the server filesystem, potentially exposing sensitive configuration files, credentials, and source code. The vulnerability exists in PHP file inclusion/require statements that fail to properly validate or sanitize user-supplied input, enabling attackers to traverse the directory structure and access files outside the intended directory scope. With an EPSS score of 0.14% indicating low exploitation probability despite the technical capability, this vulnerability requires direct web interaction but poses information disclosure risks rather than remote code execution.

In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. Rated medium severity (CVSS 6.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

LaRecipe versions prior to 2.8.1 contain a Server-Side Template Injection (SSTI) vulnerability that can lead to Remote Code Execution (RCE) in vulnerable configurations. The vulnerability allows unauthenticated network attackers to execute arbitrary commands on the server, access sensitive environment variables, and escalate privileges without requiring user interaction or special access. With a perfect CVSS 3.1 score of 10.0 and network-based attack vector, this represents a critical threat to all unpatched LaRecipe installations.

WeGIA versions prior to 3.4.5 contain a SQL Injection vulnerability in the member deletion endpoint that allows authenticated users to execute arbitrary SQL commands via the `id_socio` parameter. This high-severity vulnerability (CVSS 8.8) compromises the confidentiality, integrity, and availability of the entire database. The vulnerability requires valid credentials to exploit but offers complete database compromise once authenticated.

CVE-2025-53819 is a privilege escalation vulnerability in Nix 2.30.0 on macOS where package builds are incorrectly executed with root privileges instead of restricted build user accounts. This affects macOS systems running Nix 2.30.0, allowing local attackers with standard user privileges to execute arbitrary code with root-level access during package builds. The vulnerability was patched in Nix 2.30.1, and no public exploits or known workarounds are currently available, though the high CVSS score (7.9) reflects the severity of privilege escalation with potential system-wide impact.

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Starting in version 2.2 and prior to version 3.3.7, an endpoint used to display details of users listed in certain fields (such as ACLs) could be misused to dump basic user details (such as name, affiliation and email) in bulk. Version 3.3.7 fixes the issue. Owners of instances that allow everyone to create a user account, who wish to truly restrict access to these user details, should consider restricting user search to managers. As a workaround, it is possible to restrict access to the affected endpoints (e.g. in the webserver config), but doing so would break certain form fields which could no longer show the details of the users listed in those fields, so upgrading instead is highly recommended.

CVE-2025-53623 is an arbitrary code execution vulnerability in the Job Iteration API's CsvEnumerator class affecting versions prior to 1.11.0. An unauthenticated remote attacker can execute arbitrary system commands by supplying malicious input to CSV file processing methods, particularly the count_of_rows_in_file method, potentially leading to complete system compromise. The vulnerability has a CVSS score of 8.1 indicating high severity with network-accessible attack vector and no privilege requirements.

ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-0 and 6.9.13-26, in ImageMagick's `magick stream` command, specifying multiple consecutive `%d` format specifiers in a filename template causes a memory leak. Versions 7.1.2-0 and 6.9.13-26 fix the issue.

CVE-2025-53015 is a denial-of-service vulnerability in ImageMagick versions prior to 7.1.2-0 that causes infinite loops during XMP file conversion operations. An unauthenticated attacker can trigger this vulnerability remotely by submitting a maliciously crafted XMP file, resulting in resource exhaustion and service unavailability. The vulnerability has a CVSS score of 7.5 (High) due to its network-exploitable nature and availability impact, though it does not affect confidentiality or integrity.

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the `InterpretImageFilename` function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processing format strings containing consecutive percent signs (`%%`). Versions 7.1.2-0 and 6.9.13-26 fix the issue.

A arbitrary file access vulnerability in the component /admin/Backups.php of Mccms (CVSS 5.5) that allows attackers. Risk factors: public PoC available.

CVE-2024-51770 is an information disclosure vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17 that allows unauthenticated remote attackers to access sensitive information over the network. The vulnerability has a CVSS score of 7.5 with high confidentiality impact, enabling attackers to extract confidential data without requiring authentication, special privileges, or user interaction. The network-accessible nature of this information disclosure makes it a significant risk for organizations running vulnerable APLS versions.

CVE-2024-51769 is an information disclosure vulnerability in HPE AutoPass License Server (APLS) versions prior to 9.17 that allows unauthenticated network attackers to access sensitive information without requiring user interaction. The vulnerability has a CVSS 3.1 score of 7.5 with a high confidentiality impact (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor), making it a significant risk for organizations relying on APLS for license management across their HPE infrastructure.

Apache Jackrabbit versions prior to 2.23.2 contain blind XXE (XML External Entity) vulnerabilities in jackrabbit-spi-commons and jackrabbit-core components due to unsafe XML document parsing when loading privilege definitions. An authenticated attacker with low privileges can exploit this to achieve high-impact confidentiality, integrity, and availability compromise. The vulnerability requires user authentication (PR:L) but has no interaction requirement and affects all systems regardless of scope.

A security vulnerability in A vulnerability in the External Interface of OTRS (CVSS 5.3) that allows conclusions. Remediation should follow standard vulnerability management procedures.

A arbitrary file access vulnerability (CVSS 7.1) that allows an attacker. High severity vulnerability requiring prompt remediation.

A information disclosure vulnerability (CVSS 8.7). High severity vulnerability requiring prompt remediation.

CVE-2025-7576 is a critical improper access control vulnerability affecting Teledyne FLIR thermal imaging devices (FB-Series O and FH-Series) running firmware version 1.3.2.16 and earlier. An unauthenticated remote attacker can exploit the vulnerable /priv/production/production.html endpoint to gain unauthorized access with low complexity, potentially reading, modifying, or disrupting system availability. Public exploit code exists and the vendor has not responded to disclosure, increasing real-world exploitation risk.

A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM, the issue allows an attacker to inject malicious scripts into the folder name field while creating a new shared folder. These scripts are not properly sanitized and will be executed when the folder name is subsequently displayed in the user interface. This allows attackers to execute arbitrary JavaScript in the context of another user's session, potentially accessing session cookies or other sensitive data. Affected products and versions include: from ADM 4.1.0 to ADM 4.3.3.RH61 as well as ADM 5.0.0.RIN1 and earlier.

A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This issue affects the function bs_GetManPwd in the library libblinkapi.so of the file /cgi-bin/lighttpd.cgi. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as critical was found in LB-LINK BL-AC1900, BL-AC2100_AZ3, BL-AC3600, BL-AX1800, BL-AX5400P and BL-WR9000 up to 20250702. This vulnerability affects the function bs_GetHostInfo in the library libblinkapi.so of the file /cgi-bin/lighttpd.cgi. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability, which was classified as critical, was found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function geteasycfg of the file /cgi-bin/lighttpd.cgi of the component Web Management Interface. The manipulation of the argument Password leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A remote code execution vulnerability in Dromara Northstar (CVSS 6.3). Remediation should follow standard vulnerability management procedures.

CVE-2024-41169 is an unauthenticated information disclosure vulnerability in Apache Zeppelin's raft server protocol that allows remote attackers to enumerate and view server resources, including sensitive directories and files, without authentication. Versions 0.10.1 through 0.12.0 are affected. The vulnerability has a CVSS score of 7.5 (High) with a network-accessible attack vector and no authentication requirements, making it trivially exploitable by unauthenticated remote actors.

IBM Storage Scale 5.2.3.0 and 5.2.3.1 could allow an authenticated user to obtain sensitive information from files due to the insecure permissions inherited through the SMB protocol.